/**
 * EVO-12 hosted OAuth — runtime config (ported from mcp-wave; decoupled from
 * the Wave env type — takes a plain input object so it is unit-testable).
 *
 * Scope is read-only (`h2a:read`) — the hosted surface exposes only read tools
 * (DEC-116 key custody; see ../readonly-allowlist).
 */
import type { H2AUpstreamOidcConfig } from "./oidc-rp.js";
export declare const H2A_HOSTED_OAUTH_SCOPE = "h2a:read";
export interface H2AHostedOAuthEnv {
    PUBLIC_BASE_URL: string;
    OAUTH_ISSUER_URL: string;
    OAUTH_CONSENT_SECRET?: string;
    OAUTH_ALLOWED_REDIRECT_URIS: string;
    OAUTH_ACCESS_TOKEN_TTL_SECONDS: number;
    OAUTH_REFRESH_TOKEN_TTL_SECONDS: number;
    OAUTH_AUTH_CODE_TTL_SECONDS: number;
    H2A_HOSTED_ENROLLMENT_ENABLED?: string;
    NODE_ENV?: string;
    H2A_BROKER_MODE?: string;
    H2A_UPSTREAM_ISSUER?: string;
    H2A_UPSTREAM_AUTHORIZE_URL?: string;
    H2A_UPSTREAM_TOKEN_URL?: string;
    H2A_UPSTREAM_CLIENT_ID?: string;
    H2A_UPSTREAM_CLIENT_SECRET?: string;
    H2A_UPSTREAM_REDIRECT_URI?: string;
    H2A_UPSTREAM_SCOPES?: string;
}
export interface H2AHostedOAuthConfig {
    issuerUrl: URL;
    publicBaseUrl: URL;
    resourceServerUrl: URL;
    resourceMetadataUrl: string;
    consentSecret: string;
    enrollmentEnabled: boolean;
    allowedRedirectUris: readonly string[];
    accessTokenTtlSeconds: number;
    refreshTokenTtlSeconds: number;
    authCodeTtlSeconds: number;
    nodeEnv: string;
    /** EVO-12 P2: broker mode (delegate login to 39-auth). */
    brokerMode: boolean;
    /** The seeded 39-auth RP config — present iff broker mode. */
    upstream?: H2AUpstreamOidcConfig;
}
export declare function parseOAuthCsv(value: string): string[];
export declare function parseHostedEnrollmentEnabled(value: string | undefined): boolean;
export declare function oauthConfigFromEnv(env: H2AHostedOAuthEnv): H2AHostedOAuthConfig;
//# sourceMappingURL=config.d.ts.map