/**
 * Query-time network guard.
 *
 * The stop condition says "zero network calls at query time". This module does
 * not *infer* that from reading code — it BLOCKS the network and records every
 * attempt. If retrieval needs the network, queries fail loudly instead of
 * quietly succeeding and leaving us to assert offline-ness we never tested.
 *
 * Honest limits, stated so nobody over-claims from this evidence:
 *  - Coverage is layered, and the layers are not equally strong:
 *      * `net.Socket.prototype.connect` / `tls.TLSSocket.prototype.connect` are
 *        PROTOTYPE patches, so they bite no matter how the caller imported the
 *        module. Every TCP client in Node funnels through them, including
 *        undici (and therefore fetch), http, https and any npm HTTP library.
 *        This is the layer that actually makes the claim true.
 *      * `globalThis.fetch` is a global patch and equally universal.
 *      * The module-level patches (http.request, dns.lookup, ...) only bite for
 *        `require()` consumers: an ESM `import * as http` snapshots the
 *        bindings at load time and cannot be reached afterwards. They are kept
 *        as a second net, not relied on.
 *  - A native addon opening a socket in C++ would bypass all of it, which is
 *    why the baseline report also carries an out-of-process `lsof` check.
 *  - It is installed around the query phase only. Ingest may legitimately fetch
 *    an embedding model on first run; that is build time, not query time, and
 *    is reported separately.
 *
 * @module v1/cli/knowledge/eval/network-guard
 */
export interface NetworkAttempt {
    api: string;
    target: string;
    stack: string;
}
export interface NetworkGuard {
    attempts: NetworkAttempt[];
    /** APIs that could NOT be patched. A non-empty list downgrades the offline
     *  claim from "proven" to "partial" — never silently ignored. */
    unpatched: string[];
    release(): void;
}
/**
 * Installs the guard. Every blocked call throws, so any code path that needed
 * the network surfaces as a failed query rather than a silent pass.
 */
export declare function installNetworkGuard(): NetworkGuard;
//# sourceMappingURL=network-guard.d.ts.map