/**
 * Session state for asroot.
 *
 * The sudo password is cached in memory for CACHE_MS (mirroring sudo's
 * familiar 5-minute timestamp), then dropped. While cached it is also
 * used for exact-match leak scrubbing. Never on disk, never in env,
 * never in session files.
 */
export declare const PASSWORD_NAME = "SUDO_PASSWORD";
/** Mirrors sudo's default timestamp_timeout. */
export declare const CACHE_MS: number;
export interface CachedPassword {
    value: string;
    expiresAt: number;
}
export interface AsrootState {
    cached: CachedPassword | null;
    /** True when shroud acknowledged the password — it owns scrubbing then. */
    shroudSynced: boolean;
    stats: {
        prompted: number;
        runs: number;
        scrubbed: number;
        blocked: number;
    };
}
export declare function createState(): AsrootState;
/** Fresh cached password, or null when missing/expired. */
export declare function freshPassword(st: AsrootState): string | null;
/** Exact-match scrub of the sudo password from a text channel. */
export declare function scrubText(text: string, st: AsrootState): string | undefined;
export declare function maskQuoted(command: string): string;
/** True if a bash command invokes sudo (word followed by an argument). */
export declare function referencesSudo(command: string): boolean;