/**
 * @packageDocumentation
 *
 * Enforces a `DesignLintPolicy` against a resolved `Config` and/or lint results.
 *
 * Static enforcement (`enforcePolicy`) checks rule configuration and raises
 * a `ConfigError` before any linting begins.
 *
 * Runtime enforcement (`enforceRuntimePolicy`) runs after a lint pass
 * completes and validates token coverage, ratchet, and agent policy
 * constraints against the actual results.
 */
import type { Config } from '../core/linter.js';
import type { DesignLintPolicy, LintResult } from '../core/types.js';
/**
 * Contextual data required for runtime policy enforcement.
 */
export interface RuntimePolicyContext {
    /**
     * Known baseline violation counts for ratchet enforcement.
     * When absent, ratchet checks are skipped.
     */
    baseline?: {
        /** Total violation count from the reference run. */
        totalCount: number;
        /** Computed quality score (0–100) from the reference run. */
        score: number;
    };
    /**
     * Agent identifier for `agentPolicy.trustedAgents` evaluation.
     * When absent, the agent is treated as untrusted.
     */
    agentId?: string;
}
/**
 * Enforces `policy` constraints against `config`.
 *
 * Checks:
 * - Every `requiredRule` is present and not `'off'`.
 * - No rule in `minSeverity` is configured below the minimum.
 *
 * @throws {ConfigError} on the first violation found.
 */
export declare function enforcePolicy(config: Config, policy: DesignLintPolicy): void;
/**
 * Enforces runtime policy constraints against completed lint results.
 *
 * Checks (in order):
 * 1. **tokenCoverage** — when threshold is `1` (100%), any violation for
 *    that token category fails. Sub-100% thresholds require total usage
 *    counts (not currently tracked) and are skipped with no error.
 * 2. **ratchet** — metric mode: total violation count must not exceed
 *    `baseline.totalCount + (maxDelta ?? 0)`. Entropy mode: computed score
 *    must be ≥ `minScore`.
 * 3. **agentPolicy** — `requiredConvergence` fails on any error-severity
 *    message; `maxViolationRate` fails when violations-per-file exceeds the
 *    threshold; trusted agents bypass both checks.
 *
 * @throws {ConfigError} on the first runtime policy violation found.
 */
export declare function enforceRuntimePolicy(results: LintResult[], policy: DesignLintPolicy, context?: RuntimePolicyContext): void;
//# sourceMappingURL=policy-enforcer.d.ts.map