/**
 * ProviderCompliance boot-hook -- operator-visible configuration verification.
 *
 * C-2 (2026-04-21, fail-open remediation): flipping strictMode default to
 * true in the constructor is necessary but not sufficient. An operator can
 * still explicitly pass `strictMode: false` and silently degrade the
 * compliance posture. This boot-hook surfaces that configuration at process
 * start with explicit errors and warnings so it cannot hide in production.
 *
 * Call this from the server boot sequence (e.g. packages/governance-server
 * index) BEFORE accepting traffic. When `ok` is false, refuse to boot.
 *
 * IMPORTANT (2026-04-21): hook ready; wire into packages/governance-server
 * src/index.ts after P1C-03 fix lands. A concurrent agent owns that file in
 * this cycle, so the wiring commit is deferred to a follow-up.
 *
 * @connexum/ai-governance
 */
import type { ProviderCompliance } from './provider-compliance';
export interface VerifyProviderComplianceConfigOptions {
    /**
     * Known providers the host application intends to call at runtime.
     * Typically pulled from LLM destination config, env vars, or the
     * vendor-routes destination registry. Each entry is checked against
     * the enforcer and must be allowed.
     */
    expectedProviders?: string[];
    /**
     * If true (default), a permissive-mode deployment that ALSO declares
     * an unknown provider in `expectedProviders` is upgraded from a
     * warning to an error (boot refusal). Set to false only for synthetic
     * test harnesses.
     */
    rejectPermissivePlusUnknown?: boolean;
}
export interface VerifyProviderComplianceConfigResult {
    ok: boolean;
    warnings: string[];
    errors: string[];
    /** Snapshot of relevant config fields for audit logs */
    snapshot: {
        strictMode: boolean;
        activePacks: string[];
        expectedProviders: string[];
    };
}
/**
 * Verify the instantiated ProviderCompliance enforcer is in a safe
 * production posture. Returns a structured result; the caller decides
 * whether to refuse boot, though `ok: false` is strong signal to abort.
 *
 * Error conditions:
 *   - `strictMode: false` AND any `expectedProviders` entry resolves to
 *     an unknown provider (would have been silently approved under the
 *     old buggy default). Rejects boot.
 *   - Any `expectedProviders` entry that is rejected by the enforcer
 *     (unknown or pack-blocked under strict mode). Rejects boot.
 *
 * Warning conditions:
 *   - `strictMode: false` with no unknown expected providers. Boot is
 *     still permitted but permissive mode is logged at WARN.
 */
export declare function verifyProviderComplianceConfig(enforcer: ProviderCompliance, options?: VerifyProviderComplianceConfigOptions): VerifyProviderComplianceConfigResult;
//# sourceMappingURL=provider-compliance-boot.d.ts.map