/**
 * @name premium/private-manifest-loader
 * @description Filesystem loader for private/enterprise premium plugin manifests.
 *
 * When `SAP_MCP_ENABLE_PREMIUM_PLUGINS=true` and `SAP_MCP_PLUGIN_DIR` is set,
 * this module scans the configured directory (and its `manifests/` subdirectory)
 * for `.json` files, validates each against `validatePremiumPluginManifest`,
 * and returns sanitized `PremiumPluginManifest` objects.
 *
 * Security guarantees:
 *   - Manifests are data only — no code is ever executed from plugin files.
 *   - Provider secrets are never read from or stored in manifests.
 *   - Symlink escaping is prevented via `realpathSync` + prefix checks.
 *   - File count (100) and per-file size (256 KB) are capped.
 *   - Every loaded manifest is sanitized to strip any extraneous fields before
 *     being returned to callers.
 *
 * @flow
 *   1. `builtin-plugins.ts:listPremiumPlugins()` calls
 *      `loadPrivatePremiumPluginManifests()` to merge private manifests into
 *      the discovery catalog.
 *   2. `builtin-plugins.ts:premiumPrivatePluginSupport()` calls
 *      `loadPrivatePremiumPluginReport()` for diagnostic output.
 *   3. Internally: `loadPrivatePremiumPluginReport()` scans the plugin dir,
 *      reads + validates each `.json` file, and returns accepted/rejected lists.
 *   4. `loadPrivatePremiumPluginManifests()` returns only the accepted manifests,
 *      deep-cloned to prevent external mutation.
 *
 * @env SAP_MCP_ENABLE_PREMIUM_PLUGINS — Must be `true` or `1` to enable loading.
 * @env SAP_MCP_PLUGIN_DIR              — Filesystem path to the plugin directory.
 * @env SAP_MCP_PREMIUM_EXPOSE_PRIVATE_DISCOVERY — If `true`/`1`, private/enterprise
 *      plugins appear in public discovery responses.
 *
 * @module premium/private-manifest-loader
 */
import type { PremiumPluginManifest, PremiumValidationIssue } from './types.js';
/**
 * @name PrivatePremiumPluginLoadReport
 * @description Diagnostic report returned by `loadPrivatePremiumPluginReport`.
 *
 * @property enabled               - Whether private plugin loading is enabled.
 * @property exposePrivateDiscovery - Whether private plugins appear in discovery.
 * @property pluginDirConfigured    - Whether `SAP_MCP_PLUGIN_DIR` is set.
 * @property loadedManifests        - Successfully validated and sanitized manifests.
 * @property rejectedManifests      - Files that failed validation or loading,
 *   with reason and optional validation errors.
 *
 * @usedBy `builtin-plugins.ts:premiumPrivatePluginSupport` (diagnostic output).
 */
export interface PrivatePremiumPluginLoadReport {
    enabled: boolean;
    exposePrivateDiscovery: boolean;
    pluginDirConfigured: boolean;
    loadedManifests: PremiumPluginManifest[];
    rejectedManifests: Array<{
        file: string;
        reason: string;
        errors?: PremiumValidationIssue[];
    }>;
}
/**
 * @name privatePremiumPluginsEnabled
 * @description Check whether private plugin loading is enabled via env var.
 *
 * @returns `true` if `SAP_MCP_ENABLE_PREMIUM_PLUGINS` is `true` or `1`.
 *
 * @usedBy `loadPrivatePremiumPluginReport` (gate check).
 */
export declare function privatePremiumPluginsEnabled(): boolean;
/**
 * @name premiumDiscoveryIncludesPrivate
 * @description Check whether private/enterprise plugins should appear in
 * public discovery responses.
 *
 * @returns `true` if `SAP_MCP_PREMIUM_EXPOSE_PRIVATE_DISCOVERY` is `true` or `1`.
 *
 * @usedBy `builtin-plugins.ts:listPremiumPlugins` (visibility filter default).
 */
export declare function premiumDiscoveryIncludesPrivate(): boolean;
/**
 * @name loadPrivatePremiumPluginReport
 * @description Scan, validate, and load private premium plugin manifests from
 * the configured plugin directory.
 *
 * Steps:
 *   1. Check if loading is enabled (`SAP_MCP_ENABLE_PREMIUM_PLUGINS`).
 *   2. Check if `SAP_MCP_PLUGIN_DIR` is configured and exists.
 *   3. Discover `.json` files in the root and `manifests/` subdirectory.
 *   4. For each file: check size, parse JSON, validate with
 *      `validatePremiumPluginManifest`, sanitize if valid.
 *   5. Accepted manifests go into `loadedManifests`; rejected ones into
 *      `rejectedManifests` with a reason string.
 *
 * @returns A `PrivatePremiumPluginLoadReport` with loaded and rejected manifests.
 *
 * @usedBy
 *   - `builtin-plugins.ts:loadPrivatePremiumPluginManifests` (accepted only).
 *   - `builtin-plugins.ts:premiumPrivatePluginSupport` (diagnostic counts).
 */
export declare function loadPrivatePremiumPluginReport(): PrivatePremiumPluginLoadReport;
/**
 * @name loadPrivatePremiumPluginManifests
 * @description Return only the successfully loaded private plugin manifests,
 * deep-cloned to prevent external mutation.
 *
 * @returns Array of `PremiumPluginManifest` clones (empty if disabled or no dir).
 *
 * @usedBy `builtin-plugins.ts:listPremiumPlugins` (merged with built-in plugins).
 */
export declare function loadPrivatePremiumPluginManifests(): PremiumPluginManifest[];
//# sourceMappingURL=private-manifest-loader.d.ts.map