/**
 * False-positive allowlist predicates shared across passes.
 *
 * Used by:
 *   - scan-secrets-pass: #176 PEM-delimiter and #174 CLI-option-key
 *   - weak-crypto-pass / weak-password-hash-pass: #175 protocol-mandated
 *     legacy auth (NTLM / Kerberos / SMB1 / SASL CRAM-MD5 / HTTP Digest)
 *
 * Each predicate is a pure function (no IO, no mutable state) so it is
 * safe to import from any pass without coupling.
 */
/**
 * Real embedded PEM keys always have base64-shape body lines (>=30 chars
 * of [A-Za-z0-9+/]) within a few lines of the BEGIN delimiter. Constants,
 * error messages, and parser `contains()` calls do not — they hold only
 * the delimiter substring with no key material adjacent.
 */
export declare function pemHasInlineBody(lines: string[], hitLineIdx: number): boolean;
export declare function isCliOptionKeyValue(value: string): boolean;
/**
 * Returns true when the file is a protocol-mandated legacy-auth
 * implementation (NTLM / Kerberos / SMB1 / SASL CRAM-MD5 / HTTP Digest).
 * In such files, DES/RC4/MD4/MD5 are hardcoded by the protocol spec;
 * switching algorithms would break interop with conformant peers.
 */
export declare function isProtocolMandatedCryptoFile(file: string, code: string): boolean;
//# sourceMappingURL=_fp-allowlists.d.ts.map