import { z } from 'zod/v4';
import type { IKeycloakUser } from './keycloak.types.js';
/**
 * Keycloak module configuration schema with validation.
 *
 * Enforces strict rules on required vs optional fields based on `validationMode`:
 * - **Online mode** (default): `clientSecret` is REQUIRED (non-empty string)
 * - **Offline mode**: `clientSecret` is optional and ignored (JWT validation via JWKS)
 *
 * Additional configuration:
 * - `jwksCacheTtlMs`: Cache TTL for JWKS in milliseconds (default 300000 = 5 min)
 * - `issuer`: Token issuer URL override (defaults to authServerUrl)
 * - `clockSkewSeconds`: accepted and validated, but not currently read by offline JWT
 *   validation — use `clockToleranceSec` instead (default 30, kept for schema/backward compatibility)
 * - `clockToleranceSec`: Clock tolerance in seconds for offline JWT expiry validation (optional) —
 *   this is the field `keycloak-token-validation.service.ts` actually consumes
 * - `introspectionTimeoutMs`: HTTP timeout for online introspection requests (optional)
 * - `introspectionCacheTtlMs`: Cache TTL for introspection results (optional)
 * - `failedIntrospectionCacheTtlMs`: Cache TTL for failed (negative) introspection results (optional) —
 *   caches invalid/expired tokens to reduce Keycloak load; see JSDoc for security tradeoff details
 * - `mapUserFn`: Optional hook to reshape the extracted user object after successful validation (optional) —
 *   allows custom claim mapping for non-standard Keycloak protocol mappers
 *
 * @example
 * ```ts
 * // Online mode (requires clientSecret)
 * const onlineConfig = KEYCLOAK_CONFIG_SCHEMA.parse({
 *   authServerUrl: 'https://auth.example.com',
 *   realm: 'myrealm',
 *   clientId: 'my-service',
 *   clientSecret: 'secret',
 *   validationMode: 'online'
 * });
 *
 * // Offline mode (clientSecret optional)
 * const offlineConfig = KEYCLOAK_CONFIG_SCHEMA.parse({
 *   authServerUrl: 'https://auth.example.com',
 *   realm: 'myrealm',
 *   clientId: 'my-service',
 *   validationMode: 'offline',
 *   clockToleranceSec: 60
 * });
 * ```
 */
export declare const KEYCLOAK_CONFIG_SCHEMA: z.ZodObject<{
    authServerUrl: z.ZodString;
    realm: z.ZodString;
    clientId: z.ZodString;
    validationMode: z.ZodDefault<z.ZodEnum<{
        online: "online";
        offline: "offline";
    }>>;
    clientSecret: z.ZodOptional<z.ZodString>;
    jwksCacheTtlMs: z.ZodDefault<z.ZodNumber>;
    issuer: z.ZodOptional<z.ZodString>;
    clockSkewSeconds: z.ZodDefault<z.ZodNumber>;
    clockToleranceSec: z.ZodOptional<z.ZodNumber>;
    introspectionTimeoutMs: z.ZodOptional<z.ZodNumber>;
    introspectionCacheTtlMs: z.ZodOptional<z.ZodNumber>;
    failedIntrospectionCacheTtlMs: z.ZodOptional<z.ZodNumber>;
    mapUserFn: z.ZodOptional<z.ZodFunction<z.ZodTuple<readonly [z.ZodRecord<z.ZodString, z.ZodUnknown>, z.ZodCustom<IKeycloakUser, IKeycloakUser>], null>, z.ZodCustom<IKeycloakUser, IKeycloakUser>>>;
}, z.core.$strip>;
/**
 * Inferred type of KEYCLOAK_CONFIG_SCHEMA.
 *
 * Represents validated Keycloak module configuration. Enforces the online/offline clientSecret
 * contract: online mode requires non-empty clientSecret; offline mode allows it to be omitted.
 *
 * @example
 * ```ts
 * const config: TKeycloakConfig = {
 *   authServerUrl: 'https://auth.example.com',
 *   realm: 'test',
 *   clientId: 'test-client',
 *   clientSecret: 'secret',
 *   validationMode: 'offline'
 * };
 * ```
 */
export type TKeycloakConfig = z.infer<typeof KEYCLOAK_CONFIG_SCHEMA>;
/**
 * Asserts that config conforms to the Keycloak configuration schema.
 *
 * @param config - The configuration object to validate
 * @throws {z.ZodError} If config fails validation
 *
 * @example
 * ```ts
 * AssertKeycloakConfig({
 *   authServerUrl: 'https://auth.example.com',
 *   realm: 'myrealm',
 *   clientId: 'my-service',
 *   clientSecret: 'secret',
 *   validationMode: 'online'
 * }); // Passes
 *
 * AssertKeycloakConfig({
 *   authServerUrl: 'https://auth.example.com',
 *   realm: 'myrealm',
 *   clientId: 'my-service',
 *   validationMode: 'online'
 *   // Missing clientSecret — throws ZodError
 * });
 * ```
 */
export declare function AssertKeycloakConfig(config: unknown): asserts config is TKeycloakConfig;
/**
 * Validates that config conforms to the Keycloak configuration schema.
 *
 * @param config - The configuration object to validate
 * @returns `true` if config is valid, `false` otherwise
 *
 * @example
 * ```ts
 * const isValid = ValidateKeycloakConfig({
 *   authServerUrl: 'https://auth.example.com',
 *   realm: 'myrealm',
 *   clientId: 'my-service',
 *   clientSecret: 'secret',
 *   validationMode: 'online'
 * });
 * console.log(isValid); // true
 *
 * const isInvalid = ValidateKeycloakConfig({
 *   authServerUrl: 'invalid-url'
 * });
 * console.log(isInvalid); // false (no exception thrown)
 * ```
 */
export declare function ValidateKeycloakConfig(config: unknown): boolean;
//# sourceMappingURL=keycloak.config.d.ts.map