import type { CapabilityPolicy } from './policy.js';
import type { SandboxCapabilities, SandboxEnv } from './sandbox.js';
export type NetworkEnforcementLayer = 'none' | 'process' | 'container' | 'cluster' | 'provider';
export interface NetworkEnforcementRequirement {
    /** Minimum acceptable enforcement layer. Defaults to `container`. */
    minimum?: Exclude<NetworkEnforcementLayer, 'none' | 'process'>;
    /** Operator label included in diagnostics. */
    deployment?: string;
}
/**
 * Refuse production network policy when it can be bypassed by code in the
 * sandbox. This validates an operator assertion; the named network boundary
 * must still be provisioned by Docker, Kubernetes, or the cloud provider.
 */
export declare function assertEnforceableNetworkPolicy(policy: CapabilityPolicy | undefined, sandbox: SandboxEnv | Pick<SandboxCapabilities, 'network' | 'networkEnforcement' | 'networkBoundary'> | undefined, requirement?: NetworkEnforcementRequirement): void;
//# sourceMappingURL=network-enforcement.d.ts.map