/**
 * Startup security-posture check.
 *
 * Surfaces every security/integrity-relevant setting that is currently in a
 * LESS-SAFE state — whether because the user set it that way, or because the
 * backward-compatible default is the less-strict option. The goal is a single,
 * loud, grouped banner at boot so a new operator who inherited an .env (or never
 * configured these) immediately sees what protections are off and how to enable
 * them. It only WARNS — it never changes behavior or refuses to start.
 *
 * To add a new check: append an entry to SECURITY_CHECKS. `isLessSafe` returns
 * true when the current value is the weaker posture; `message`/`fix` explain it.
 */
/** Recommended minimum length for the JWT signing secret. */
export declare const MIN_SECRET_LENGTH = 32;
/**
 * Evaluate the checks and return the keys currently in a less-safe state. Pure
 * (no output) so it can be unit-tested directly. Used by
 * validateSecurityPostureAtStartup for the banner.
 */
export declare function evaluateSecurityPosture(): string[];
/**
 * The one fatal startup check: a missing SECRET_KEY means nothing can authenticate
 * safely, so the server must NOT start. Throws. (Short-but-present secrets are an
 * advisory posture check, not fatal — see the SECRET_KEY entry above.) Always runs,
 * including under TEST_MODE, since a missing secret is fatal regardless.
 */
export declare function assertRequiredSecuritySettings(): void;
/**
 * Single startup security entry point:
 *  1. Hard-fail on missing required settings (SECRET_KEY) — fail fast.
 *  2. Print a grouped advisory banner for every setting in a less-safe state.
 * No banner when everything is safe; banner skipped under TEST_MODE (the fatal
 * check in step 1 still runs). Returns the list of triggered advisory keys.
 */
export declare function validateSecurityPostureAtStartup(): string[];
//# sourceMappingURL=securityPosture.d.ts.map