/**
 * Security Configuration
 * JWT, CSRF, encryption and other security settings
 * Sealed namespace for immutability
 *
 * APP_KEY: Primary encryption key for storage signing and app-level encryption.
 *          Set automatically during project scaffolding.
 *
 * Security keys can be configured per domain:
 * - APP_KEY: Default encryption key for all operations (auto-generated)
 * - API_KEY_SECRET: Optional API key authentication (if API_KEY_ENABLED=true)
 * - ENCRYPTION_CIPHER: Cipher for encrypted envelope interoperability
 * - JWT_SECRET: JWT token signing key
 *
 * Developers can use a single APP_KEY or configure separate keys for different
 * security domains (e.g., different keys for different microservices).
 */
export declare const securityConfig: Readonly<{
    /**
     * JWT Configuration
     */
    readonly jwt: {
        readonly enabled: boolean;
        readonly secret: string;
        readonly algorithm: "HS256" | "HS512" | "RS256";
        readonly expiresIn: number;
        readonly refreshExpiresIn: string;
        readonly issuer: string;
        readonly audience: string;
    };
    /**
     * CSRF Protection
     */
    readonly csrf: {
        readonly enabled: boolean;
        readonly headerName: string;
        readonly tokenName: string;
        readonly cookieName: string;
        readonly cookieHttpOnly: boolean;
        readonly cookieSecure: boolean;
        readonly cookieSameSite: "strict" | "lax" | "none";
    };
    /**
     * Encryption
     */
    readonly encryption: {
        readonly cipher: string;
        readonly appKey: string;
        readonly appPreviousKeys: string;
        readonly algorithm: string;
        readonly key: string;
    };
    /**
     * API Key Authentication
     */
    readonly apiKey: {
        readonly enabled: boolean;
        readonly headerName: string;
        readonly secret: string;
    };
    /**
     * CORS Configuration
     */
    readonly cors: {
        readonly enabled: boolean;
        readonly origins: string[];
        readonly methods: string[];
        readonly allowedHeaders: string[];
        readonly exposedHeaders: string[];
        readonly credentials: boolean;
        readonly maxAge: number;
    };
    /**
     * Rate Limiting
     */
    readonly rateLimit: {
        readonly enabled: boolean;
        readonly windowMs: number;
        readonly maxRequests: number;
        readonly message: string;
    };
    /**
     * XSS Protection
     */
    readonly xss: {
        readonly enabled: boolean;
        readonly reportUri: string;
    };
    /**
     * Helmet Security Headers
     */
    readonly helmet: {
        readonly enabled: boolean;
        readonly contentSecurityPolicy: boolean;
        readonly hsts: {
            readonly enabled: boolean;
            readonly maxAge: number;
            readonly includeSubDomains: boolean;
        };
    };
    /**
     * Session Configuration
     */
    readonly session: {
        readonly name: string;
        readonly secret: string;
        readonly expiresIn: number;
        readonly secure: boolean;
        readonly httpOnly: boolean;
        readonly sameSite: "strict" | "lax" | "none";
    };
    /**
     * Password settings
     */
    readonly password: {
        readonly minLength: number;
        readonly requireUppercase: boolean;
        readonly requireNumbers: boolean;
        readonly requireSpecialChars: boolean;
        readonly bcryptRounds: number;
    };
}>;
//# sourceMappingURL=security.d.ts.map