/**
 * Security settings parsing + validation (pure).
 *
 * The persisted, enforced policy lives under the `security` key of the
 * `settings` global. Only fields the runtime actually enforces are stored
 * here (MFA requirement + grace, concurrent-session cap) so the UI never
 * presents a control that does nothing.
 */
import type { SecuritySettings } from './types.js';
export declare const DEFAULT_SECURITY_SETTINGS: SecuritySettings;
export declare const MFA_GRACE_PERIOD_OPTIONS: readonly [0, 1, 7, 14, 30];
export declare const MAX_CONCURRENT_SESSION_OPTIONS: readonly [0, 3, 5, 10];
export interface SecurityValidationIssue {
    field: string;
    message: string;
    severity: 'error' | 'warning';
}
/** Read the `security` blob off a settings document, coercing to a safe shape. */
export declare function parseSecuritySettings(blob: unknown): SecuritySettings;
/** Validate an incoming settings payload. Pure — no DB / lockout checks here. */
export declare function validateSecuritySettings(settings: SecuritySettings): SecurityValidationIssue[];
/**
 * Lockout-safe MFA enable check. Enabling org-wide MFA while the acting admin
 * has no TOTP configured would lock them (and possibly everyone) out. Callers
 * MUST run this server-side before persisting `mfa.required = true`.
 */
export declare function mfaEnableLockoutError(input: {
    enabling: boolean;
    viewerHasMfa: boolean;
    totalAdmins: number;
}): string | null;
/**
 * Validate a single allowlist entry: an IPv4/IPv6 literal or a CIDR range.
 * Standalone (does not import the matcher's private helpers) so it can run in
 * the client bundle for inline form validation.
 */
export declare function validateIpRange(entry: string): boolean;
//# sourceMappingURL=settings.d.ts.map