/**
 * OAuth Configuration
 *
 * Provider configuration and initialization utilities
 */
import type { OAuthProviderConfig, OAuthPluginConfig, ProviderRegistry, Logger } from '../types.ts';
/**
 * Expand environment variable in a string value
 *
 * If the value is a string in the format `${VAR_NAME}`, it will be replaced
 * with the value of the environment variable. Non-string values are returned unchanged.
 *
 * @example
 * expandEnvVar('${MY_VAR}') // Returns process.env.MY_VAR or '${MY_VAR}' if undefined
 * expandEnvVar('literal')   // Returns 'literal'
 * expandEnvVar(123)         // Returns 123
 * expandEnvVar(true)        // Returns true
 */
export declare function expandEnvVar(value: any): any;
/**
 * Recursively expand `${ENV_VAR}` placeholders on every string leaf of a value.
 *
 * Used for structured config blocks (like `mcp`) where sensitive leaves
 * (e.g., `mcp.dynamicClientRegistration.initialAccessToken`) still need
 * env-var expansion but the block itself isn't a flat property bag.
 */
export declare function expandEnvVarsDeep<T>(value: T): T;
/**
 * Coerce a config value that documents a boolean but may arrive as an
 * env-expanded string (`enabled: ${FLAG}` → `"false"`). Returns the boolean
 * for `true`/`false` (case-insensitive), otherwise `undefined` (so callers
 * apply their own default). A real boolean passes through unchanged.
 */
export declare function coerceConfigBoolean(value: unknown): boolean | undefined;
/**
 * Normalize the security-relevant fields of the `mcp` config block in place,
 * so a mis-typed value can never silently fail open:
 * - `mcp.enabled` and `mcp.clientIdMetadataDocuments.enabled` are coerced from
 *   documented boolean strings to real booleans (an env-expanded `"false"`
 *   would otherwise be truthy and enable the feature the operator disabled).
 * - `mcp.clientIdMetadataDocuments.allowedHosts` is normalized to an array of
 *   exact, lowercased hostnames. A scalar string (which `Array.includes` /
 *   `String.includes` would turn into substring matching) is wrapped into a
 *   single-element array; anything that isn't a string or array of strings is
 *   rejected rather than treated as "no restriction".
 * - `mcp.clientCredentials.enabled` is coerced the same way — this flag mints
 *   tokens for headless agents, so a stray truthy string must not enable it
 *   (it is explicit opt-in, default OFF).
 */
export declare function normalizeMcpSecurityConfig(mcpConfig: Record<string, any>): void;
/**
 * Build configuration for a specific provider
 */
export declare function buildProviderConfig(providerConfig: Record<string, any>, providerName: string, pluginDefaults?: Partial<OAuthProviderConfig>): OAuthProviderConfig;
/**
 * Extract plugin-level defaults from options
 */
export declare function extractPluginDefaults(options: OAuthPluginConfig): Partial<OAuthProviderConfig>;
/**
 * Initialize OAuth providers from configuration
 */
export declare function initializeProviders(options: OAuthPluginConfig, logger?: Logger): ProviderRegistry;