/**
 * Runtime SDK configuration — TypeScript parity port of python/runtime/config.py
 * and go-sdk/config.go.
 *
 * The Config interface holds everything required to protect an MCP resource
 * server with AuthSec. It supports two orthogonal mode enums:
 *
 *  - PolicyMode      — how the tool→scope policy is sourced and enforced.
 *  - ValidationMode  — how JWT verification and RFC 7662 introspection combine.
 *
 * Field semantics mirror the Python and Go SDKs exactly. See the production
 * AuthSec admin UI ("Application onboarding → Show config") for canonical
 * example values.
 */
/** How the SDK selects and enforces its tool→scope policy source. */
export type PolicyMode = 'unset' | 'remote_required' | 'remote_with_local_fallback' | 'local_only' | 'open';
/** How JWT and RFC 7662 introspection are combined for token validation. */
export type ValidationMode = 'unset' | 'jwt_only' | 'introspection_only' | 'jwt_and_introspect' | 'jwt_or_introspect';
/**
 * A sync or async function returning a list of manifest tool descriptors.
 * Escape hatch for manifest publishing — bypasses synthetic ``tools/list``.
 */
export type ToolInventoryProvider = () => ManifestToolInput[] | Promise<ManifestToolInput[]>;
/** Loose shape accepted by ToolInventoryProvider / publishManifest. */
export interface ManifestToolInput {
    /** Canonical MCP tool name. */
    name?: string;
    /** Legacy alias accepted from older examples. */
    tool_id?: string;
    title?: string;
    description?: string;
    /** Accept either snake_case (Python) or camelCase (JS) input. */
    input_schema?: Record<string, unknown> | null;
    inputSchema?: Record<string, unknown> | null;
    annotations?: Record<string, unknown> | null;
    suggested_scopes?: string[];
    /** Convenience alias accepted by some helpers. */
    scopes_required?: string[];
}
/** Configuration for protecting an MCP resource server with AuthSec. */
export interface Config {
    issuer: string;
    authorizationServer: string;
    jwksUrl: string;
    introspectionUrl: string;
    introspectionClientId: string;
    introspectionClientSecret: string;
    resourceUri: string;
    resourceName: string;
    /**
     * AuthSec resource server UUID. When set, the SDK fetches the authoritative
     * tool→scope mapping from AuthSec at startup and refreshes it periodically.
     */
    resourceServerId: string;
    /**
     * OAuth scopes this RS advertises in protected-resource metadata. Optional
     * if the RS is already registered in AuthSec.
     */
    supportedScopes: string[];
    /**
     * Optional LOCAL tool→scope mapping for defense-in-depth. Empty list for a
     * tool key marks it explicitly public. Absent key means denied when any
     * policy is active. `null` (or omitted) means "no local map".
     */
    toolScopes: Record<string, string[]> | null;
    /** How long the fetched tool→scope mapping is cached, in seconds. */
    scopeMatrixCacheTtlSeconds: number;
    policyMode: PolicyMode;
    validationMode: ValidationMode;
    /** When true, the SDK pushes its tool inventory to AuthSec at startup. */
    publishManifest: boolean;
    /** SDK author's recommended scope set per tool. Used only for manifest publish. */
    toolScopeSuggestions: Record<string, string[]>;
    /** Escape hatch for manifest publishing — bypass synthetic ``tools/list``. */
    toolInventoryProvider: ToolInventoryProvider | null;
    bearerMethodsSupported: string[];
    requestTimeoutSeconds: number;
}
/** Construct a fresh Config with all defaults. */
export declare function defaultConfig(): Config;
/** Resolve ``policyMode === 'unset'`` to an inferred default. */
export declare function effectivePolicyMode(cfg: Config): PolicyMode;
/** Resolve ``validationMode === 'unset'`` to an inferred default. */
export declare function effectiveValidationMode(cfg: Config): ValidationMode;
/**
 * Validate the config. Throws a verbose Error if unusable. Always run this
 * before constructing a Runtime — production misconfig should fail loudly.
 */
export declare function validateConfig(cfg: Config): void;
/** Return a copy of the config with sensible defaults filled in. */
export declare function normalizeConfig(cfg: Config): Config;
/**
 * Build a Config from environment variables, mirroring the Python `from_env`.
 *
 * Conventional env vars (matching the .env block AuthSec UI emits):
 *
 *   AUTHSEC_ISSUER
 *   AUTHSEC_AUTHORIZATION_SERVER
 *   AUTHSEC_JWKS_URL
 *   AUTHSEC_INTROSPECTION_URL
 *   AUTHSEC_INTROSPECTION_CLIENT_ID
 *   AUTHSEC_INTROSPECTION_CLIENT_SECRET
 *   AUTHSEC_RESOURCE_URI
 *   AUTHSEC_RESOURCE_NAME
 *   AUTHSEC_RESOURCE_SERVER_ID
 *   AUTHSEC_SUPPORTED_SCOPES        (space-separated)
 *   AUTHSEC_POLICY_MODE             ('remote_required', etc.)
 *   AUTHSEC_VALIDATION_MODE         ('jwt_and_introspect', etc.)
 *   AUTHSEC_PUBLISH_MANIFEST        ('true' | 'false')
 */
export declare function loadConfigFromEnv(prefix?: string, env?: NodeJS.ProcessEnv): Config;
//# sourceMappingURL=config.d.ts.map