import { z } from "zod";
/**
 * How SSH-backed tools reach the node that actually hosts a guest.
 *
 * `pct exec` is a node-local command, so in a cluster the MCP must first work
 * out which node holds the container and then reach that node.
 *
 * - `auto`     resolve the node, try it directly, and fall back to hopping
 *              through the entry host. Correct for both clusters and
 *              standalone installs; this is the default so nobody has to know.
 * - `direct`   always connect straight to the resolved node.
 * - `hop`      always go through the entry host (`ssh entry ssh node ...`),
 *              for setups where only one node is reachable from outside.
 * - `disabled` never use SSH; only REST tools work.
 */
export declare const sshStrategyValues: readonly ["auto", "direct", "hop", "disabled"];
export declare const runtimeConfigSchema: z.ZodObject<{
    proxmoxHost: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>;
    proxmoxPort: z.ZodNumber;
    proxmoxUser: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>;
    proxmoxRealm: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>;
    tokenName: z.ZodEffects<z.ZodString, string, string>;
    tokenSecret: z.ZodEffects<z.ZodString, string, string>;
    allowInsecureTls: z.ZodDefault<z.ZodBoolean>;
    sshHost: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>;
    sshPort: z.ZodDefault<z.ZodNumber>;
    sshUser: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>;
    sshKeyPath: z.ZodEffects<z.ZodString, string, string>;
    sshStrategy: z.ZodDefault<z.ZodEnum<["auto", "direct", "hop", "disabled"]>>;
    /**
     * Which Proxmox node `sshHost` actually is. Lets the router skip all routing
     * when a guest already lives on the node we connect to. `setup` fills this in
     * by asking the node its own hostname, so nobody has to know it.
     */
    sshNodeName: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>>;
    /**
     * Per-node connection overrides, keyed by Proxmox node name. Only needed when
     * a node's address cannot be discovered or differs from what the cluster
     * reports (for example a NAT or VPN address).
     */
    sshNodes: z.ZodOptional<z.ZodRecord<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>, z.ZodObject<{
        host: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>;
        port: z.ZodOptional<z.ZodNumber>;
        user: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>>;
    }, "strip", z.ZodTypeAny, {
        host: string;
        user?: string | undefined;
        port?: number | undefined;
    }, {
        host: string;
        user?: string | undefined;
        port?: number | undefined;
    }>>>;
}, "strip", z.ZodTypeAny, {
    tokenSecret: string;
    proxmoxHost: string;
    proxmoxPort: number;
    proxmoxUser: string;
    proxmoxRealm: string;
    tokenName: string;
    allowInsecureTls: boolean;
    sshHost: string;
    sshPort: number;
    sshUser: string;
    sshKeyPath: string;
    sshStrategy: "auto" | "direct" | "hop" | "disabled";
    sshNodeName?: string | undefined;
    sshNodes?: Record<string, {
        host: string;
        user?: string | undefined;
        port?: number | undefined;
    }> | undefined;
}, {
    tokenSecret: string;
    proxmoxHost: string;
    proxmoxPort: number;
    proxmoxUser: string;
    proxmoxRealm: string;
    tokenName: string;
    sshHost: string;
    sshUser: string;
    sshKeyPath: string;
    allowInsecureTls?: boolean | undefined;
    sshPort?: number | undefined;
    sshStrategy?: "auto" | "direct" | "hop" | "disabled" | undefined;
    sshNodeName?: string | undefined;
    sshNodes?: Record<string, {
        host: string;
        user?: string | undefined;
        port?: number | undefined;
    }> | undefined;
}>;
export type RuntimeConfig = z.infer<typeof runtimeConfigSchema>;
export type SshStrategy = (typeof sshStrategyValues)[number];
//# sourceMappingURL=validate.d.ts.map