/**
 * Phase 9a — connector config schema (WARN-MODE).
 *
 * Registry-driven validator that flags secret-shaped material in a connector
 * config blob (HTTP or stdio). Reuses the connector-leak walker that powers
 * the export sanitizer and import gate (`connectorImportLeaks`) — the two
 * MUST agree so a literal token can't slip through one path while another
 * rejects it.
 *
 * Coverage:
 *   - headers / query / oauth.client_secret / token: secret-named keys MUST
 *     be `$ENV_VAR` placeholders
 *   - stdio env / args: raw token-prefixed values flagged
 *   - URL with embedded credentials anywhere: flagged
 *
 * In 9a the validator only logs; Phase 9b routes writers through it, 9c
 * flips rejection on.
 */
import { z } from 'zod';
import type { SchemaViolation } from './workspace.js';
/**
 * Loose top-level shape — connector configs come in two flavours (http and
 * stdio) and we want both to pass through. Strict shape enforcement is for
 * Phase 9b once we know what the wire-data actually looks like.
 */
export declare const ConnectorConfigSchema: z.ZodObject<{
    name: z.ZodString;
    type: z.ZodOptional<z.ZodEnum<{
        http: "http";
        stdio: "stdio";
    }>>;
    url: z.ZodOptional<z.ZodString>;
    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
    query: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
    args: z.ZodOptional<z.ZodArray<z.ZodString>>;
    oauth: z.ZodOptional<z.ZodObject<{
        client_id: z.ZodOptional<z.ZodString>;
        client_secret: z.ZodOptional<z.ZodString>;
    }, z.core.$loose>>;
    token: z.ZodOptional<z.ZodString>;
}, z.core.$loose>;
/**
 * Walk a single connector config and return structured violations.
 * `connectorImportLeaks` is designed for an array of connectors and returns
 * paths prefixed with `connectors.<i>.…` — we wrap the single config in a
 * one-element array and strip the prefix before returning.
 */
export declare function validateConnectorConfig(input: unknown): SchemaViolation[];
/**
 * Warn-mode entry point: validate + log each violation. Returns the
 * violations so callers can inspect.
 */
export declare function warnOnConnectorConfigViolations(input: unknown): SchemaViolation[];
/**
 * Phase 9c — strict-or-warn entry point used by save sites.
 *
 * When `STUDIOGRAPH_SCHEMA_STRICT` is on (default), throws
 * `SchemaViolationError` on the first non-empty violation list. Otherwise
 * delegates to the warn-mode logger.
 *
 * `ConnectorManager.saveWorkspaceConfig` should call this. Strict mode
 * means a connector with a literal Authorization header (post-strip) is
 * a bug — `stripSecrets` failed to do its job — and we reject loudly
 * instead of silently writing a leak.
 */
export declare function enforceConnectorConfig(input: unknown): SchemaViolation[];
