/**
 * manifest enforce-surface
 *
 * CI-safe guard that fails when application code deviates from the
 * compiled Manifest command registry. The strictest registry-vs-app
 * check: refuses to let agents or contributors invent duplicate or
 * bypass write paths when a registered Manifest command already exists.
 *
 * Composes the existing governance detector suite (direct-writes,
 * route-drift, event-fabrication, bypass-violations) with three
 * registry-aware detectors (unregistered-command-call,
 * unregistered-entity-write, existing-command-available) and projects
 * findings into the spec-defined finding codes. Severity is downgraded
 * to `warning` for codes that the spec treats as error-only-in-strict
 * (APPROVED_BYPASS_REQUIRED, DYNAMIC_COMMAND_UNVERIFIABLE).
 *
 * Exit code:
 *   --strict + any error finding → process.exitCode = 1
 *   otherwise → 0
 *
 * The `ok` field on the result mirrors the strict failure condition:
 * ok === (errors === 0).
 */
export interface EnforceSurfaceOptions {
    root?: string;
    commandsRegistry?: string;
    entitiesRegistry?: string;
    bypassRegistry?: string;
    format?: 'text' | 'json';
    strict?: boolean;
    include?: string[];
    exclude?: string[];
    /** ORM client identifier the direct-write detectors match on (default: prisma). */
    writeReceiver?: string;
}
export interface EnforceSurfaceFinding {
    code: string;
    severity: 'error' | 'warning';
    file: string | null;
    line: number | null;
    column: number | null;
    entity: string | null;
    command: string | null;
    message: string;
    suggestion: string;
}
export interface EnforceSurfaceResult {
    ok: boolean;
    root: string;
    registry: {
        commandsRegistry: string | null;
        entitiesRegistry: string | null;
    };
    summary: {
        errors: number;
        warnings: number;
        byCode: Record<string, number>;
    };
    findings: EnforceSurfaceFinding[];
}
export declare function enforceSurfaceCommand(options?: EnforceSurfaceOptions): Promise<EnforceSurfaceResult>;
//# sourceMappingURL=enforce-surface.d.ts.map