/**
 * Security Mode Configuration
 *
 * Enforces security boundaries between development and production environments.
 * Prevents accidental deployment of insecure configurations.
 *
 * @packageDocumentation
 */
/**
 * Security mode levels
 */
export type SecurityMode = 'production' | 'staging' | 'development' | 'testing';
/**
 * Security mode configuration
 */
export interface SecurityModeConfig {
    /** Allow insecure defaults in development */
    allowInsecureDefaults: boolean;
    /** Allow ephemeral signing keys */
    allowEphemeralKeys: boolean;
    /** Allow skipping signature verification */
    allowSkipVerification: boolean;
    /** Allow debug endpoints */
    allowDebugEndpoints: boolean;
    /** Allow verbose error messages */
    allowVerboseErrors: boolean;
    /** Require HTTPS */
    requireHttps: boolean;
    /** Require strong secrets */
    requireStrongSecrets: boolean;
    /** Debug endpoint bind address (localhost only for security) */
    debugEndpointBindAddress?: string;
    /** Require debug authentication token even in development */
    requireDebugAuth?: boolean;
}
/**
 * Get the current security mode based on environment
 *
 * Priority:
 * 1. VORION_SECURITY_MODE (explicit override)
 * 2. VORION_ENV
 * 3. NODE_ENV
 * 4. Default to 'production' (fail-safe)
 */
export declare function getSecurityMode(): SecurityMode;
/**
 * Get security configuration for current mode
 */
export declare function getSecurityConfig(): SecurityModeConfig;
/**
 * Check if current mode is production-grade (production or staging)
 */
export declare function isProductionGrade(): boolean;
/**
 * Check if current mode allows development features
 */
export declare function isDevelopmentMode(): boolean;
/**
 * Require production-grade security
 *
 * Call this before operations that should never run with reduced security.
 *
 * @throws Error if not in production-grade mode
 */
export declare function requireProductionSecurity(operation: string): void;
/**
 * Assert a security condition, throwing if not met in production
 *
 * In development, logs a warning instead of throwing.
 */
export declare function assertSecurityCondition(condition: boolean, message: string, context?: Record<string, unknown>): void;
/**
 * Check if a specific security feature is allowed in current mode
 */
export declare function isSecurityFeatureAllowed(feature: keyof SecurityModeConfig): boolean;
/**
 * Guard for insecure development defaults
 *
 * SECURITY: For encryption keys, this function ALWAYS throws an error.
 * Hardcoded encryption credentials are never allowed, even in development.
 *
 * Use this when providing fallback values that should only work in development.
 * Note: Encryption-related configurations should NOT use this function.
 *
 * @example
 * const secret = process.env.SOME_CONFIG ?? devOnlyDefault('some-config', 'dev-value');
 *
 * @throws Error always for encryption keys (VORION_ENCRYPTION_KEY, VORION_ENCRYPTION_SALT)
 * @throws Error in production/staging for other configurations
 */
export declare function devOnlyDefault<T>(name: string, defaultValue: T): T;
/**
 * Guard for ephemeral keys
 *
 * Use this when generating keys that won't persist across restarts.
 */
export declare function allowEphemeralKey(keyType: string): void;
/**
 * Validate that a secret meets minimum strength requirements
 *
 * @returns true if valid, throws in production if invalid
 */
export declare function validateSecretStrength(secretName: string, secret: string, minLength?: number, minEntropy?: number): boolean;
/**
 * Reset cached mode (for testing only)
 */
export declare function resetSecurityMode(): void;
/**
 * Override security mode (for testing only)
 */
export declare function overrideSecurityMode(mode: SecurityMode): void;
/**
 * Result of encryption configuration validation
 */
export interface EncryptionValidationResult {
    valid: boolean;
    errors: string[];
    warnings: string[];
}
/**
 * Validate encryption configuration at startup
 *
 * This function validates that encryption keys are properly configured.
 * It should be called during application initialization to ensure the
 * system has proper encryption credentials before processing any data.
 *
 * SECURITY: Encryption keys are REQUIRED in ALL environments including development.
 * This prevents accidental exposure of hardcoded credentials.
 *
 * @param options.throwOnError - If true, throws an error when validation fails (default: true)
 * @returns Validation result with errors and warnings
 * @throws Error if validation fails and throwOnError is true
 *
 * @example
 * ```typescript
 * // Call at application startup
 * import { validateEncryptionConfig } from './security-mode.js';
 *
 * try {
 *   validateEncryptionConfig();
 *   console.log('Encryption configuration validated successfully');
 * } catch (error) {
 *   console.error('Encryption configuration error:', error.message);
 *   process.exit(1);
 * }
 * ```
 */
export declare function validateEncryptionConfig(options?: {
    throwOnError?: boolean;
}): EncryptionValidationResult;
//# sourceMappingURL=security-mode.d.ts.map