import { type Exec } from '../exec.js';
import type { IsolationBackend, ResolvedIsolation } from './types.js';
export type { IsolationBackend } from './types.js';
export { makeBubblewrapBackend, unsharesNet } from './bubblewrap.js';
export { makeNoneBackend } from './none.js';
/** Outcome of resolving a policy's `backend:` (incl. `auto`) against host reality. */
export interface Selection {
    backend: IsolationBackend;
    /** True when the requested backend was unavailable and we fell back to none. */
    degraded: boolean;
    detail: string;
}
/**
 * Pick the isolation backend for a resolved policy, honouring rootless,
 * bwrap-first `auto` and the `on_unavailable` degradation policy.
 *
 * - `none`         → the identity backend.
 * - `bubblewrap`   → bwrap if available, else degrade/refuse per on_unavailable.
 * - `podman`       → not implemented ⇒ treated as unavailable.
 * - `auto`         → bwrap if available, else degrade/refuse.
 *
 * On `on_unavailable: strict` with nothing available, throws (fail closed).
 */
export declare function selectIsolationBackend(policy: ResolvedIsolation, exec?: Exec): Promise<Selection>;