/**
 * Pass: plaintext-password-storage (CWE-256, category: security)
 *
 * Detects writing a credential-named identifier to a persistent store
 * (file, KV store, cookie, database) without first passing it through a
 * cryptographic hash / KDF.
 *
 * Detection per language:
 *   Python:
 *     - `open(...).write(password)` / `f.write(password)`
 *     - `pickle.dump(password, ...)` / `json.dump(...)` / `yaml.dump(...)`
 *     - `redis.set(key, password)`
 *   JS/TS:
 *     - `fs.writeFile|writeFileSync|appendFile(path, password)`
 *     - `localStorage.setItem(key, password)` / `sessionStorage.setItem`
 *     - `redis.set(key, password)`
 *   Java:
 *     - `Files.write|writeString(path, password)`
 *     - `FileWriter.write(password)`
 *   Go:
 *     - `os.WriteFile(name, []byte(password), ...)`
 *     - `f.WriteString(password)` / `f.Write([]byte(password))`
 *
 * Heuristic for "not hashed": intraprocedural — walk all calls earlier
 * in the same `in_method` scope; if any of them is a known hash/KDF
 * (see _credential-helpers `isHashFunctionCall`) and consumes the
 * credential identifier, suppress.
 *
 * This is intentionally lightweight (no full DFG); FP risk skewed toward
 * recall loss for cross-function hashing (controller → service.hash →
 * repo.store), which is acceptable for v1.
 */
import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
export interface PlaintextPasswordStorageResult {
    findings: Array<{
        line: number;
        language: string;
        api: string;
        identifier: string;
    }>;
}
export declare class PlaintextPasswordStoragePass implements AnalysisPass<PlaintextPasswordStorageResult> {
    readonly name = "plaintext-password-storage";
    readonly category: "security";
    run(ctx: PassContext): PlaintextPasswordStorageResult;
}
//# sourceMappingURL=plaintext-password-storage-pass.d.ts.map