/**
 * SMI-6441: generated common-password lexicon for the `sensitive_path`
 * MF-4b veto (Wave 2). Vetoes MF-4's 2-token documentation-label
 * carve-out when one of the tokens is a known common password.
 * @module @skillsmith/core/security/scanner/SecurityScanner.weak-passwords
 * @generated DO NOT EDIT — produced by scripts/gen-weak-password-lexicon.mjs
 * from data/wordlists/{seclists-xato-top-10000.txt,doc-vocab-keeplist.txt}.
 * Regenerate with `npm run lexicon:weak-passwords`; verify freshness with
 * `npm run lexicon:weak-passwords:check`. A hand edit here is overwritten
 * on the next --write and is caught by the L3 --check gate before merge.
 *
 * SECURITY-RELEVANT DUPLICATION (ADR-137 Decision point 4): this file is
 * one of three byte-identical-modulo-@module copies of the same
 * generated payload —
 *   packages/core/src/security/scanner/SecurityScanner.weak-passwords.ts
 *   scripts/indexer/_shared/security-scanner-edge.weak-passwords.ts
 *   supabase/functions/_shared/security-scanner-edge.weak-passwords.ts
 * A silent divergence between these three is a SECURITY GAP, not a
 * cosmetic inconsistency: this data decides whether a `sensitive_path`
 * finding is HIGH or MEDIUM (quarantine vs. pass on the weekly scan
 * surface; blocked vs. permitted install). Enforced by three parity
 * layers: L1 Deno<->Node byte identity
 * (scripts/tests/indexer/security-scanner-edge.test.ts's
 * PATHS_FAMILY_TWINS), L2 three-way literal payload identity
 * (scripts/tests/indexer/parity-utils.ts's extractGeneratedPayload),
 * and L3 freshness/anti-hand-edit (`npm run lexicon:weak-passwords:check`,
 * wired into scripts/audit-standards.mjs).
 *
 * Source: SecLists (MIT license) — see data/wordlists/LICENSE-SecLists
 * and WEAK_PASSWORD_LEXICON_SOURCE below for exact provenance.
 *
 * Full design: docs/internal/implementation/smi-6441-weak-password-veto.md
 * See also: docs/internal/adr/149-generated-scanner-data-veto-severity-model.md
 * and docs/internal/adr/137-cross-runtime-duplication-of-security-logic.md
 */
/** Provenance of the vendored upstream snapshot this file was generated from. */
export declare const WEAK_PASSWORD_LEXICON_SOURCE: {
    readonly upstream: "https://github.com/danielmiessler/SecLists";
    readonly path: "Passwords/Common-Credentials/xato-net-10-million-passwords-10000.txt";
    readonly license: "MIT";
    readonly commit: "c205c36a445bff37f8e58a9ec829105cd4975c58";
    readonly sha256: "c63d5e4ccc31344d662583cc39ca4bd5bd20517ff1d24501f0c4e0c22d9b722a";
    readonly sourceRankLimit: 5000;
    readonly entries: 4009;
};
/** Bumped whenever the emitted entry set changes. Deterministic, no timestamp. */
export declare const WEAK_PASSWORD_LEXICON_VERSION: "2026-09-09.2";
/**
 * Lowercase-alphabetic common-password tokens, 3-19 chars, sorted, with the
 * documentation vocabulary subtracted at generation time. Exact membership
 * by design (see the ADR): the veto's failure direction is a false positive
 * on ordinary documentation, so an approximate structure is not acceptable here.
 */
export declare const COMMON_WEAK_PASSWORDS: ReadonlySet<string>;
//# sourceMappingURL=SecurityScanner.weak-passwords.d.ts.map