import { type Config } from '../common/config.js';
/**
 * Security check category
 */
export type SecurityCheckCategory = 'crypto' | 'auth' | 'network' | 'data' | 'config';
/**
 * Security check severity level
 */
export type SecurityCheckSeverity = 'critical' | 'high' | 'medium' | 'low';
/**
 * Individual security check result
 */
export interface SecurityCheck {
    /** Unique identifier for this check (e.g., 'JWT_SECRET_ENTROPY') */
    id: string;
    /** Human-readable name for the check */
    name: string;
    /** Category of security concern */
    category: SecurityCheckCategory;
    /** Severity level if the check fails */
    severity: SecurityCheckSeverity;
    /** Whether the check passed */
    passed: boolean;
    /** Detailed message about the check result */
    message: string;
    /** Remediation steps if the check failed */
    remediation?: string;
}
/**
 * Overall security audit result
 */
export interface SecurityCheckResult {
    /** Whether all critical and high severity checks passed */
    passed: boolean;
    /** All individual check results */
    checks: SecurityCheck[];
    /** Checks that failed with critical severity */
    criticalFailures: SecurityCheck[];
    /** Checks that failed with high or medium severity */
    warnings: SecurityCheck[];
    /** General security recommendations */
    recommendations: string[];
}
/**
 * Calculate Shannon entropy of a string in bits
 *
 * Shannon entropy measures the unpredictability of a string.
 * For cryptographic secrets, higher entropy indicates better randomness.
 *
 * @param str - The string to analyze
 * @returns Entropy in bits (total, not per-character)
 *
 * @example
 * ```typescript
 * // Random 32-byte base64 string has ~170-190 bits entropy
 * calculateEntropy('Rk8qYjM2N3RoZXJlYXJlbm9zcG9vbnM='); // ~180 bits
 *
 * // Weak string with repeated characters has low entropy
 * calculateEntropy('aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'); // ~0 bits
 * ```
 */
export declare function calculateEntropy(str: string): number;
/**
 * Run comprehensive security audit on configuration
 *
 * Executes all security checks and returns categorized results.
 * In production mode, critical failures will cause the audit to fail.
 *
 * @param config - The configuration to audit (defaults to getConfig())
 * @returns Promise resolving to security check results
 *
 * @example
 * ```typescript
 * const result = await runSecurityAudit();
 *
 * if (!result.passed) {
 *   for (const failure of result.criticalFailures) {
 *     console.error(`CRITICAL: ${failure.name} - ${failure.message}`);
 *     console.error(`  Remediation: ${failure.remediation}`);
 *   }
 *   process.exit(1);
 * }
 *
 * // Log warnings
 * for (const warning of result.warnings) {
 *   console.warn(`WARNING: ${warning.name} - ${warning.message}`);
 * }
 * ```
 */
export declare function runSecurityAudit(config?: Config): Promise<SecurityCheckResult>;
/**
 * Run security audit and throw if critical failures are found
 *
 * Convenience function for startup validation that throws an error
 * if the configuration doesn't meet security requirements.
 *
 * @param config - The configuration to audit
 * @throws Error if critical security checks fail
 *
 * @example
 * ```typescript
 * // In application startup
 * try {
 *   await assertSecureConfig();
 *   console.log('Security configuration validated');
 * } catch (error) {
 *   console.error('Security validation failed:', error.message);
 *   process.exit(1);
 * }
 * ```
 */
export declare function assertSecureConfig(config?: Config): Promise<void>;
/**
 * Get security audit summary for health checks
 *
 * Returns a lightweight summary suitable for health check endpoints.
 *
 * @param config - The configuration to audit
 * @returns Summary object with passed status and counts
 */
export declare function getSecurityAuditSummary(config?: Config): Promise<{
    passed: boolean;
    totalChecks: number;
    passedChecks: number;
    criticalFailures: number;
    highFailures: number;
    mediumWarnings: number;
    lowWarnings: number;
}>;
//# sourceMappingURL=config-validator.d.ts.map