/**
 * scanEnvCredentials — ported from `scripts/guard-no-env-credentials.mjs`.
 *
 * User credentials are per-user (or per-org) data. They MUST live in SQL,
 * scoped by `userEmail` / `orgId`, never in `process.env` — a deployment's
 * env vars are shared by every signed-in user. This guard flags any
 * `process.env.<KEY>` / `process.env["KEY"]` read whose key is not on the
 * deploy-level allowlist (`DATABASE_URL`, `BETTER_AUTH_SECRET`, etc.), plus
 * any dynamic `process.env[key]` read (the key is only known at runtime, so
 * it can never be allowlisted safely).
 *
 * Conditional guard — per report 005's V1 guard set table, this is "the big
 * one": the original only scans a curated set of monorepo subtrees
 * (`packages/core/src/{credentials,secrets,vault,agent}/`, template
 * credential libs/routes) via `FORBIDDEN_PATH_PREDICATES` — none of which
 * exist in a generated app, so nothing would ever be scanned. This port
 * replaces that default-allow-outside-a-curated-subtree behavior with
 * default-deny across the whole app source tree: every `process.env.<KEY>`
 * read anywhere in app source must be on the deploy-var allowlist (kept
 * verbatim) or carry the opt-out marker. `HIGH_RISK_ENV_KEY_ALLOWLIST`,
 * `HIGH_RISK_PROCESS_ENV_ALLOWLIST`, and `HIGH_RISK_ENV_VARS_WRITE_ALLOWLIST`
 * — the three monorepo-file-keyed exception maps for specific template
 * platform-adapter files — are dropped entirely per the report; with
 * default-deny scanning already covering every `process.env` read
 * everywhere, the narrower `env-config.ts`/`core-routes.ts`-specific
 * registration checks those maps supported become redundant (any
 * high-risk key would already be caught by the general scan) and are
 * dropped along with them. The per-line `// guard:allow-env-credential`
 * marker remains the only escape hatch.
 *
 * Opt-out (same line, or the line immediately above):
 *   process.env.SOMETHING // guard:allow-env-credential — short reason
 */
import type { GuardResult, GuardScanOptions } from "./types.js";
export declare function scanEnvCredentials(options: GuardScanOptions): GuardResult;
//# sourceMappingURL=no-env-credentials.d.ts.map