/**
 * Finding generator
 *
 * Combines taint sources, sinks, and data flow analysis to generate
 * vulnerability findings with paths and remediation suggestions.
 */
import type { TaintSource, TaintSink, DFG, Finding, SinkType } from '../types/index.js';
/**
 * Generate vulnerability findings from taint analysis results.
 *
 * cognium-dev#250 — When `sourceCode` and `language` are supplied,
 * candidate sources whose `line` points at an import/package/comment/
 * annotation-only/const-literal-declaration line are dropped before
 * pair emission. This is a defense-in-depth gate against fabricated
 * flows introduced upstream (LLM enrichment hallucinations or
 * detector regressions). Both parameters are optional to preserve
 * backward compatibility with pre-3.165 callers.
 */
export declare function generateFindings(sources: TaintSource[], sinks: TaintSink[], dfg: DFG, fileName: string, sourceCode?: string, language?: string): Finding[];
/**
 * Check if a source type can potentially reach a sink type.
 *
 * Exported so detection passes (e.g. `detectExpressionScanFlows` in
 * `taint-propagation-pass.ts`) can gate emit-time flows on the same
 * source-to-sink coverage matrix that `generateFindings` uses below.
 */
export declare function canSourceReachSink(sourceType: string, sinkType: SinkType): boolean;
/**
 * Source-semantics gate (cognium-dev #138).
 *
 * Consumed by `taint-propagation-pass.ts` (both colocation and
 * variable-scan flow generators) to drop flows whose source has been
 * tagged as a compile-time constant or an SPI-loaded value by
 * `SourceSemanticsPass`. The `demoPath` tag is deliberately NOT
 * consumed here — it is used by `scan-secrets-pass.ts` to downgrade
 * hardcoded-credential severity but never to drop flows.
 *
 * Policy (hardcoded per-sink allowlist):
 *   - `source.constant === true`  → drop for every taint sink type.
 *     Compile-time constants cannot carry attacker-controlled data,
 *     so no taint flow is possible. Hardcoded-credential emission
 *     happens in `scan-secrets-pass` and does not go through this
 *     predicate, so it is unaffected.
 *   - `source.spi === true`       → drop for every sink EXCEPT
 *     `code_injection`. Stage 9f in `sink-filter-pass.ts` already
 *     downgrades `Class.forName(spiLoaded)` to a library-API-surface
 *     tag; dropping again here would double-suppress real reflection
 *     bugs.
 *   - No relevant tags set        → allowed (default is to preserve
 *     the flow — this predicate is a subtractive gate only).
 *
 * The predicate must be called AFTER `canSourceReachSink` (which is
 * the coarse sink-type reachability check). Both must pass for the
 * flow to be emitted.
 */
export declare function sourceSemanticsAllowed(source: {
    constant?: boolean;
    spi?: boolean;
}, sinkType: SinkType): boolean;
//# sourceMappingURL=findings.d.ts.map