/**
 * Shared helpers for the credential / crypto rule family (Sprint 28).
 *
 * Used by:
 *   - weak-password-hash-pass.ts (CWE-916)
 *   - plaintext-password-storage-pass.ts (CWE-256)
 *   - cleartext-credential-transport-pass.ts (CWE-523)
 *   - weak-password-encoding-pass.ts (CWE-261)
 *
 * The credential-keyword regex is the same shape used by
 * scan-secrets-pass.ts (CWE-260, Sprint 26). Kept identifier-anchored:
 * `password`, `passwd`, `pwd`, `secret`, `api[_-]?key`, `auth[_-]?token`,
 * `private[_-]?key`, `access[_-]?key`, `credential`.
 */
import type { CallInfo, ArgumentInfo } from '../../types/index.js';
/** True if a bare identifier name carries a credential keyword. */
export declare function isCredentialIdentifier(name: string | null | undefined): boolean;
/** True if any of the argument's variable / expression text carries a credential keyword. */
export declare function argLooksLikeCredential(arg: ArgumentInfo | undefined): boolean;
/** Strip surrounding quotes from a literal expression. */
export declare function stripQuotes(s: string): string;
/** Return the literal/value of an argument, with quotes stripped; null if not a literal. */
export declare function literalAt(call: CallInfo, position: number): string | null;
/**
 * True if the call is a known cryptographic hash / KDF that "protects" a
 * credential value. Used by plaintext-storage detector to suppress when
 * the credential identifier has already been passed through a hash.
 *
 * Recognised:
 *   - Java: MessageDigest.update / .digest, DigestUtils.*, BCrypt.hashpw,
 *           PBKDF2*, Argon2*, SecretKeyFactory.generateSecret
 *   - Python: hashlib.*, bcrypt.hashpw / .hash, argon2.hash, passlib.hash
 *   - JS/TS: crypto.createHash().update / .digest, bcrypt.hash / .hashSync,
 *           argon2.hash, scrypt
 *   - Go: md5.Sum, sha*.Sum, bcrypt.GenerateFromPassword, argon2.*
 */
export declare function isHashFunctionCall(call: CallInfo): boolean;
/** True if the argument identifier was the target of a hash call earlier in `priorCalls`. */
export declare function priorHashOf(varName: string, priorCalls: CallInfo[]): boolean;
//# sourceMappingURL=_credential-helpers.d.ts.map