/**
 * scanUnscopedCredentials — ported from
 * `scripts/guard-no-unscoped-credentials.mjs`.
 *
 * Refuse to let any caller invoke `resolveCredential` / `hasCredential` /
 * `saveCredential` / `deleteCredential` with only one argument. The
 * contract requires a second argument carrying the per-user / per-org
 * context object — `(key, { userEmail, orgId })` — so the credential
 * lookup is scoped to the requesting principal.
 *
 * Generic guard, shipped as-is: the detection regex, arg-balancing parser,
 * and marker semantics are unchanged from the monorepo original. The one
 * difference from the monorepo script is scan scope: the original restricts
 * its walk to `packages/`, `templates/`, `app/` — a monorepo-specific
 * optimization that also happens to exclude its own dotfile/doc trees. A
 * generated app's source lives at `actions/`, `app/`, `server/` (no
 * `packages/`/`templates/` wrapper — see report 005's "Path resolution"),
 * so keeping that literal subtree filter would silently skip `actions/`
 * and `server/`. This port scans the whole app root (still respecting
 * `SKIP_DIRS`) instead, which is a superset of the original's coverage and
 * has no false-negative risk for a single-app tree.
 *
 * Opt-out (same line only):
 *   resolveCredential(key) // guard:allow-unscoped-credential — short reason
 */
import type { GuardResult, GuardScanOptions } from "./types.js";
export declare function scanUnscopedCredentials(options: GuardScanOptions): GuardResult;
//# sourceMappingURL=no-unscoped-credentials.d.ts.map