/** VCS provider configuration for fetching artifacts from git. */
export interface VcsConfig {
    provider: "github" | "gitlab" | "bitbucket";
    repo: string;
    token: string;
    identity: string;
    environment: string;
    ref?: string;
    apiUrl?: string;
}
/** Telemetry configuration resolved from environment. */
export interface TelemetryConfig {
    /** Endpoint URL for telemetry delivery. */
    url: string;
}
/** Resolved agent configuration. */
export interface AgentConfig {
    /** HTTP URL or local file path to the published artifact. Optional when VCS is configured. */
    source?: string;
    /** VCS provider configuration. */
    vcs?: VcsConfig;
    /** Disk cache path for fallback on VCS failure. */
    cachePath?: string;
    /** Port for the HTTP API server. */
    port: number;
    /** Max seconds the agent serves secrets without a successful refresh. */
    cacheTtl: number;
    /** Inline age private key. */
    ageKey?: string;
    /** Path to age key file. */
    ageKeyFile?: string;
    /** Bearer token for API authentication. Auto-generated if not set. */
    token: string;
    /** Unique agent instance ID. Auto-generated if not set. */
    agentId: string;
    /** Telemetry configuration. Present when CLEF_AGENT_TELEMETRY_URL is set. Token is read from packed secrets (CLEF_TELEMETRY_TOKEN key). */
    telemetry?: TelemetryConfig;
    /** Public key for artifact signature verification (base64-encoded DER SPKI). When set, unsigned or invalid artifacts are hard-rejected. */
    verifyKey?: string;
}
/** Errors describing missing or invalid configuration. */
export declare class ConfigError extends Error {
    constructor(message: string);
}
/**
 * Resolve agent configuration from environment variables.
 *
 * | Variable                       | Default        | Description                          |
 * |--------------------------------|----------------|--------------------------------------|
 * | CLEF_AGENT_SOURCE              | —              | HTTP URL or local file path          |
 * | CLEF_AGENT_VCS_PROVIDER        | —              | VCS provider (github/gitlab/bitbucket) |
 * | CLEF_AGENT_VCS_REPO            | —              | VCS repository (owner/repo)          |
 * | CLEF_AGENT_VCS_TOKEN           | —              | VCS authentication token             |
 * | CLEF_AGENT_VCS_IDENTITY        | —              | Packed artifact identity             |
 * | CLEF_AGENT_VCS_ENVIRONMENT     | —              | Packed artifact environment          |
 * | CLEF_AGENT_VCS_REF             | —              | Git ref (branch/tag/sha)             |
 * | CLEF_AGENT_VCS_API_URL         | —              | Custom VCS API base URL              |
 * | CLEF_AGENT_CACHE_PATH          | —              | Disk cache path for fallback         |
 * | CLEF_AGENT_PORT                | 7779           | HTTP API port                        |
 * | CLEF_AGENT_CACHE_TTL           | 300            | Max seconds to serve without refresh |
 * | CLEF_AGENT_AGE_KEY             | —              | Inline age private key               |
 * | CLEF_AGENT_AGE_KEY_FILE        | —              | Path to age key file                 |
 * | CLEF_AGENT_TOKEN               | auto-generated | Bearer token for API auth            |
 * | CLEF_AGENT_ID                  | auto-generated | Unique agent instance ID             |
 * | CLEF_AGENT_TELEMETRY_URL       | —              | Telemetry endpoint URL               |
 * | CLEF_AGENT_VERIFY_KEY          | —              | Public key for artifact signature verification (base64 DER SPKI) |
 */
export declare function resolveConfig(env?: Record<string, string | undefined>): AgentConfig;
//# sourceMappingURL=config.d.ts.map