/** Gate proxy configuration. */
export interface GateConfig {
    port: number;
    tls?: {
        cert: string;
        key: string;
    };
    require_agent_auth: boolean;
    policy_mode: 'enforce' | 'dry-run' | 'off';
    policies_dir?: string;
    /** Maximum request body size in bytes (default: 1048576 = 1 MB). Bodies exceeding this return 413. */
    max_body_size: number;
    /** Request timeout in milliseconds (default: 30000 = 30s). Prevents slowloris attacks. */
    request_timeout: number;
    /** Maximum concurrent in-flight requests per agent (default: 50). Prevents socket exhaustion. */
    max_connections_per_agent: number;
}
/** Vault configuration. */
export interface VaultConfig {
    name: string;
    data_dir: string;
    master_key: string;
}
/** Observability configuration. */
export interface ObservabilityConfig {
    log_level: 'debug' | 'info' | 'warn' | 'error';
    log_format: 'json' | 'pretty';
    metrics: boolean;
    dashboard?: {
        enabled: boolean;
        port: number;
    };
}
/** MCP server configuration. */
export interface McpConfig {
    transport: 'stdio' | 'streamable-http';
    port: number;
}
/** Webhook configuration (inline in config file). */
export interface WebhookConfigEntry {
    url: string;
    secret?: string;
    events: string[];
}
/** Complete aegis.config.yaml schema. */
export interface AegisConfigFile {
    gate?: Partial<GateConfig>;
    vault?: Partial<VaultConfig>;
    observability?: Partial<ObservabilityConfig>;
    mcp?: Partial<McpConfig>;
    webhooks?: WebhookConfigEntry[];
}
/** Resolved Aegis configuration — all fields have values. */
export interface AegisConfig {
    port: number;
    masterKey: string;
    salt: string;
    dataDir: string;
    logLevel: 'debug' | 'info' | 'warn' | 'error';
    logFormat: 'json' | 'pretty';
    vaultName: string;
    tls?: {
        cert: string;
        key: string;
    };
    requireAgentAuth: boolean;
    policyMode: 'enforce' | 'dry-run' | 'off';
    policiesDir?: string;
    metricsEnabled: boolean;
    dashboard: {
        enabled: boolean;
        port: number;
    };
    mcp: {
        transport: 'stdio' | 'streamable-http';
        port: number;
    };
    webhooks: WebhookConfigEntry[];
    /** Maximum request body size in bytes (default: 1 MB). */
    maxBodySize: number;
    /** Request timeout in milliseconds (default: 30s). */
    requestTimeout: number;
    /** Max concurrent in-flight requests per agent (default: 50). */
    maxConnectionsPerAgent: number;
    /** Path to the config file used, if any. */
    configFilePath?: string;
}
/**
 * Find the config file path, checking CWD first, then the CLI script's directory.
 * The script directory fallback ensures MCP servers spawned by Claude Desktop /
 * Cursor (which set cwd=/) can still find the config file next to the CLI.
 * Returns absolute path or null if not found.
 */
export declare function findConfigFile(cwd?: string): string | null;
/**
 * Parse a YAML config file. Returns the parsed object.
 * Throws on invalid YAML or file read errors.
 */
export declare function parseConfigFile(filePath: string): AegisConfigFile;
export interface ConfigValidationError {
    path: string;
    message: string;
}
/**
 * Validate a parsed config file. Returns an array of errors (empty = valid).
 */
export declare function validateConfigFile(config: AegisConfigFile): ConfigValidationError[];
export declare function loadEnv(filePath: string): Record<string, string>;
/**
 * Load and resolve the full Aegis configuration.
 *
 * Resolution order (highest priority wins):
 *   1. Environment variables (AEGIS_*)
 *   2. Config file (aegis.config.yaml)
 *   3. Built-in defaults
 *
 * The .env file is loaded into the environment variable layer.
 * The master key has special handling: env → unseal key file → empty.
 */
export declare function getConfig(): AegisConfig;
//# sourceMappingURL=config.d.ts.map