/**
 * SSL Configuration Utility
 *
 * Provides centralized SSL configuration for PostgreSQL connections based on
 * connection string sslmode parameter and environment variables.
 *
 * Extracted from @revealui/core to break circular dependencies
 *
 * @module ssl-config
 */
/**
 * PostgreSQL SSL configuration options
 */
interface SSLConfig {
    rejectUnauthorized: boolean;
}
/**
 * Determines the appropriate SSL configuration for a PostgreSQL connection
 * based on the connection string's sslmode parameter.
 *
 * SSL Modes (aligned with PostgreSQL libpq standards):
 * - `disable`: No SSL connection
 * - `require`: SSL connection with certificate verification
 * - `verify-full`: Full SSL verification (same as require in pg v9+)
 * - `verify-ca`: CA verification (treated as verify-full)
 *
 * Environment Override:
 * - `DATABASE_SSL_REJECT_UNAUTHORIZED=false`: Force skip certificate verification
 *   (DEVELOPMENT ONLY - use for self-signed certificates in local environments)
 *
 * @param connectionString - PostgreSQL connection string (may include sslmode parameter)
 * @returns SSL configuration object or false to disable SSL
 *
 * @example
 * ```typescript
 * // Connection string with SSL required
 * const ssl = getSSLConfig('postgresql://user:pass@host/db?sslmode=require')
 * // Returns: { rejectUnauthorized: true }
 *
 * // Connection string without SSL
 * const ssl = getSSLConfig('postgresql://localhost:5432/db')
 * // Returns: false
 *
 * // Development override for self-signed certificates
 * process.env.DATABASE_SSL_REJECT_UNAUTHORIZED = 'false'
 * const ssl = getSSLConfig('postgresql://user:pass@host/db?sslmode=require')
 * // Returns: { rejectUnauthorized: false }
 * ```
 */
declare function getSSLConfig(connectionString: string): SSLConfig | false;
/**
 * Validates SSL configuration for production environments.
 * Warns if insecure SSL settings are detected in production.
 *
 * @param connectionString - PostgreSQL connection string
 * @param environment - Current environment (e.g., 'production', 'development')
 */
declare function validateSSLConfig(connectionString: string, environment?: string): boolean;

export { type SSLConfig, getSSLConfig, validateSSLConfig };