/**
 * Environment shape validation for the Actuate CMS runtime.
 *
 * The `/health` and admin diagnostics endpoints surface this so operators
 * notice mis-configured secrets *before* a runtime call hits them. We never
 * return the values themselves — only the validation verdict and a redacted
 * preview where it helps debugging (e.g. "first 4 hex chars match").
 *
 * Why a dedicated module:
 *   - Centralises all "is this env var well-formed" rules so consumers don't
 *     re-invent length / hex / placeholder checks per call site.
 *   - Fails closed on shape errors (e.g. a 31-char CMS_SECRET, an
 *     `aes256-local-dev-key-...` placeholder still in production) which the
 *     prior `presence-only` check missed entirely (audit issue M6).
 */
export type EnvCheckSeverity = 'ok' | 'warn' | 'error' | 'missing';
export interface EnvCheck {
    /** Variable name, e.g. `CMS_SECRET`. */
    name: string;
    /** Verdict bucket. */
    status: EnvCheckSeverity;
    /** Human-readable message safe to surface to the operator. */
    message: string;
    /** True when the var is required for production deploys. */
    required: boolean;
}
export interface EnvCheckSummary {
    ok: boolean;
    /** Number of variables in `error` or `missing` (required) state. */
    errorCount: number;
    /** Number of variables in `warn` state. */
    warnCount: number;
    checks: EnvCheck[];
}
interface EnvSource {
    get(name: string): string | undefined;
}
/**
 * Validate the shape of every well-known runtime env var. Pass a custom
 * `source` to test without mutating `process.env`.
 */
export declare function validateEnvShape(source?: EnvSource): EnvCheckSummary;
export {};
//# sourceMappingURL=env.d.ts.map