/**
 * Detect credentials exported from shell rc files.
 *
 * A secret exported from `~/.zshenv`, `~/.zshrc`, `~/.bashrc`, `~/.profile`, …
 * is inherited by every process the login shell spawns and is readable from
 * `/proc/<pid>/environ` by any same-user process — the master passphrase leak
 * behind RUSH-1968. `.zshenv` in particular is sourced by *every* zsh
 * invocation, including non-interactive `ssh host 'cmd'`, so the value lands in
 * the environment of essentially everything the box runs.
 *
 * The keychain-backed store (`agents secrets`) is the sanctioned home for
 * credentials; the file-store master passphrase belongs in the off-env 0600 key
 * file (`~/.agents/.secrets-key/passphrase`), never a shell rc export.
 *
 * This scanner powers a warn-level advisory in `agents doctor`. It reads only
 * the exported variable *name* and its line number — never the value — so a
 * finding can be printed, logged, or shipped without leaking the secret.
 */
/** Shell rc files sourced at login/startup, in the order a report lists them. */
export declare const RC_FILENAMES: readonly [".zshenv", ".zprofile", ".zshrc", ".zlogin", ".bash_profile", ".bash_login", ".bashrc", ".profile", ".kshrc"];
/**
 * A single credential-shaped export found in an rc file. Carries the variable
 * NAME and location only — the value is never captured.
 */
export interface RcSecretFinding {
    /** Basename of the rc file, e.g. `.zshenv`. */
    file: string;
    /** 1-based line number of the export. */
    line: number;
    /** The exported variable name (e.g. `AGENTS_SECRETS_PASSPHRASE`). Never the value. */
    name: string;
    /** The file-store master passphrase gets called out separately — it is the highest-severity case. */
    isMasterPassphrase: boolean;
}
/** The file-store master key. Its own resolution prefers an off-env 0600 file, so
 *  a shell-rc export is always wrong once the store exists (RUSH-1968). */
export declare const MASTER_PASSPHRASE = "AGENTS_SECRETS_PASSPHRASE";
/**
 * True when the file-store master key is live in THIS process's environment.
 *
 * The scanner above reads FILES, and that leaves a hole: a value inherited by a
 * long-lived process outlives the rc line that set it, so deleting the export
 * makes `scanRcExports` report clean while every shell, editor and agent started
 * beforehand still carries the key and passes it to everything it spawns.
 * Returns a boolean — never the value — so a finding built from it can be
 * printed, logged, or shipped without leaking the secret.
 */
export declare function masterPassphraseInEnv(): boolean;
/** True if a variable name looks like it holds a credential value. */
export declare function isCredentialName(name: string): boolean;
/**
 * Scan one rc file's contents for credential-shaped exports. Pure — takes the
 * text, returns findings (names + line numbers only, never values). A trailing
 * `# comment` is stripped before matching so a commented-out export is ignored;
 * the variable name always precedes any inline `#`, so stripping never loses it.
 */
export declare function scanRcExports(basename: string, content: string): RcSecretFinding[];
/**
 * Scan the current user's shell rc files. Reads each file that exists under
 * `homeDir` (default `os.homedir()`) and aggregates the findings. Missing or
 * unreadable files are skipped silently — an advisory, not a hard requirement.
 */
export declare function scanUserRcFiles(homeDir?: string): RcSecretFinding[];
