/**
 * True if a route parameter (params / searchParams) reaches a DB/query sink in
 * this file, following assignments and query-builder calls. Returns true (the safe
 * default — don't suppress) when TypeScript is unavailable or parsing fails, so
 * the rule keeps its prior behavior rather than silently hiding a finding.
 */
export declare function paramReachesSink(code: string, filePath?: string): boolean;
/**
 * BOLA ownership-guard detection for VG950 (find-by-user-id). Returns true (the
 * query is ownership-guarded → suppress the finding) when EITHER:
 *  (1) the find call's WHERE clause (not select!) contains an ownership field
 *      whose value is not itself a route param, OR
 *  (2) the enclosing function performs a post-fetch ownership comparison of an
 *      ownership field against a session/user value.
 * Returns false on uncertainty (no parser, no matching call) so the rule keeps
 * firing — for a BOLA rule we prefer a false positive over hiding a real one.
 */
export declare function bolaOwnershipGuarded(code: string, filePath: string | undefined, line: number): boolean;
/**
 * BOLA ownership-guard detection for VG951 (delete/update). The rule's regex
 * already suppresses an ownership field inside the mutation's WHERE clause (via a
 * negative lookahead), so the only blind spot is the find → compare → mutate
 * pattern: the mutation's where-clause is a bare id, but the enclosing function
 * fetched the resource and compared its ownership field against the session first.
 * Returns true (→ suppress) only when that post-fetch comparison is present;
 * false on uncertainty so a genuinely unguarded mutation keeps firing.
 */
export declare function bolaMutationGuarded(code: string, filePath: string | undefined, line: number): boolean;
/**
 * Find SQL-sink calls whose first argument is a BARE identifier (the multi-hop shape
 * the inline regex can't see). Returns the 1-based sink line and the variable name so
 * the taint engine can confirm the variable is a user-tainted SQL string before
 * reporting. Empty (no suppression of other paths) when TypeScript is unavailable or
 * the parse fails. The first argument must be a plain identifier — an inline
 * string/template/concat is already covered by the regex sinks and is skipped here.
 */
export declare function bareVarSqlSinks(code: string, filePath?: string): Array<{
    line: number;
    varName: string;
}>;
/**
 * True when the argument to a `new RegExp(...)` at `line` is PROVABLY a constant
 * (a string literal, a variable assigned from a string literal, or the callback
 * parameter of an iteration over a const string-array — the "bot list" pattern),
 * so VG126 ("Dynamic RegExp from user input") is a false positive there. Returns
 * false on any uncertainty so the rule keeps firing — a regex built from anything
 * not provably constant stays flagged.
 */
export declare function regexpArgIsConstant(code: string, filePath: string | undefined, line: number): boolean;