export interface AgentConfig {
    rate_limit_rpm?: number;
    allowed_facades?: string[];
    tier?: 'core' | 'pro' | 'apps';
}
export interface DaemonConfig {
    daemon: {
        port: number;
        host: string;
        auth_token?: string;
        log_max_size_mb: number;
        log_max_files: number;
        rate_limit_rpm: number;
        gc_interval_secs: number;
    };
    /** AgentHQ post office (EPIC-0037). The token is a secret — see tools/postoffice.ts. */
    hq?: {
        url?: string;
        token?: string;
    };
    license?: {
        key?: string;
    };
    /**
     * Zoom AI Companion ingestion (EPIC-0036). Server-to-Server OAuth credentials.
     * These are ACCOUNT-WIDE ADMIN scope — meeting_summary:read:admin reads every
     * meeting in the account, not only client ones. See ISS-0123.
     */
    zoom?: {
        account_id?: string;
        client_id?: string;
        client_secret?: string;
    };
    /**
     * Private facades loaded at boot (EPIC-0038 Phase 7). `allow` holds absolute
     * paths to extension modules; anything else is rejected by the loader. This
     * lives in config rather than the environment on purpose — see the trust
     * boundary note in runtime/extensions.ts.
     */
    extensions?: {
        allow?: string[];
    };
    /**
     * Hosted sessions (ADR-0012 / decibel-hq EPIC-0015). The session WRITE routes
     * — attach-token, control, spawn, WS attach — can start `claude` and type into
     * it, so they are gated on their own bearer rather than the daemon's, which is
     * usually unset on a localhost daemon. No token = those routes fail closed.
     * The token is a secret (POL-0002): it never reaches a browser; the HQ dev
     * proxy injects it server-side.
     */
    sessions?: {
        token?: string;
        allowed_origins?: string[];
    };
    /**
     * claude-peers broker supervision (ISS-0193). When `broker.command` is set,
     * the daemon keeps the broker on 127.0.0.1:7899 alive, starting it detached
     * when /health does not answer. Absolute paths only.
     */
    peers?: {
        broker?: {
            command?: string[];
        };
    };
    agents?: Record<string, AgentConfig>;
}
/**
 * Load config from ~/.decibel/config.yaml, merged with defaults.
 * Returns defaults if file doesn't exist or is invalid.
 */
export declare function loadConfig(): DaemonConfig;
/**
 * Get the config file path (for display purposes).
 */
export declare function getConfigPath(): string;
/**
 * Write a license key into ~/.decibel/config.yaml, creating the file if
 * needed. Uses parseDocument so existing comments and formatting survive —
 * this file is hand-edited by users.
 */
export declare function writeLicenseKey(key: string): void;
/**
 * Merge CLI flags over config file values. CLI takes precedence.
 */
export declare function mergeCliOverrides(config: DaemonConfig, overrides: {
    port?: number;
    host?: string;
    authToken?: string;
    logMaxSizeMb?: number;
    logMaxFiles?: number;
    rateLimitRpm?: number;
}): DaemonConfig;
/**
 * Reload config and return hot-reloadable fields that changed.
 * Port and host changes are detected but require a restart.
 */
export declare function reloadConfig(current: DaemonConfig): {
    config: DaemonConfig;
    changes: string[];
    requiresRestart: boolean;
};
//# sourceMappingURL=daemonConfig.d.ts.map