import './assert_dev_env.js';
import { type SurfaceSecurityPolicyOptions, type ErrorSchemaTightnessOptions } from './surface_invariants.js';
import { type AppSurfaceSpec } from '../http/surface.js';
/** Options for adversarial test runners (auth enforcement and input validation). */
export interface AdversarialTestOptions {
    /** Build the app surface bundle (surface + route specs + middleware specs). */
    build: () => AppSurfaceSpec;
    /** All roles in the app (e.g. `['admin', 'keeper']`). */
    roles: Array<string>;
}
/**
 * Generate adversarial HTTP auth enforcement test suites.
 *
 * Describe blocks:
 * - unauthenticated → 401 — every protected route
 * - wrong role → 403 — every role route, tested with all non-matching roles
 * - authenticated without role → 403 — every role route, no-role context
 * - correct auth passes guard — every protected route, assert not 401/403
 */
export declare const describe_adversarial_auth: (options: AdversarialTestOptions) => void;
/**
 * Merge a consumer's `error_schema_tightness` option with
 * `default_error_schema_tightness` so `allowlist` and `ignore_statuses` are
 * additive rather than replacing.
 *
 * - `undefined` → return the default as-is.
 * - `null` → return `null` (opt out of the assertion).
 * - object → spread the default, then consumer overrides for scalar fields
 *   (`min_specificity`), then concat stock-then-consumer for the list fields
 *   (`allowlist`, `ignore_statuses`) so consumer entries extend rather than
 *   replace.
 *
 * Exported for direct use when a consumer calls `assert_error_schema_tightness`
 * outside the standard suite but still wants the additive merge.
 */
export declare const resolve_standard_error_schema_tightness: (consumer: ErrorSchemaTightnessOptions | null | undefined) => ErrorSchemaTightnessOptions | null;
/** Options for the standard attack surface test suite. */
export interface StandardAttackSurfaceOptions {
    /** Build the app surface bundle (surface + route specs + middleware specs). */
    build: () => AppSurfaceSpec;
    /** Absolute path to the committed snapshot JSON file. */
    snapshot_path: string;
    /** Expected public routes, e.g. `['GET /health', 'POST /api/account/login']`. */
    expected_public_routes: Array<string>;
    /** Expected middleware names for API routes, e.g. `['origin', 'session', 'request_context', 'bearer_auth']`. */
    expected_api_middleware: Array<string>;
    /** All roles in the app (e.g. `['admin', 'keeper']`). */
    roles: Array<string>;
    /** Path prefix for middleware stack assertion. Default `'/api/'`. */
    api_path_prefix?: string;
    /** Security policy configuration. Omit for sensible defaults. */
    security_policy?: SurfaceSecurityPolicyOptions;
    /**
     * Error schema tightness assertion config. Defaults to
     * `default_error_schema_tightness` (ignores 401/403/429,
     * `min_specificity: 'enum'`, allowlist seeded with
     * `fuz_app_stock_route_tightness_allowlist`).
     *
     * Consumer-supplied `allowlist` and `ignore_statuses` are **additive** —
     * the suite merges them underneath the stock defaults, so project-specific
     * entries don't need to re-list fuz_app's own stock routes. Pass a narrower
     * config to extend either list or tighten `min_specificity`; pass `null`
     * to skip the assertion and keep the audit log informational-only.
     */
    error_schema_tightness?: ErrorSchemaTightnessOptions | null;
}
/**
 * Run the standard attack surface test suite.
 *
 * Test groups:
 * 1. Snapshot — live surface matches committed JSON
 * 2. Determinism — building twice yields identical results
 * 3. Public routes — bidirectional check (no unexpected, no missing)
 * 4. Middleware stack — every API route has the full middleware chain
 * 5. Surface invariants — structural assertions over `surface.routes` (error schemas, descriptions, duplicates, consistency)
 * 6. RPC/WS surface invariants — structural assertions over `surface.rpc_endpoints` + `surface.ws_endpoints` (descriptions, protocol-action spread, kind ⇔ auth)
 * 7. Security policy — rate limiting on sensitive routes, no unexpected public mutations, method conventions
 * 8. Error schema tightness — informational log of generic vs specific error schemas, plus assertion against `default_error_schema_tightness` by default (opt out with `error_schema_tightness: null`)
 * 9. Adversarial auth — unauthenticated/wrong-role/correct-auth enforcement
 * 10. Adversarial input — input body and params validation
 * 11. Adversarial 404 — stub 404 handlers, validate response bodies against declared schemas
 *
 * Consumer test files call this with project-specific options, then add
 * any project-specific assertions in additional `describe` blocks.
 */
export declare const describe_standard_attack_surface_tests: (options: StandardAttackSurfaceOptions) => void;
//# sourceMappingURL=attack_surface.d.ts.map