/**
 * Security Audit — Production Readiness Warnings
 *
 * Logs security-relevant configuration at server startup.
 * Warn-only approach: no defaults are changed, but insecure
 * configurations are flagged in production environments.
 */
import type { CorsOptions } from '../../common';
/**
 * Security configuration for the audit.
 */
export interface SecurityAuditConfig {
    /** CORS configuration (undefined = permissive default) */
    cors?: CorsOptions | false;
    /** Security options from HttpOptionsInterface */
    security?: {
        strict?: boolean;
        bindAddress?: 'loopback' | 'all' | string;
        dnsRebindingProtection?: {
            enabled?: boolean;
            allowedHosts?: string[];
            allowedOrigins?: string[];
        };
    };
    /** Resolved bind address (what the server actually binds to) */
    resolvedBindAddress?: string;
    /** Deployment mode */
    deploymentMode?: string;
}
/**
 * Individual security finding.
 */
export interface SecurityFinding {
    level: 'warn' | 'info';
    code: string;
    message: string;
    recommendation?: string;
}
/**
 * Audit security configuration and return findings.
 * Called at server startup to produce log warnings.
 *
 * @param config - Current security-relevant configuration
 * @param isProduction - Whether NODE_ENV is 'production'
 * @returns Array of security findings
 */
export declare function auditSecurityDefaults(config: SecurityAuditConfig, isProduction: boolean): SecurityFinding[];
/**
 * Format and log security findings.
 *
 * @param findings - Security findings from auditSecurityDefaults
 * @param logger - Logger with info/warn methods
 */
export declare function logSecurityFindings(findings: SecurityFinding[], logger: {
    info: (msg: string) => void;
    warn: (msg: string) => void;
}): void;
/**
 * Resolve the effective bind address based on configuration and deployment mode.
 *
 * @param security - Security configuration
 * @param deploymentMode - Current deployment mode
 * @returns Resolved IP address string
 */
export declare function resolveBindAddress(security?: SecurityAuditConfig['security'], deploymentMode?: string): string;
//# sourceMappingURL=security-audit.d.ts.map