/**
 * Configuration loader for taint source/sink definitions
 *
 * Loads YAML configs from configs/sources/ and configs/sinks/
 */
import type { SourceConfig, SinkConfig, TaintConfig, SourcePattern, SinkPattern, SanitizerPattern, HeaderRule } from '../types/config.js';
/**
 * Parse YAML/JSON configuration content.
 * Uses JSON since the config files are actually JSON despite .yaml extension.
 */
export declare function parseConfig<T>(content: string): T;
/**
 * Load and merge multiple source configs.
 */
export declare function loadSourceConfigs(configs: SourceConfig[]): SourcePattern[];
/**
 * Load and merge multiple sink configs.
 */
export declare function loadSinkConfigs(configs: SinkConfig[]): {
    sinks: SinkPattern[];
    sanitizers: SanitizerPattern[];
};
/**
 * Create a combined taint configuration from raw config contents.
 */
export declare function createTaintConfig(sourceContents: string[], sinkContents: string[]): TaintConfig;
/**
 * Embedded default configurations (subset for standalone use).
 * Full configs should be loaded from files when available.
 */
export declare const DEFAULT_SOURCES: SourcePattern[];
export declare const DEFAULT_SINKS: SinkPattern[];
export declare const DEFAULT_SANITIZERS: SanitizerPattern[];
/**
 * Get the default taint configuration.
 */
export declare function getDefaultConfig(): TaintConfig;
/**
 * Default rule table for HTTP response security headers. Each rule is
 * evaluated against setHeader/addHeader calls and (for kind='missing')
 * against the absence of any such call on handler files.
 *
 * Covers clickjacking (CWE-1021) and CORS misconfiguration (CWE-346 /
 * CWE-942). Adding a new rule here is enough to surface a finding — no
 * pass code changes required.
 */
export declare const DEFAULT_HEADER_RULES: HeaderRule[];
//# sourceMappingURL=config-loader.d.ts.map