/** * Note-level finding coalescer — cognium-dev #143. * * Groups `SastFinding[]` by `(file, line)` and folds any group of two or * more `level === 'note'` findings into a single record. The primary * finding is picked deterministically (lexicographic `rule_id`) and * the co-located rule_ids are attached as `labels[]`. Every other * (`level === 'warning' | 'error'`) finding passes through untouched. * * Empirical basis (from the OWASP-Benchmark instrumentation capture on * cognium-dev#145, comment 2026-07-03): * - 5,481 `(file, line)` locations (31.3% of files) were hit by ≥ 2 * distinct advisory rules. * - Most-common pairs: * missing-public-doc + naming-convention × 2,740 * missing-csp-frame-ancestors + missing-x-frame-options × 2,740 * unused-variable + variable-shadowing (co-located) * - HIGH-severity: 0 co-locations in the same capture. * * Design invariants: * - Additive: consumers that key on `rule_id` continue to work * unchanged. Consumers that surface every co-located rule read * both `rule_id` and `labels`. * - Level-gated: only fires when EVERY finding in the group has * `level === 'note'`. If any group member is `warning` or `error`, * the group passes through un-coalesced — visibility of higher- * severity findings is never diminished. * - Deterministic: sort by `rule_id` inside a group before picking * the primary, so the same input always produces the same output * (test-friendly, diff-friendly, cache-friendly). * - Message preservation: the primary finding's `message` is kept * verbatim. The `labels[]` field is the sole signal that more * rules co-located there. * * This is the MVP of the reopen. Follow-ups on #143 include a full * instrumentation rerun on multi-severity data + a broader * medium-severity coalesce policy — both deferred until the data * capture is redone. */ import type { SastFinding } from '../types/index.js'; /** * Coalesce note-level findings at the same `(file, line)` location. * Returns a new array; the input is not mutated. */ export declare function coalesceNoteLevelFindings(findings: readonly SastFinding[]): SastFinding[]; //# sourceMappingURL=note-coalescer.d.ts.map