/**
 * Line patterns for `security scan` phase 3, and what each line is tested on.
 *
 * The patterns are a heuristic. Each is narrowed only where a false positive was seen on a real tree, and only by a
 * shape that cannot carry the risk the rule looks for:
 *  - every rule is tested after comment text is blanked, so a comment naming `child_process.execFile` or `eval(` is
 *    not a finding;
 *  - eval needs a word start: "retrieval (" in prose is not a call; `eval(` and `window.eval(` still are;
 *  - command injection keeps the old rule's reach (any `exec` after `child_process` on the line), and also catches
 *    dynamic exec/execSync command strings when the import was on another line;
 *  - a pg placeholder such as `$${paramCount + 1}` is a parameter number, not a value in the SQL text. It is exempt only
 *    when its expression is a number, a loop letter, `params.length`-style, or a name containing `param` or `placeholder`, it
 *    stands where SQL takes a value, and it is not inside a quoted SQL string.
 */
export type CodePattern = {
    /** Tested on one comment-stripped line. */
    match: (line: string) => boolean;
    type: string;
    severity: 'high' | 'medium';
    desc: string;
};
/**
 * `$${paramCount}` / `LIMIT $${params.length + 1}`: the pg parameter number where SQL takes a value, not interpolated
 * SQL text. `'$${n}'`, `"$${n}"`, `$${userInput}` and `x $${discount}` keep their interpolation. One left-to-right
 * pass: quotes are counted since the last backtick, so a placeholder inside a quoted SQL string keeps its finding.
 */
export declare const withoutPlaceholders: (line: string) => string;
export declare const CODE_PATTERNS: readonly CodePattern[];
/**
 * The file's lines with comment text blanked (line count kept, so locations stay right). Strings are respected, so
 * `'http://x'` is not a comment; a template literal may span lines. Regex literals and JSX text are not parsed, so a
 * `//`, `/*` or backtick inside one can be misread. The damage is bounded to one line: a block comment carries to the
 * next line only from a `/*` that starts its line, and only through lines that look like comment lines (they start
 * with `*` or contain the closing `*` + `/`). Any other line ends the carried comment and is scanned as code. One pass,
 * linear in the file size.
 */
export declare function codeLinesOf(content: string): string[];
/** True for an istanbul or Playwright asset, given its parent folder's name and what the parent folder holds. */
export declare function isGeneratedReportAsset(parentName: string, entryName: string, parentHas: (name: string) => boolean): boolean;
//# sourceMappingURL=security-code-patterns.d.ts.map