/**
 * Credential Guard
 *
 * Prevents credential leakage through:
 * - Environment sanitisation for terminal commands
 * - Tool output credential scanning
 * - Sensitive file read blocking
 * - ENV variable filtering
 */
import { type SecurityEvent } from './security-event.types.js';
export declare class CredentialGuard {
    private events;
    /**
     * Sanitise environment variables for subprocess execution.
     * Returns a copy with sensitive values replaced by [REDACTED].
     */
    sanitizeEnvironment(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
    /**
     * Check if an environment variable name matches sensitive patterns.
     */
    isSensitiveEnvVar(name: string): boolean;
    /**
     * Scan tool output for credentials and redact them.
     */
    scanOutput(content: string): string;
    /**
     * Check if a file path points to a sensitive file.
     */
    isSensitiveFile(filePath: string): boolean;
    /**
     * Get recorded security events (for testing/monitoring).
     */
    getEvents(): SecurityEvent[];
    /**
     * Clear recorded events.
     */
    clearEvents(): void;
    private logEvent;
}
export declare function getCredentialGuard(): CredentialGuard;
export declare function resetCredentialGuard(): void;
//# sourceMappingURL=credential-guard.d.ts.map