export interface ConstraintViolation {
    field: string;
    expected: unknown;
    got: unknown;
}
export interface ConstraintResult {
    ok: boolean;
    violation?: ConstraintViolation;
    /**
     * Request merged with any absent constrained fields filled in from the
     * constraints. Returned as a loose record since constraints may include
     * fields beyond the typed request schema (e.g. AuthHero-internal
     * `domain`, `integration_type` for the Phase 4 /connect/start flow).
     */
    filled: Record<string, unknown>;
}
/**
 * Enforce IAT-pre-bound metadata constraints on a registration request.
 *
 * Rule per plan: each constrained field must either be absent from the
 * request (filled in from the constraint) or exactly equal. No merging,
 * no subset matching.
 */
export declare function enforceConstraints(constraints: Record<string, unknown> | undefined, request: Readonly<Record<string, unknown>>): ConstraintResult;
