import type { Config } from '../../config/schema.js';
import type { ResolvedGatewayAuth } from '../auth.js';
export type SecurityAuditFinding = {
    checkId: string;
    severity: 'critical' | 'warn' | 'info';
    title: string;
    detail: string;
    /** Actionable remediation suggestion (aligned with OpenClaw audit format). */
    remediation?: string;
};
/**
 * Pure gateway config audit (no logging). Shared by startup audit and `xopc doctor`.
 */
export declare function collectGatewayConfigFindings(params: {
    auth: ResolvedGatewayAuth;
    bindHost?: string;
    corsOrigins?: string[];
    rateLimitEnabled?: boolean;
    tlsEnabled?: boolean;
    trustedProxies?: string[];
    allowRealIpFallback?: boolean;
    dangerouslyAllowHostHeaderOriginFallback?: boolean;
    strictSecurityEnabled?: boolean;
    rateLimitConfigured?: boolean;
}): SecurityAuditFinding[];
export declare function collectExposureAuditFindings(cfg: Config): SecurityAuditFinding[];
/** Findings from fail-closed startup guards (`assertGatewayRuntimeConfig`). */
export declare function collectGatewayStartupGuardFindings(cfg: Config, env?: NodeJS.ProcessEnv): SecurityAuditFinding[];
/**
 * Full gateway security findings for doctor / CLI audit (config + startup guards).
 */
export declare function collectGatewaySecurityFindings(cfg: Config, env?: NodeJS.ProcessEnv): SecurityAuditFinding[];
/**
 * Audit the gateway configuration at startup and log security findings.
 */
export declare function auditGatewayConfig(params: {
    auth: ResolvedGatewayAuth;
    bindHost?: string;
    corsOrigins?: string[];
    rateLimitEnabled?: boolean;
    tlsEnabled?: boolean;
    trustedProxies?: string[];
    allowRealIpFallback?: boolean;
    dangerouslyAllowHostHeaderOriginFallback?: boolean;
    strictSecurityEnabled?: boolean;
    rateLimitConfigured?: boolean;
}): SecurityAuditFinding[];