/**
 * The command cache's identity and determinism gates (FR-14/FR-15, Story 4.4) —
 * shared verbatim by the capture flush (which records) and the command ledger
 * (which answers), and living at the capture layer because layer direction
 * forbids `capture/` importing `query/` while the reverse is established
 * precedent (`search-ledger` → `capture/search-query`).
 *
 * **What this gate is defending against, measured rather than imagined.**
 * `npx vitest run <failing> | tail -6` exits 0 because a pipeline's status is
 * its LAST element's. The PostToolUse hook fires, and the captured stdout
 * literally reads `Test Files  1 failed (1)`. Recording that as a success is
 * SM-C3 — "a false 'your tests pass' is the worst failure this product can
 * produce" — and it was reproduced live on 2026-08-03, not theorised. Every
 * refusal below traces to a way the command's own exit status stops being what
 * the host reports.
 *
 * **Why an allowlist and not a denylist.** The Story 4.3 precedent
 * (`CERTIFIABLE_PATTERN`) applies with more force here: a denylist has to
 * enumerate every shell construct that can mask a status, in every dialect,
 * forever. An allowlist has to enumerate the characters that cannot. Being
 * wrong on an allowlist costs a miss; being wrong on a denylist costs a false
 * pass.
 */
/** Longer than any verification command anyone writes; a bound, not a budget. */
export declare const COMMAND_MAX_LENGTH = 512;
/**
 * Characters an element may contain. Everything structural is absent by
 * construction: `|` (pipeline status is the last element's), `;` (masks all but
 * the last), `&` (backgrounds — and `&&` is split off BEFORE this test runs),
 * `` ` `` and `$` (substitution and expansion make the string's meaning depend
 * on state no census can see), `<` `>` (redirection reads or writes outside the
 * command's own model), `(` `)` `{` `}` (grouping and brace expansion), `*` `?`
 * `[` `]` (globs the shell expands), `\` (escapes, and a Windows path separator
 * this project normalises away everywhere else), `!` (history expansion), `#`
 * (comment — truncates the rest of the line), and newline.
 *
 * Kept as one glance-verifiable class rather than a dialect argument.
 */
export declare const COMMAND_SAFE_CHARS: RegExp;
/**
 * `npm run <script>` is allowed only for the conventional verification script
 * names. The script body is arbitrary and invisible here, so this trusts the
 * NAME to describe it — a stated assumption, not a proof. The blast radius is
 * bounded: the record only ever asserts "this command succeeded", which stays
 * true even if the script does more than its name suggests.
 */
export declare const SAFE_RUN_SCRIPTS: ReadonlySet<string>;
/**
 * Deliberately absent, each for a reason worth keeping written down:
 * `make` (the target is defined in the user's Makefile — `make install` is
 * indistinguishable from `make test` from here), `git` (`classifyCommand` calls
 * `git push` a `git`, and pushing is not deterministic-under-fixed-state),
 * `npm install` / `npm ci` / `npm publish` (they change the dependency surface
 * this cache cannot fingerprint), and anything not on the list at all.
 *
 * **Do not delegate this to `classifyCommand` (`src/capture/redact.ts`).** That
 * function is a topical classifier for episode text: its `npm` category admits
 * `npm install` and `npm publish`, its `git` category admits `git push`, and it
 * reads only the FIRST word of a chain. It is not, and was never, a safety gate.
 */
export interface CommandIdentity {
    /** Scope-relative directory the command runs in; '' means the scope root. */
    dir: string;
    /** The command with any `cd <dir> &&` prefix removed and whitespace collapsed. */
    command: string;
}
/** Split on `&&` only. `A && B` succeeding proves BOTH succeeded — strictly
 *  more information than a bare command, and the shape of this repo's own
 *  verification block. Any other separator never reaches here: it is refused
 *  by `COMMAND_SAFE_CHARS` on the element it lands in. */
export declare function splitAndChain(command: string): string[];
/** Whether one chain element names a deterministic verification program. */
export declare function isDeterministicElement(element: string): boolean;
export interface CacheableOptions {
    /** Absolute directory the command runs in. Enables npm-script resolution. */
    dir?: string;
    /** Test seam; production reads package.json from `dir`. */
    readPackageScripts?: (dir: string) => Record<string, string> | null;
}
/**
 * The full AC #2 gate over an already-normalized command (no `cd` prefix).
 * Every element must be safe AND deterministic; one failure refuses the whole
 * command, because a chain's success claim covers all of it.
 *
 * **`npm run <script>` is resolved, not trusted** (review round). The gate reads
 * the command line, but the script BODY lives in package.json and is invisible
 * there — so `"test": "vitest run | tail -1"` laundered the exact
 * status-masking catastrophe this gate exists to stop, straight through the
 * front door. Reproduced. The body is now fetched and put through the same gate,
 * recursively (bounded), and a script that cannot be read or resolved refuses.
 * package.json is inside the census, so editing a script invalidates the record.
 */
export declare function isCacheableCommand(command: string, opts?: CacheableOptions, depth?: number): boolean;
/**
 * Strip a leading `cd <dir> &&`, collapse whitespace, and resolve the working
 * directory. Every command in this environment is written that way, so refusing
 * the shape would refuse the feature.
 *
 * Returns `null` when the command cannot be identified at all — including a
 * `cd` whose target escapes the scope root, which would key a command to a tree
 * this scope cannot census.
 */
export declare function normalizeCommand(raw: string, scopeRoot: string | null, cwd?: string): CommandIdentity | null;
/**
 * The stored form of a command's directory, shared by capture and query so the
 * two cannot disagree on a key. Mirrors `normalizeSearchRoot`: a directory
 * equal to the scope root folds to '' (its file callers never hit that case),
 * and anything OUTSIDE the scope root is refused rather than stored — a record
 * about a tree this scope cannot census could never be re-verified.
 */
export declare function normalizeCommandDir(dir: string, scopeRoot: string | null): string | null;
/**
 * Stable, versioned serialization. The key hashes the RAW command — hashing the
 * redacted form would merge distinct secret-bearing commands — and the hash is
 * one-way, so the secret itself never persists. The redacted text is what gets
 * STORED and rendered (the Story 4.3 key/redaction split).
 */
export declare function canonicalCommand(id: CommandIdentity): string;
export declare function commandKey(id: CommandIdentity): string;
//# sourceMappingURL=command-key.d.ts.map