/**
 * credential-env.ts, scrub credential-bearing environment variables out of the
 * environment handed to spawned tool processes.
 *
 * WHY. A shell command the model runs inherits this process's environment by
 * default. That environment routinely carries provider tokens and cloud
 * credentials (AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, OPENAI_API_KEY, …) that the
 * command has no need for and could exfiltrate. This module removes the
 * well-known credential-bearing variables from the base environment before it is
 * passed to a spawn, and reports exactly which variable NAMES were withheld (by
 * name only, never the value) so the exec result can state the scrub honestly.
 *
 * NOT a permission decision and NOT the frozen catastrophic-command block. This
 * is an environment hygiene step on the spawn path. A credential a command
 * legitimately needs is re-added two ways, both explicit: the model supplies it
 * in the per-command `env`, or the operator adds the variable name to the
 * configured allowlist.
 */
/** Whether a variable NAME looks credential-bearing (case-insensitive). */
export declare function isCredentialEnvName(name: string): boolean;
/** Injectable scrub configuration (wired from `permissions.exec.*` config by the consumer). */
export interface CredentialEnvScrubConfig {
    /** Master switch. Default true, the scrub is on unless a consumer disables it. */
    readonly enabled?: boolean | undefined;
    /** Variable names always kept, overriding the credential matchers (case-insensitive). */
    readonly allowlist?: readonly string[] | undefined;
}
/** Resolved, non-optional scrub configuration. */
export interface ResolvedCredentialEnvScrub {
    readonly enabled: boolean;
    readonly allowlist: ReadonlySet<string>;
}
/** Resolve raw scrub config into the internal form. Enabled by default. */
export declare function resolveCredentialEnvScrub(config?: CredentialEnvScrubConfig): ResolvedCredentialEnvScrub;
export interface CredentialEnvScrubResult {
    /** The environment with credential-bearing variables removed. */
    readonly env: Record<string, string>;
    /** Names withheld from `env`, sorted. NEVER includes values. */
    readonly withheld: string[];
}
/**
 * Remove credential-bearing variables from `env`. A name is withheld when
 * {@link isCredentialEnvName} matches and it is not on the allowlist. When the
 * scrub is disabled the env passes through untouched with an empty withheld set.
 */
export declare function scrubCredentialEnv(env: Record<string, string>, scrub: ResolvedCredentialEnvScrub): CredentialEnvScrubResult;
//# sourceMappingURL=credential-env.d.ts.map