/**
 * Provenance Resolver — Spec 21
 *
 * Language-neutral DB and validator receiver detection through
 * provenance tracking instead of English name matching.
 *
 * "Where did this variable's value come from?" rather than
 * "Is this variable named 'db'?"
 *
 * ─── Architecture ───
 *   1. extractDBProvenancedImports   → seed identifiers from known package imports
 *   2. propagateProvenance           → follow assignments, destructuring, params
 *   3. buildProvenanceContext        → combine seeds + propagation + fallbacks (R3)
 *   4. isDBProvenanced               → answer: is this call-expression DB-bound?
 *
 * ─── Modes (R3) ───
 *   hybrid     (default) — provenance-primary + conjunctive name-fallback
 *   provenance            — strict provenance only, never consults name lists
 *   names                 — legacy English-only name matching (opt-in escape hatch)
 */
import type { AST, LanguageAdapter, ASTNode } from '../languages/types.js';
/** Database packages — spec R1.1 */
export declare const DB_PACKAGES: ReadonlySet<string>;
/** Validator packages — spec R4.1 */
export declare const VALIDATOR_PACKAGES: ReadonlySet<string>;
/** Known DB type names — spec R1.1 (propagation rule 8) */
export declare const DB_TYPES: ReadonlySet<string>;
/** DB call methods — the fixed API surface (language-invariant) */
export declare const DB_CALL_METHODS: ReadonlySet<string>;
/** ORM method patterns — fixed API surface for ORM recognition (Spec 21 R1) */
export declare const ORM_METHODS: ReadonlySet<string>;
export type ProvenanceReason = 'package' | 'binding' | 'type' | 'propagation' | 'fallback';
export interface ProvenanceEvidence {
    identifier: string;
    reason: ProvenanceReason;
    /** Human-readable source of provenance, e.g. "import from better-sqlite3" */
    source: string;
    /** Chain of propagation — each hop records the intermediate identifier */
    chain: string[];
}
export type DetectionMode = 'hybrid' | 'provenance' | 'names';
export interface DetectionConfig {
    mode: DetectionMode;
}
export interface ProvenanceContext {
    /** All DB-provenanced identifiers in the current file */
    dbProvenanced: Map<string, ProvenanceEvidence>;
    /** All validator-provenanced identifiers in the current file */
    validatorProvenanced: Map<string, ProvenanceEvidence>;
    /** Active detection mode */
    mode: DetectionMode;
}
export interface InferredReceiverSet {
    identifiers: string[];
    evidence: Array<{
        identifier: string;
        reason: string;
    }>;
}
/**
 * Extract all DB-provenanced identifiers from a file's import statements.
 *
 * An import like `import Database from 'better-sqlite3'` produces
 * `Database` as DB-provenanced with reason "package".
 */
export declare function extractDBProvenancedImports(ast: AST, adapter: LanguageAdapter): Map<string, ProvenanceEvidence>;
/**
 * Extract all validator-provenanced identifiers from a file's imports.
 * Same pattern as extractDBProvenancedImports but for validator packages.
 */
export declare function extractValidatorProvenancedImports(ast: AST, adapter: LanguageAdapter): Map<string, ProvenanceEvidence>;
/**
 * Propagate provenance through assignments, destructuring, parameters,
 * class fields, and type annotations within a single file.
 *
 * The 8 single-file propagation rules (spec R1):
 *   1. new Expression → variable
 *   2. DB-provenanced call return → variable
 *   3. member expression on DB receiver → variable
 *   4. object destructuring from DB source
 *   5. array destructuring from DB source
 *   6. default parameter with DB value
 *   7. class field initialized with DB value
 *   8. type annotation with known DB type
 */
export declare function propagateProvenance(ast: AST, adapter: LanguageAdapter, sourceCode: string, seedMap: Map<string, ProvenanceEvidence>): Map<string, ProvenanceEvidence>;
export interface BuildProvenanceContextOptions {
    mode: DetectionMode;
    /** Name lists used in hybrid/names fallback modes */
    dbReceiverNames?: string[];
    dbBindingNames?: string[];
    dbCallMethods?: string[];
    /** Validator package list override (defaults to VALIDATOR_PACKAGES) */
    validatorPackageList?: string[];
}
/**
 * Build a ProvenanceContext for a file.
 *
 * This is the main entry point — call once per file before analysis.
 * Combines import extraction, propagation, and mode-based fallback.
 */
export declare function buildProvenanceContext(ast: AST, adapter: LanguageAdapter, sourceCode: string, options: BuildProvenanceContextOptions): ProvenanceContext;
/**
 * Determine if a call-expression node's callee is DB-provenanced.
 *
 * This replaces the old `isDBCallee()` / `isDbCallNode()` name-based
 * pattern matching in UniversalDataAccessAnalyzer.
 *
 * Checks:
 *   1. Simple identifier call → is the identifier DB-provenanced?
 *   2. Member expression call → is the receiver DB-provenanced AND is the
 *      method in the DB call method set?
 *   3. ORM patterns → receiver is DB-provenanced and method matches ORM API
 */
export declare function isDBProvenanced(node: ASTNode, adapter: LanguageAdapter, sourceCode: string, context: ProvenanceContext, dbCallMethods?: ReadonlySet<string>): boolean;
/**
 * Check if an identifier is validator-provenanced (R4 infrastructure).
 *
 * This will be consumed by Spec 15's validator-bypass detection.
 */
export declare function isValidatorProvenanced(identifier: string, context: ProvenanceContext): boolean;
/**
 * Infer additional DB receivers by tracing identifiers that call DB methods
 * back through assignment chains to provenanced sources.
 *
 * This is the conjunctive inference guard in action: an identifier is only
 * inferred if it (a) appears as a receiver of a known DB call method AND
 * (b) can be traced back to a provenanced source through assignments.
 *
 * Deferred: full implementation in R2 step.
 */
export declare function inferReceivers(provenancedSet: Map<string, ProvenanceEvidence>, fileAst: AST, adapter: LanguageAdapter, sourceCode: string): InferredReceiverSet;
//# sourceMappingURL=provenance.d.ts.map