/**
 * Stale-allow → baseline-entry producer.
 *
 * Detects orphaned inline allowlist annotations — `dxkit-allow:`
 * comments in source files that no longer match any current
 * finding. The developer added the annotation when something was
 * flagged; the finding is now gone (resolved, scanner-rule changed,
 * code refactored); the annotation is dead code that should be
 * removed.
 *
 * # The matching contract
 *
 * An annotation at `(file, line)` is considered ACTIVE when at
 * least one current finding lands at the same `(file, lineWindow)` —
 * the 3-line window from `lineWindowFor` absorbs small formatter /
 * line-shift drift so a still-relevant annotation doesn't get
 * flagged stale by an unrelated edit.
 *
 * Annotations with no matching finding emit a `stale-allow`
 * `BaselineEntry` whose identity is `(file, lineWindow, category)`.
 * The strict-stale model (TypeScript's `@ts-expect-error` pattern)
 * forces the developer to clean up — preventing the annotation
 * graveyard pattern common to less strict tools.
 *
 * # What counts as a "covered location"
 *
 * Source-anchored finding kinds — `secret`, `code`, `config` —
 * carry `(file, line)` and contribute to the covered set. The
 * `findingsByCategory` arrays on the canonical `SecurityAggregate`
 * are the only source today; the aggregator is the single canonical
 * fingerprint-deduped source of these findings (CLAUDE.md G_v4_8).
 *
 * Kinds without `(file, line)` — `dep-vuln`, `duplication`,
 * `secret-hmac`, `license`, etc. — never participate in inline-
 * annotation matching by construction. Annotations targeting those
 * findings always use the file-level allowlist.
 *
 * # Mode handling
 *
 * `staleHandling` lives in `.dxkit/policy.json` (out of scope for
 * this producer — the orchestrator gates whether to call it). When
 * called, the producer emits `stale-allow` entries unconditionally
 * for every orphan; the policy-level "lenient mode" surfaces these
 * as warnings in the renderer rather than as blocking entries.
 */
import type { SecurityAggregate } from '../../analyzers/security/aggregator';
import type { InlineAllowlistOccurrence } from '../../allowlist/gather';
import type { RichBaselineEntry } from '../types';
export interface StaleAllowInput {
    readonly annotations: ReadonlyArray<InlineAllowlistOccurrence>;
    readonly aggregate: SecurityAggregate | null;
}
/**
 * Build `stale-allow` entries from the annotation list + the
 * canonical security aggregate. Pure function — no I/O, no side
 * effects. Deterministic over equal inputs.
 *
 * Returns an empty array when:
 *   - The annotation list is empty (nothing to check).
 *   - The aggregate is null AND the annotation list is empty.
 *
 * When the aggregate is null but annotations exist, the producer
 * conservatively emits NO stale entries — the caller has no way to
 * know whether annotations are active or stale without the
 * findings. Surfacing "everything is stale" in that scenario would
 * be wrong; surfacing "everything is fine" is also wrong but less
 * actively misleading.
 */
export declare function staleAllowToBaselineEntries(input: StaleAllowInput): RichBaselineEntry[];
//# sourceMappingURL=stale-allow.d.ts.map