/**
 * Orchestrator configuration.
 *
 * This is a thin backward-compatible wrapper around the new config resolution
 * chain (config/resolver.ts). It preserves the existing synchronous loadConfig()
 * API so that no other files need changing.
 *
 * The new config system lives in config/ and supports:
 * - YAML config files (config/loader.ts)
 * - Shared DB config store (config/shared-store.ts)
 * - 4-layer resolution: env > YAML > DB > defaults (config/resolver.ts)
 * - KICI_ env var mapping (config/env-overlay.ts)
 *
 * Provider configuration (GitHub Apps, etc.) is managed via the `sources` table
 * and PgSecretStore, not through config. See SourceStore and SourceManager.
 */
import { z } from 'zod';
declare const configSchema: z.ZodObject<{
    mode: z.ZodDefault<z.ZodEnum<{
        platform: "platform";
        hybrid: "hybrid";
        independent: "independent";
    }>>;
    port: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    basePath: z.ZodDefault<z.ZodString>;
    tlsCertPath: z.ZodOptional<z.ZodString>;
    platformUrl: z.ZodOptional<z.ZodString>;
    platformToken: z.ZodOptional<z.ZodString>;
    dashboardUrl: z.ZodOptional<z.ZodString>;
    webhookPublicUrl: z.ZodOptional<z.ZodString>;
    databaseUrl: z.ZodDefault<z.ZodString>;
    lockfileCacheMax: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    lockfileCacheTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    queueMaxDepth: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    queueTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    queueBackpressureThreshold: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    workerConcurrency: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    concurrencyWaitTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    dispatchAckTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    cacheStorageType: z.ZodOptional<z.ZodEnum<{
        s3: "s3";
        filesystem: "filesystem";
    }>>;
    cacheStoragePath: z.ZodOptional<z.ZodString>;
    cacheStorageS3Bucket: z.ZodOptional<z.ZodString>;
    cacheStorageS3Prefix: z.ZodDefault<z.ZodString>;
    cacheStorageS3Region: z.ZodOptional<z.ZodString>;
    cacheStorageS3Endpoint: z.ZodOptional<z.ZodString>;
    cacheStorageS3ExternalEndpoint: z.ZodOptional<z.ZodString>;
    cacheStorageS3UploadEndpoint: z.ZodOptional<z.ZodString>;
    cacheStorageS3ForcePathStyle: z.ZodOptional<z.ZodPipe<z.ZodEnum<{
        true: "true";
        false: "false";
    }>, z.ZodTransform<boolean, "true" | "false">>>;
    cacheStorageFsPath: z.ZodOptional<z.ZodString>;
    cacheStorageFsBaseUrl: z.ZodOptional<z.ZodString>;
    logStorageS3Bucket: z.ZodOptional<z.ZodString>;
    cacheTtlDays: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    cacheBuildTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    cacheMaxTarballBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    userCacheQuotaBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    userCacheTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    webhookPayloadDir: z.ZodOptional<z.ZodString>;
    dataDir: z.ZodOptional<z.ZodString>;
    scalerConfigPath: z.ZodOptional<z.ZodString>;
    scalerConfigDir: z.ZodOptional<z.ZodString>;
    machineLedgerDir: z.ZodOptional<z.ZodString>;
    staleDetectorScanIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    staleDetectorThresholdMultiplier: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    jobHeartbeatIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    secretKey: z.ZodOptional<z.ZodString>;
    secretKeyFile: z.ZodOptional<z.ZodString>;
    secretKeyOld: z.ZodOptional<z.ZodString>;
    secretKeyFileOld: z.ZodOptional<z.ZodString>;
    bootstrapAdminToken: z.ZodOptional<z.ZodString>;
    pgCustomerSecrets: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
        true: "true";
        false: "false";
    }>>, z.ZodTransform<boolean, "true" | "false">>;
    agentAuth: z.ZodDefault<z.ZodEnum<{
        token: "token";
        none: "none";
    }>>;
    agentTokenTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    eventRouterMaxChainDepth: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    eventRouterRateLimitPerWorkflowPerMinute: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    eventRouterEventTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    eventRouterCleanupIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    eventRouterMaxDispatchAttempts: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    eventRouterLeaseDurationMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    eventRouterRetryBaseBackoffMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    eventRouterRetryMaxBackoffMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    eventRouterRetryScanIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    testMode: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<boolean, string>>;
    testEventFailFirstN: z.ZodOptional<z.ZodString>;
    eventLogMaxPayloadBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    logLevel: z.ZodDefault<z.ZodEnum<{
        error: "error";
        debug: "debug";
        info: "info";
        warn: "warn";
    }>>;
    nodeEnv: z.ZodDefault<z.ZodEnum<{
        development: "development";
        production: "production";
        test: "test";
    }>>;
    internalProviderRepoPath: z.ZodOptional<z.ZodString>;
    internalProviderCloneUrl: z.ZodOptional<z.ZodString>;
    autoMigrate: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<boolean, string>>;
    agentMaxReconnectDelayMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
    skipS3SentinelValidation: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<boolean, string>>;
    otelExporterOtlpEndpoint: z.ZodOptional<z.ZodString>;
    clusterName: z.ZodOptional<z.ZodString>;
    cluster: z.ZodPrefault<z.ZodObject<{
        instanceId: z.ZodDefault<z.ZodOptional<z.ZodString>>;
        address: z.ZodOptional<z.ZodString>;
        joinToken: z.ZodOptional<z.ZodString>;
        credentialFile: z.ZodDefault<z.ZodString>;
        autoRotateCredentials: z.ZodDefault<z.ZodBoolean>;
        peers: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string[], string | undefined>>;
        raftElectionTimeoutMinMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
        raftElectionTimeoutMaxMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
        raftHeartbeatMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
        peerHeartbeatIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
        peerMaxReconnectDelayMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
        role: z.ZodDefault<z.ZodEnum<{
            coordinator: "coordinator";
            worker: "worker";
        }>>;
        coordinatorUrl: z.ZodOptional<z.ZodString>;
        coordinatorUrls: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string[], string | undefined>>;
        peerStaleTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
        electionGracePeriodMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
        singleNode: z.ZodPipe<z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>, z.ZodTransform<boolean, string | boolean>>;
        trustedProxies: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<string[], string>>;
    }, z.core.$strip>>;
}, z.core.$strip>;
/**
 * App configuration type. Includes computed instanceId for multi-instance support.
 *
 * Provider configuration (GitHub Apps) is now managed via the sources table
 * and SourceManager, not through config.
 */
export type AppConfig = z.infer<typeof configSchema> & {
    /** Unique identifier for this orchestrator instance, generated at startup */
    instanceId: string;
    /** Object storage settings (populated from legacy env vars or SharedConfig) */
    storage?: {
        type?: 's3' | 'filesystem';
        bucket?: string;
        prefix?: string;
        region?: string;
        endpoint?: string;
        externalEndpoint?: string;
        uploadEndpoint?: string;
        forcePathStyle?: boolean;
        logBucket?: string;
        /** Filesystem backend: absolute base directory for cached blobs. */
        fsBasePath?: string;
        /** Filesystem backend: base URL the agent uses to reach this orchestrator. */
        fsBaseUrl?: string;
        /** Per-org byte quota for the user-facing cache (UserCache). */
        userCacheQuotaBytes?: number;
        /** Per-entry TTL (ms) for the user-facing cache (UserCache). */
        userCacheTtlMs?: number;
    };
};
/**
 * Env-var definition for the orchestrator. Exported so the docs generator and
 * the deploy-stg pre-validator can re-parse without going through process.env.
 *
 * Note: passes the inner `baseSchema` (a ZodObject) so describe() can walk
 * `.shape`, but uses the outer `configSchema` (with .superRefine) as the parser
 * so cross-field rules still fire.
 */
export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
    mode: "platform" | "hybrid" | "independent";
    port: number;
    basePath: string;
    databaseUrl: string;
    lockfileCacheMax: number;
    lockfileCacheTtlMs: number;
    queueMaxDepth: number;
    queueTimeoutMs: number;
    queueBackpressureThreshold: number;
    workerConcurrency: number;
    concurrencyWaitTimeoutMs: number;
    dispatchAckTimeoutMs: number;
    cacheStorageS3Prefix: string;
    cacheTtlDays: number;
    cacheBuildTimeoutMs: number;
    cacheMaxTarballBytes: number;
    userCacheQuotaBytes: number;
    userCacheTtlMs: number;
    staleDetectorScanIntervalMs: number;
    staleDetectorThresholdMultiplier: number;
    jobHeartbeatIntervalMs: number;
    pgCustomerSecrets: boolean;
    agentAuth: "token" | "none";
    agentTokenTtlMs: number;
    eventRouterMaxChainDepth: number;
    eventRouterRateLimitPerWorkflowPerMinute: number;
    eventRouterEventTtlSeconds: number;
    eventRouterCleanupIntervalMs: number;
    eventRouterMaxDispatchAttempts: number;
    eventRouterLeaseDurationMs: number;
    eventRouterRetryBaseBackoffMs: number;
    eventRouterRetryMaxBackoffMs: number;
    eventRouterRetryScanIntervalMs: number;
    testMode: boolean;
    eventLogMaxPayloadBytes: number;
    logLevel: "error" | "debug" | "info" | "warn";
    nodeEnv: "development" | "production" | "test";
    autoMigrate: boolean;
    agentMaxReconnectDelayMs: number;
    skipS3SentinelValidation: boolean;
    cluster: {
        instanceId: string;
        credentialFile: string;
        autoRotateCredentials: boolean;
        peers: string[];
        raftElectionTimeoutMinMs: number;
        raftElectionTimeoutMaxMs: number;
        raftHeartbeatMs: number;
        peerHeartbeatIntervalMs: number;
        peerMaxReconnectDelayMs: number;
        role: "coordinator" | "worker";
        coordinatorUrls: string[];
        peerStaleTimeoutMs: number;
        electionGracePeriodMs: number;
        singleNode: boolean;
        trustedProxies: string[];
        address?: string | undefined;
        joinToken?: string | undefined;
        coordinatorUrl?: string | undefined;
    };
    tlsCertPath?: string | undefined;
    platformUrl?: string | undefined;
    platformToken?: string | undefined;
    dashboardUrl?: string | undefined;
    webhookPublicUrl?: string | undefined;
    cacheStorageType?: "s3" | "filesystem" | undefined;
    cacheStoragePath?: string | undefined;
    cacheStorageS3Bucket?: string | undefined;
    cacheStorageS3Region?: string | undefined;
    cacheStorageS3Endpoint?: string | undefined;
    cacheStorageS3ExternalEndpoint?: string | undefined;
    cacheStorageS3UploadEndpoint?: string | undefined;
    cacheStorageS3ForcePathStyle?: boolean | undefined;
    cacheStorageFsPath?: string | undefined;
    cacheStorageFsBaseUrl?: string | undefined;
    logStorageS3Bucket?: string | undefined;
    webhookPayloadDir?: string | undefined;
    dataDir?: string | undefined;
    scalerConfigPath?: string | undefined;
    scalerConfigDir?: string | undefined;
    machineLedgerDir?: string | undefined;
    secretKey?: string | undefined;
    secretKeyFile?: string | undefined;
    secretKeyOld?: string | undefined;
    secretKeyFileOld?: string | undefined;
    bootstrapAdminToken?: string | undefined;
    testEventFailFirstN?: string | undefined;
    internalProviderRepoPath?: string | undefined;
    internalProviderCloneUrl?: string | undefined;
    otelExporterOtlpEndpoint?: string | undefined;
    clusterName?: string | undefined;
}>;
export declare function loadConfig(): AppConfig;
export {};
//# sourceMappingURL=config.d.ts.map