/**
 * The deny-by-default environment gate.
 *
 * Called from inside `resolveEnvironment` (`src/shared/env.ts`) — the one
 * resolver every surface (CLI, SDK, MCP) routes through — so no call site
 * can miss it.
 */
import type { EnvironmentConfiguration } from "../config/types.js";
export interface EnforceEnvironmentPolicyParams {
    envName: string;
    environment: EnvironmentConfiguration;
    /** Directory holding the resolved `sitecoreai.cli.json`. */
    configRootDir: string;
}
/**
 * Throws `POLICY_DENIED` when the environment is not on the workspace-
 * policy allowlist, or when its tenant identity has drifted from what was
 * pinned at enrollment.
 *
 * A no-op in "unmanaged mode" (no `~/.sitecoreai/policy.json`), so a
 * setup that predates this feature is never locked out — the policy file
 * appears, and enforcement switches on, the next time the operator runs
 * `scai setup login`, `scai mcp serve`, or `scai policy init`.
 */
export declare const enforceEnvironmentPolicy: (params: EnforceEnvironmentPolicyParams) => void;