/**
 * Environment-based configuration for Sophos Central MCP Server.
 * Credentials are read from environment variables only.
 */
export interface SophosConfig {
    clientId: string;
    clientSecret: string;
    tenantId?: string;
    port: number;
    transport: "http" | "stdio";
    /** Address the HTTP transport binds to. 127.0.0.1 unless MCP_HTTP_HOST says otherwise. */
    httpHost: string;
    /** When set, every /mcp request must send it as a bearer token. */
    httpToken?: string;
    /** Browser origins allowed besides loopback ones, from MCP_ALLOWED_ORIGINS. */
    allowedOrigins: string[];
}
export declare function loadConfig(): SophosConfig;
/**
 * MCP_ALLOWED_ORIGINS is a comma separated list of browser origins, such as
 * "https://inspector.example.com,http://10.0.0.5:6274". Each entry is reduced
 * to its origin (scheme, host and port) so it compares equal to the Origin
 * header a browser sends.
 */
export declare function parseAllowedOrigins(value: string | undefined): string[];
export declare const SOPHOS_AUTH_URL = "https://id.sophos.com/api/v2/oauth2/token";
export declare const SOPHOS_GLOBAL_API = "https://api.central.sophos.com";
export declare const SOPHOS_FUSION_GRAPHQL_URL: string;
/**
 * The bearer token is sent to SOPHOS_FUSION_GRAPHQL_URL, and dotenv fills that
 * from a .env in the working directory, which for a stdio server is whatever
 * directory the client was started in (a cloned repo, say). So the override
 * must be an https URL on a sophos.com host, or the server refuses to start.
 */
export declare function checkFusionGraphQLUrl(value: string): string;
export declare const CHARACTER_LIMIT: number;
export declare const DEFAULT_PAGE_SIZE = 50;
export declare const MAX_PAGE_SIZE = 100;
export declare const MAX_TOOL_INPUT_ELEMENTS = 1000000;
export declare const CLASSIC_MIGRATION_CHECK: boolean;
//# sourceMappingURL=config.d.ts.map