/**
 * scanEnvMutation — ported from `scripts/guard-no-env-mutation.mjs`.
 *
 * Refuse to let production code MUTATE `process.env` (e.g.
 * `process.env.AGENT_USER_EMAIL = userEmail`). `process.env` is
 * process-scoped, not request-scoped — on serverless, every warm container
 * handles many concurrent requests in one Node process, so mutating
 * `process.env` in a request handler leaks state across requests. Use
 * `runWithRequestContext` instead.
 *
 * Conditional guard — per report 005's V1 guard set table: the original
 * has 9 `ALLOWED_PATH_PREDICATES`; 4 are monorepo-only
 * (`packages/core/src/dev`, `templates/*\/test(s)/`, `packages/cli/`,
 * `packages/create-agent-native/`) and dropped here. The 5 portable ones
 * (`scripts/**`, `*.spec.*`, `*.test.*`, `/cli/`, `/scaffold/`) are kept
 * verbatim — they already work unmodified for a generated app.
 *
 * Opt-out (same line, or the line immediately above):
 *   process.env.X = y // guard:allow-env-mutation — short reason
 */
import type { GuardResult, GuardScanOptions } from "./types.js";
export declare function scanEnvMutation(options: GuardScanOptions): GuardResult;
//# sourceMappingURL=no-env-mutation.d.ts.map