/**
 * An env snapshot safe to pass to `execFile`/`execFileSync`/`spawn` when
 * spawning `git`: every inherited `GIT_*` variable is removed except the
 * transport carve-out above, so no parent-process git state (an absolute
 * GIT_DIR, GIT_INDEX_FILE, ... leaked by an outer `git commit`) can steer the
 * spawn away from its `cwd`/`-C`.
 *
 * Mirrors tests/git-fixture-env.ts `hermeticGitEnv()`, including its rationale
 * for NOT redirecting GIT_CONFIG_GLOBAL/GIT_CONFIG_SYSTEM at an empty file: the
 * inherited values are dropped so git falls back to the real `~/.gitconfig`,
 * which keeps host `core.autocrlf` intact. Emptying the config instead would
 * desync line endings between hermetic and non-hermetic checkouts.
 *
 * `base` defaults to the live `process.env` (read on every call, so it reflects
 * any later env mutation). It is a parameter only so the stripping logic can be
 * unit-tested against a synthetic env without mutating the process.
 */
export declare function hermeticGitEnv(base?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
/**
 * True when `command` invokes git, so a generic spawn seam can apply
 * {@link hermeticGitEnv} without every caller opting in. Matches the bare name
 * aih's argv arrays use plus an absolute/Windows-shim path, and deliberately not
 * `gh` or `gitleaks` — those are separate executables with their own env
 * contract.
 */
export declare function isGitExecutable(command: string): boolean;
/**
 * The same guard as one line of JavaScript source, for the standalone scripts
 * aih GENERATES and installs (the ECC install-manifest recorder, the usage
 * recorder). Those run in their own node process — often as a git hook, which is
 * precisely when GIT_DIR is exported — so they cannot import the helper above
 * and must carry the scrub inline. Defines a `gitEnv` const for the spawns to
 * pass as `env`.
 *
 * Blanket `GIT_*` strip with no transport carve-out: generated scripts only ever
 * run local, offline provenance reads (`rev-parse`, `show`), so no transport
 * variable is relevant to them.
 */
export declare const HERMETIC_GIT_ENV_SCRIPT_LINE = "const gitEnv = Object.fromEntries(Object.entries(process.env).filter(([k]) => !/^GIT_/i.test(k)));";