/**
 * Security-aware migration (#306).
 *
 * Migration is the edge between the two security endpoints (#296 ↔ #305).
 * Security properties don't translate 1:1 — some are silently preserved, some
 * lost, some need re-establishing on the GitLab side. This module classifies
 * each security-relevant property's fate as it crosses the boundary and runs
 * the GitLab security post-synth checks against the migrated output so anything
 * lost in translation is caught on the target side.
 */
import type { ProvenanceRecord } from "./provenance.js";
/**
 * Classify the fate of security-relevant properties as they migrate from a
 * GitHub Actions workflow to GitLab CI. Returns provenance records carrying a
 * `security` classification (which flow into diagnostics, SARIF, and the report
 * like any other provenance record).
 */
export declare function analyzeSecurity(sourceYaml: string, opts?: {
    sourceFile?: string;
}): ProvenanceRecord[];
/**
 * Run the GitLab security post-synth checks against the migrated `.gitlab-ci.yml`
 * and return their findings as provenance records — *migrate, then prove the
 * output clears the GitLab security bar*. Anything lost in translation that
 * lands as a concrete weakness on the target is caught here.
 */
export declare function runSecurityChecks(gitlabYaml: string, opts?: {
    sourceFile?: string;
}): Promise<ProvenanceRecord[]>;
/**
 * Render a "Security posture" Markdown section from the security provenance
 * records (those carrying a `security` classification).
 */
export declare function renderSecurityPosture(records: ProvenanceRecord[]): string;
//# sourceMappingURL=security.d.ts.map