/**
 * VECNA-specific configuration (env vars).
 *
 * DB connection reuses VINES's loader (`src/config.ts`). VECNA-only knobs
 * live here.
 */
import type { DBConfig } from "../config.js";
export interface VecnaConfig {
    host: string;
    port: number;
    authToken: string | null;
    /** ASI06: explicit opt-in to run the Hive without authentication. */
    allowInsecure: boolean;
    dedupWindowMinutes: number;
    db: DBConfig;
}
export interface ClientConfig {
    url: string;
    authToken: string | null;
    timeoutMs: number;
}
export declare function loadVecnaServerConfig(env?: NodeJS.ProcessEnv): VecnaConfig;
/**
 * ASI06 hardening — parse the explicit insecure opt-in. Accepts `1`, `true`,
 * or `yes` (case-insensitive). Anything else (incl. unset) is `false`.
 */
export declare function parseAllowInsecure(env?: NodeJS.ProcessEnv): boolean;
/**
 * ASI06 hardening — auth-by-default. Refuse to start an unauthenticated Hive
 * unless the operator has explicitly opted in. Without a bearer token, any local
 * process that can reach the port (default `127.0.0.1:8765`) can read and
 * `evolve` shared memory fragments that later flow into agent context.
 *
 * Throws with an actionable message when no token is configured and the operator
 * has not set `VECNA_ALLOW_INSECURE`.
 */
export declare function assertServeAuthPosture(cfg: {
    authToken: string | null;
    allowInsecure: boolean;
}): void;
export declare function loadVecnaClientConfig(env?: NodeJS.ProcessEnv): ClientConfig;
//# sourceMappingURL=config.d.ts.map