/**
 * Canonicalisation for replay detection.
 *
 * Hashes (executable, args[], cwd, envSubset) into a stable SHA-256
 * string. Only a small whitelist of env vars is included so that
 * benign variation (PWD, SHLVL, terminal info) does not break the
 * replay match.
 *
 * All string components are normalised via NFKC + bypass-codepoint
 * strip BEFORE hashing so an attacker cannot defeat replay detection
 * by appending a zero-width joiner to an arg on each call. See
 * `./normalize.ts` for the full character set.
 */
/**
 * Env vars that meaningfully change command semantics. Anything else
 * is dropped from the canonical hash so two calls that only differ in
 * `TERM` or `PWD` collide as expected.
 */
declare const SEMANTIC_ENV_KEYS: readonly string[];
export interface CanonicalInput {
    executable: string;
    args: readonly string[];
    cwd?: string | undefined;
    env?: Record<string, string | undefined> | undefined;
    /**
     * Override which env keys to include. Defaults to SEMANTIC_ENV_KEYS.
     */
    envKeys?: readonly string[];
}
/**
 * Build the canonical string for a command invocation. Deterministic
 * across calls with semantically identical inputs.
 */
export declare function canonicalize(input: CanonicalInput): string;
export declare function canonicalHash(input: CanonicalInput): string;
export { SEMANTIC_ENV_KEYS };
//# sourceMappingURL=canonical.d.ts.map