/**
 * The first 10 Sentinel rule ports (Phase C, ShipSafe × Assay bridge).
 *
 * Source of truth: security-agent-dev/src/layers/rules/domains/
 *   secrets-exposure.ts (SECRETS-002 @ L184-224, SECRETS-004 @ L264-340)
 *   input-injection.ts  (INPUT-001..004, 006..009 @ L71-533)
 *
 * Every port is single-file decidable: it fires only on POSITIVE evidence in
 * the scanned code string. Rules that need project context (SECRETS-001/003/
 * 005/006/008/009, INPUT-005) were deliberately NOT ported — see index.ts.
 *
 * Documented deviations from the Sentinel originals (each tightens precision,
 * never loosens it — at the formal layer there is no LLM lane to dismiss FPs):
 *   • SECRETS-004 additionally requires the value to be secret-SHAPED
 *     (isSecretShaped): no interior whitespace, non-placeholder, credential-
 *     like charset/entropy. Kills the natural-language FP class
 *     (`apiKey = 'see your dashboard settings page'` — the assay-bridge-
 *     dogfood bait that Sentinel's original flags and its LLM lane dismisses).
 *   • INPUT-001's same-file sanitizer suppression is widened from the three
 *     named libraries to any /sanitiz/i identifier, so a local sanitize
 *     helper suppresses the finding too.
 *   • Sentinel's PATH-based exclusions (test/, migrations/, *.spec.ts) cannot
 *     apply here — detect() sees code, not paths. The placeholder-value
 *     guards cover the dominant test-credential FP shape.
 */
import { type SentinelRulePort } from './shared.js';
export declare const PHASE_C_PORTS: SentinelRulePort[];