@graphorin/server 0.5.0

package/dist/config.d.ts

@@ -0,0 +1,760 @@
+import { z } from "zod";
+
+//#region src/config.d.ts
+
+/**
+ * String literal that flags a value as a `SecretRef` URI. The
+ * server's pre-bind step resolves every `*Ref` field through the
+ * `@graphorin/security` resolver registry before binding the
+ * listener; an unresolvable ref fails fast with
+ * {@link import('./errors/index.js').PrebindSecretUnresolvableError}.
+ *
+ * @stable
+ */
+type SecretRefString = string;
+/**
+ * Selector for which `SecretsStore` flavour the server activates.
+ * Mirrors `--secrets-source` from DEC-136.
+ *
+ * @stable
+ */
+type SecretsSource = 'auto' | 'keyring' | 'encrypted-file' | 'env';
+/** @stable */
+type IdempotencyRequireKeyMode = 'off' | 'warn' | 'enforce';
+/** @stable */
+type DeliveryCommentaryPolicyConfig = 'wrap' | 'strip' | 'pass-through';
+/** @stable */
+interface ServerConfigSpec {
+  readonly server: {
+    readonly host: string;
+    readonly port: number;
+    readonly basePath: string;
+    readonly cors: {
+      readonly allowOrigins: ReadonlyArray<string>;
+      readonly allowCredentials: boolean;
+      readonly allowMethods: ReadonlyArray<string>;
+      readonly allowHeaders: ReadonlyArray<string>;
+      readonly maxAgeSeconds: number;
+    };
+    readonly csrf: {
+      readonly enabled: boolean;
+      readonly cookieName: string;
+      readonly headerName: string;
+      readonly safeMethods: ReadonlyArray<string>;
+    };
+    readonly rateLimit: {
+      readonly enabled: boolean;
+      readonly windowMs: number;
+      readonly perIpRequests: number;
+    };
+    readonly idempotency: {
+      readonly enabled: boolean;
+      readonly requireKey: IdempotencyRequireKeyMode;
+      readonly ttlSeconds: number;
+      readonly checkBodyFingerprint: boolean;
+      readonly lruCacheSize: number;
+    };
+    readonly shutdown: {
+      readonly drainTimeoutMs: number;
+    };
+    readonly trustProxy: boolean;
+    readonly stream: {
+      readonly disconnectPolicy: 'continue' | 'pause-on-disconnect' | 'abort-on-disconnect';
+      readonly disconnectGracePeriodMs: number;
+      readonly replayBuffer: {
+        readonly maxEvents: number;
+        readonly ttlSeconds: number;
+      };
+      readonly perConnectionQueueLimit: number;
+    };
+    readonly ws: {
+      readonly enabled: boolean;
+      readonly path: string;
+      readonly ticketTtlMs: number;
+      readonly commentarySanitization: {
+        readonly policy: DeliveryCommentaryPolicyConfig;
+        readonly applyToEvents: ReadonlyArray<string>;
+      };
+    };
+    readonly sse: {
+      readonly enabled: boolean;
+      readonly path: string;
+      readonly keepAliveMs: number;
+    };
+  };
+  readonly storage: {
+    readonly path: string;
+    readonly mode: 'lib' | 'server';
+    readonly walCheckpointIntervalMs?: number;
+    readonly encryption: {
+      readonly enabled: boolean;
+      readonly cipher?: string;
+      readonly passphraseRef?: SecretRefString;
+    };
+  };
+  readonly audit: {
+    readonly enabled: boolean;
+    readonly path?: string;
+    readonly passphraseRef?: SecretRefString;
+    readonly cipher?: string;
+  };
+  readonly secrets: {
+    readonly source: SecretsSource;
+    readonly strict: boolean;
+  };
+  readonly auth: {
+    readonly kind: 'token' | 'none';
+    readonly pepperRef?: SecretRefString;
+    readonly tokenPrefix: string;
+    readonly tokenEnvironments: ReadonlyArray<string>;
+    readonly perIpFailureThreshold?: number;
+    readonly perIpLockoutMs?: number;
+  };
+  readonly observability: {
+    readonly logger: 'json' | 'pretty' | 'silent';
+  };
+  readonly hardening: {
+    readonly applyOnStart: boolean;
+    readonly refuseRoot: boolean;
+    readonly umask: number;
+  };
+  readonly metrics: {
+    readonly enabled: boolean;
+    readonly path: string;
+    readonly requireAuth: boolean;
+  };
+  readonly health: {
+    readonly walWarnThresholdBytes: number;
+  };
+}
+/**
+ * Zod schema for the resolved {@link ServerConfigSpec}. Exposed for
+ * advanced users that want to validate other config sources (env-only
+ * launch, CLI overrides, etc.).
+ *
+ * @stable
+ */
+declare const ServerConfigSchema: z.ZodDefault<z.ZodObject<{
+  server: z.ZodDefault<z.ZodObject<{
+    host: z.ZodDefault<z.ZodString>;
+    port: z.ZodDefault<z.ZodNumber>;
+    basePath: z.ZodDefault<z.ZodString>;
+    cors: z.ZodDefault<z.ZodObject<{
+      allowOrigins: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+      allowCredentials: z.ZodDefault<z.ZodBoolean>;
+      allowMethods: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+      allowHeaders: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+      maxAgeSeconds: z.ZodDefault<z.ZodNumber>;
+    }, "strict", z.ZodTypeAny, {
+      allowOrigins: string[];
+      allowCredentials: boolean;
+      allowMethods: string[];
+      allowHeaders: string[];
+      maxAgeSeconds: number;
+    }, {
+      allowOrigins?: string[] | undefined;
+      allowCredentials?: boolean | undefined;
+      allowMethods?: string[] | undefined;
+      allowHeaders?: string[] | undefined;
+      maxAgeSeconds?: number | undefined;
+    }>>;
+    csrf: z.ZodDefault<z.ZodObject<{
+      enabled: z.ZodDefault<z.ZodBoolean>;
+      cookieName: z.ZodDefault<z.ZodString>;
+      headerName: z.ZodDefault<z.ZodString>;
+      safeMethods: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    }, "strict", z.ZodTypeAny, {
+      enabled: boolean;
+      cookieName: string;
+      headerName: string;
+      safeMethods: string[];
+    }, {
+      enabled?: boolean | undefined;
+      cookieName?: string | undefined;
+      headerName?: string | undefined;
+      safeMethods?: string[] | undefined;
+    }>>;
+    rateLimit: z.ZodDefault<z.ZodObject<{
+      enabled: z.ZodDefault<z.ZodBoolean>;
+      windowMs: z.ZodDefault<z.ZodNumber>;
+      perIpRequests: z.ZodDefault<z.ZodNumber>;
+    }, "strict", z.ZodTypeAny, {
+      enabled: boolean;
+      windowMs: number;
+      perIpRequests: number;
+    }, {
+      enabled?: boolean | undefined;
+      windowMs?: number | undefined;
+      perIpRequests?: number | undefined;
+    }>>;
+    idempotency: z.ZodDefault<z.ZodObject<{
+      enabled: z.ZodDefault<z.ZodBoolean>;
+      requireKey: z.ZodDefault<z.ZodEnum<["off", "warn", "enforce"]>>;
+      ttlSeconds: z.ZodDefault<z.ZodNumber>;
+      checkBodyFingerprint: z.ZodDefault<z.ZodBoolean>;
+      lruCacheSize: z.ZodDefault<z.ZodNumber>;
+    }, "strict", z.ZodTypeAny, {
+      enabled: boolean;
+      requireKey: "off" | "warn" | "enforce";
+      ttlSeconds: number;
+      checkBodyFingerprint: boolean;
+      lruCacheSize: number;
+    }, {
+      enabled?: boolean | undefined;
+      requireKey?: "off" | "warn" | "enforce" | undefined;
+      ttlSeconds?: number | undefined;
+      checkBodyFingerprint?: boolean | undefined;
+      lruCacheSize?: number | undefined;
+    }>>;
+    shutdown: z.ZodDefault<z.ZodObject<{
+      drainTimeoutMs: z.ZodDefault<z.ZodNumber>;
+    }, "strict", z.ZodTypeAny, {
+      drainTimeoutMs: number;
+    }, {
+      drainTimeoutMs?: number | undefined;
+    }>>;
+    trustProxy: z.ZodDefault<z.ZodBoolean>;
+    stream: z.ZodDefault<z.ZodObject<{
+      disconnectPolicy: z.ZodDefault<z.ZodEnum<["continue", "pause-on-disconnect", "abort-on-disconnect"]>>;
+      disconnectGracePeriodMs: z.ZodDefault<z.ZodNumber>;
+      replayBuffer: z.ZodDefault<z.ZodObject<{
+        maxEvents: z.ZodDefault<z.ZodNumber>;
+        ttlSeconds: z.ZodDefault<z.ZodNumber>;
+      }, "strict", z.ZodTypeAny, {
+        ttlSeconds: number;
+        maxEvents: number;
+      }, {
+        ttlSeconds?: number | undefined;
+        maxEvents?: number | undefined;
+      }>>;
+      perConnectionQueueLimit: z.ZodDefault<z.ZodNumber>;
+    }, "strict", z.ZodTypeAny, {
+      disconnectPolicy: "continue" | "pause-on-disconnect" | "abort-on-disconnect";
+      disconnectGracePeriodMs: number;
+      replayBuffer: {
+        ttlSeconds: number;
+        maxEvents: number;
+      };
+      perConnectionQueueLimit: number;
+    }, {
+      disconnectPolicy?: "continue" | "pause-on-disconnect" | "abort-on-disconnect" | undefined;
+      disconnectGracePeriodMs?: number | undefined;
+      replayBuffer?: {
+        ttlSeconds?: number | undefined;
+        maxEvents?: number | undefined;
+      } | undefined;
+      perConnectionQueueLimit?: number | undefined;
+    }>>;
+    ws: z.ZodDefault<z.ZodObject<{
+      enabled: z.ZodDefault<z.ZodBoolean>;
+      path: z.ZodDefault<z.ZodString>;
+      ticketTtlMs: z.ZodDefault<z.ZodNumber>;
+      commentarySanitization: z.ZodDefault<z.ZodObject<{
+        policy: z.ZodDefault<z.ZodEnum<["wrap", "strip", "pass-through"]>>;
+        applyToEvents: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+      }, "strict", z.ZodTypeAny, {
+        policy: "strip" | "wrap" | "pass-through";
+        applyToEvents: string[];
+      }, {
+        policy?: "strip" | "wrap" | "pass-through" | undefined;
+        applyToEvents?: string[] | undefined;
+      }>>;
+    }, "strict", z.ZodTypeAny, {
+      path: string;
+      enabled: boolean;
+      ticketTtlMs: number;
+      commentarySanitization: {
+        policy: "strip" | "wrap" | "pass-through";
+        applyToEvents: string[];
+      };
+    }, {
+      path?: string | undefined;
+      enabled?: boolean | undefined;
+      ticketTtlMs?: number | undefined;
+      commentarySanitization?: {
+        policy?: "strip" | "wrap" | "pass-through" | undefined;
+        applyToEvents?: string[] | undefined;
+      } | undefined;
+    }>>;
+    sse: z.ZodDefault<z.ZodObject<{
+      enabled: z.ZodDefault<z.ZodBoolean>;
+      path: z.ZodDefault<z.ZodString>;
+      keepAliveMs: z.ZodDefault<z.ZodNumber>;
+    }, "strict", z.ZodTypeAny, {
+      path: string;
+      enabled: boolean;
+      keepAliveMs: number;
+    }, {
+      path?: string | undefined;
+      enabled?: boolean | undefined;
+      keepAliveMs?: number | undefined;
+    }>>;
+  }, "strict", z.ZodTypeAny, {
+    host: string;
+    port: number;
+    basePath: string;
+    cors: {
+      allowOrigins: string[];
+      allowCredentials: boolean;
+      allowMethods: string[];
+      allowHeaders: string[];
+      maxAgeSeconds: number;
+    };
+    csrf: {
+      enabled: boolean;
+      cookieName: string;
+      headerName: string;
+      safeMethods: string[];
+    };
+    rateLimit: {
+      enabled: boolean;
+      windowMs: number;
+      perIpRequests: number;
+    };
+    idempotency: {
+      enabled: boolean;
+      requireKey: "off" | "warn" | "enforce";
+      ttlSeconds: number;
+      checkBodyFingerprint: boolean;
+      lruCacheSize: number;
+    };
+    shutdown: {
+      drainTimeoutMs: number;
+    };
+    trustProxy: boolean;
+    stream: {
+      disconnectPolicy: "continue" | "pause-on-disconnect" | "abort-on-disconnect";
+      disconnectGracePeriodMs: number;
+      replayBuffer: {
+        ttlSeconds: number;
+        maxEvents: number;
+      };
+      perConnectionQueueLimit: number;
+    };
+    ws: {
+      path: string;
+      enabled: boolean;
+      ticketTtlMs: number;
+      commentarySanitization: {
+        policy: "strip" | "wrap" | "pass-through";
+        applyToEvents: string[];
+      };
+    };
+    sse: {
+      path: string;
+      enabled: boolean;
+      keepAliveMs: number;
+    };
+  }, {
+    host?: string | undefined;
+    port?: number | undefined;
+    basePath?: string | undefined;
+    cors?: {
+      allowOrigins?: string[] | undefined;
+      allowCredentials?: boolean | undefined;
+      allowMethods?: string[] | undefined;
+      allowHeaders?: string[] | undefined;
+      maxAgeSeconds?: number | undefined;
+    } | undefined;
+    csrf?: {
+      enabled?: boolean | undefined;
+      cookieName?: string | undefined;
+      headerName?: string | undefined;
+      safeMethods?: string[] | undefined;
+    } | undefined;
+    rateLimit?: {
+      enabled?: boolean | undefined;
+      windowMs?: number | undefined;
+      perIpRequests?: number | undefined;
+    } | undefined;
+    idempotency?: {
+      enabled?: boolean | undefined;
+      requireKey?: "off" | "warn" | "enforce" | undefined;
+      ttlSeconds?: number | undefined;
+      checkBodyFingerprint?: boolean | undefined;
+      lruCacheSize?: number | undefined;
+    } | undefined;
+    shutdown?: {
+      drainTimeoutMs?: number | undefined;
+    } | undefined;
+    trustProxy?: boolean | undefined;
+    stream?: {
+      disconnectPolicy?: "continue" | "pause-on-disconnect" | "abort-on-disconnect" | undefined;
+      disconnectGracePeriodMs?: number | undefined;
+      replayBuffer?: {
+        ttlSeconds?: number | undefined;
+        maxEvents?: number | undefined;
+      } | undefined;
+      perConnectionQueueLimit?: number | undefined;
+    } | undefined;
+    ws?: {
+      path?: string | undefined;
+      enabled?: boolean | undefined;
+      ticketTtlMs?: number | undefined;
+      commentarySanitization?: {
+        policy?: "strip" | "wrap" | "pass-through" | undefined;
+        applyToEvents?: string[] | undefined;
+      } | undefined;
+    } | undefined;
+    sse?: {
+      path?: string | undefined;
+      enabled?: boolean | undefined;
+      keepAliveMs?: number | undefined;
+    } | undefined;
+  }>>;
+  storage: z.ZodDefault<z.ZodObject<{
+    path: z.ZodDefault<z.ZodString>;
+    mode: z.ZodDefault<z.ZodEnum<["lib", "server"]>>;
+    walCheckpointIntervalMs: z.ZodOptional<z.ZodNumber>;
+    encryption: z.ZodDefault<z.ZodObject<{
+      enabled: z.ZodDefault<z.ZodBoolean>;
+      cipher: z.ZodOptional<z.ZodString>;
+      passphraseRef: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+      enabled: boolean;
+      cipher?: string | undefined;
+      passphraseRef?: string | undefined;
+    }, {
+      enabled?: boolean | undefined;
+      cipher?: string | undefined;
+      passphraseRef?: string | undefined;
+    }>>;
+  }, "strict", z.ZodTypeAny, {
+    path: string;
+    mode: "server" | "lib";
+    encryption: {
+      enabled: boolean;
+      cipher?: string | undefined;
+      passphraseRef?: string | undefined;
+    };
+    walCheckpointIntervalMs?: number | undefined;
+  }, {
+    path?: string | undefined;
+    mode?: "server" | "lib" | undefined;
+    walCheckpointIntervalMs?: number | undefined;
+    encryption?: {
+      enabled?: boolean | undefined;
+      cipher?: string | undefined;
+      passphraseRef?: string | undefined;
+    } | undefined;
+  }>>;
+  audit: z.ZodDefault<z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    path: z.ZodOptional<z.ZodString>;
+    passphraseRef: z.ZodOptional<z.ZodString>;
+    cipher: z.ZodOptional<z.ZodString>;
+  }, "strict", z.ZodTypeAny, {
+    enabled: boolean;
+    path?: string | undefined;
+    cipher?: string | undefined;
+    passphraseRef?: string | undefined;
+  }, {
+    path?: string | undefined;
+    enabled?: boolean | undefined;
+    cipher?: string | undefined;
+    passphraseRef?: string | undefined;
+  }>>;
+  secrets: z.ZodDefault<z.ZodObject<{
+    source: z.ZodDefault<z.ZodEnum<["auto", "keyring", "encrypted-file", "env"]>>;
+    strict: z.ZodDefault<z.ZodBoolean>;
+  }, "strict", z.ZodTypeAny, {
+    strict: boolean;
+    source: "auto" | "keyring" | "encrypted-file" | "env";
+  }, {
+    strict?: boolean | undefined;
+    source?: "auto" | "keyring" | "encrypted-file" | "env" | undefined;
+  }>>;
+  auth: z.ZodDefault<z.ZodObject<{
+    kind: z.ZodDefault<z.ZodEnum<["token", "none"]>>;
+    pepperRef: z.ZodOptional<z.ZodString>;
+    tokenPrefix: z.ZodDefault<z.ZodString>;
+    tokenEnvironments: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    perIpFailureThreshold: z.ZodOptional<z.ZodNumber>;
+    perIpLockoutMs: z.ZodOptional<z.ZodNumber>;
+  }, "strict", z.ZodTypeAny, {
+    kind: "token" | "none";
+    tokenPrefix: string;
+    tokenEnvironments: string[];
+    pepperRef?: string | undefined;
+    perIpFailureThreshold?: number | undefined;
+    perIpLockoutMs?: number | undefined;
+  }, {
+    kind?: "token" | "none" | undefined;
+    pepperRef?: string | undefined;
+    tokenPrefix?: string | undefined;
+    tokenEnvironments?: string[] | undefined;
+    perIpFailureThreshold?: number | undefined;
+    perIpLockoutMs?: number | undefined;
+  }>>;
+  observability: z.ZodDefault<z.ZodObject<{
+    logger: z.ZodDefault<z.ZodEnum<["json", "pretty", "silent"]>>;
+  }, "strict", z.ZodTypeAny, {
+    logger: "json" | "pretty" | "silent";
+  }, {
+    logger?: "json" | "pretty" | "silent" | undefined;
+  }>>;
+  hardening: z.ZodDefault<z.ZodObject<{
+    applyOnStart: z.ZodDefault<z.ZodBoolean>;
+    refuseRoot: z.ZodDefault<z.ZodBoolean>;
+    umask: z.ZodDefault<z.ZodNumber>;
+  }, "strict", z.ZodTypeAny, {
+    applyOnStart: boolean;
+    refuseRoot: boolean;
+    umask: number;
+  }, {
+    applyOnStart?: boolean | undefined;
+    refuseRoot?: boolean | undefined;
+    umask?: number | undefined;
+  }>>;
+  metrics: z.ZodDefault<z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    path: z.ZodDefault<z.ZodString>;
+    requireAuth: z.ZodDefault<z.ZodBoolean>;
+  }, "strict", z.ZodTypeAny, {
+    path: string;
+    enabled: boolean;
+    requireAuth: boolean;
+  }, {
+    path?: string | undefined;
+    enabled?: boolean | undefined;
+    requireAuth?: boolean | undefined;
+  }>>;
+  health: z.ZodDefault<z.ZodObject<{
+    walWarnThresholdBytes: z.ZodDefault<z.ZodNumber>;
+  }, "strict", z.ZodTypeAny, {
+    walWarnThresholdBytes: number;
+  }, {
+    walWarnThresholdBytes?: number | undefined;
+  }>>;
+}, "strict", z.ZodTypeAny, {
+  server: {
+    host: string;
+    port: number;
+    basePath: string;
+    cors: {
+      allowOrigins: string[];
+      allowCredentials: boolean;
+      allowMethods: string[];
+      allowHeaders: string[];
+      maxAgeSeconds: number;
+    };
+    csrf: {
+      enabled: boolean;
+      cookieName: string;
+      headerName: string;
+      safeMethods: string[];
+    };
+    rateLimit: {
+      enabled: boolean;
+      windowMs: number;
+      perIpRequests: number;
+    };
+    idempotency: {
+      enabled: boolean;
+      requireKey: "off" | "warn" | "enforce";
+      ttlSeconds: number;
+      checkBodyFingerprint: boolean;
+      lruCacheSize: number;
+    };
+    shutdown: {
+      drainTimeoutMs: number;
+    };
+    trustProxy: boolean;
+    stream: {
+      disconnectPolicy: "continue" | "pause-on-disconnect" | "abort-on-disconnect";
+      disconnectGracePeriodMs: number;
+      replayBuffer: {
+        ttlSeconds: number;
+        maxEvents: number;
+      };
+      perConnectionQueueLimit: number;
+    };
+    ws: {
+      path: string;
+      enabled: boolean;
+      ticketTtlMs: number;
+      commentarySanitization: {
+        policy: "strip" | "wrap" | "pass-through";
+        applyToEvents: string[];
+      };
+    };
+    sse: {
+      path: string;
+      enabled: boolean;
+      keepAliveMs: number;
+    };
+  };
+  storage: {
+    path: string;
+    mode: "server" | "lib";
+    encryption: {
+      enabled: boolean;
+      cipher?: string | undefined;
+      passphraseRef?: string | undefined;
+    };
+    walCheckpointIntervalMs?: number | undefined;
+  };
+  audit: {
+    enabled: boolean;
+    path?: string | undefined;
+    cipher?: string | undefined;
+    passphraseRef?: string | undefined;
+  };
+  secrets: {
+    strict: boolean;
+    source: "auto" | "keyring" | "encrypted-file" | "env";
+  };
+  auth: {
+    kind: "token" | "none";
+    tokenPrefix: string;
+    tokenEnvironments: string[];
+    pepperRef?: string | undefined;
+    perIpFailureThreshold?: number | undefined;
+    perIpLockoutMs?: number | undefined;
+  };
+  observability: {
+    logger: "json" | "pretty" | "silent";
+  };
+  hardening: {
+    applyOnStart: boolean;
+    refuseRoot: boolean;
+    umask: number;
+  };
+  metrics: {
+    path: string;
+    enabled: boolean;
+    requireAuth: boolean;
+  };
+  health: {
+    walWarnThresholdBytes: number;
+  };
+}, {
+  server?: {
+    host?: string | undefined;
+    port?: number | undefined;
+    basePath?: string | undefined;
+    cors?: {
+      allowOrigins?: string[] | undefined;
+      allowCredentials?: boolean | undefined;
+      allowMethods?: string[] | undefined;
+      allowHeaders?: string[] | undefined;
+      maxAgeSeconds?: number | undefined;
+    } | undefined;
+    csrf?: {
+      enabled?: boolean | undefined;
+      cookieName?: string | undefined;
+      headerName?: string | undefined;
+      safeMethods?: string[] | undefined;
+    } | undefined;
+    rateLimit?: {
+      enabled?: boolean | undefined;
+      windowMs?: number | undefined;
+      perIpRequests?: number | undefined;
+    } | undefined;
+    idempotency?: {
+      enabled?: boolean | undefined;
+      requireKey?: "off" | "warn" | "enforce" | undefined;
+      ttlSeconds?: number | undefined;
+      checkBodyFingerprint?: boolean | undefined;
+      lruCacheSize?: number | undefined;
+    } | undefined;
+    shutdown?: {
+      drainTimeoutMs?: number | undefined;
+    } | undefined;
+    trustProxy?: boolean | undefined;
+    stream?: {
+      disconnectPolicy?: "continue" | "pause-on-disconnect" | "abort-on-disconnect" | undefined;
+      disconnectGracePeriodMs?: number | undefined;
+      replayBuffer?: {
+        ttlSeconds?: number | undefined;
+        maxEvents?: number | undefined;
+      } | undefined;
+      perConnectionQueueLimit?: number | undefined;
+    } | undefined;
+    ws?: {
+      path?: string | undefined;
+      enabled?: boolean | undefined;
+      ticketTtlMs?: number | undefined;
+      commentarySanitization?: {
+        policy?: "strip" | "wrap" | "pass-through" | undefined;
+        applyToEvents?: string[] | undefined;
+      } | undefined;
+    } | undefined;
+    sse?: {
+      path?: string | undefined;
+      enabled?: boolean | undefined;
+      keepAliveMs?: number | undefined;
+    } | undefined;
+  } | undefined;
+  storage?: {
+    path?: string | undefined;
+    mode?: "server" | "lib" | undefined;
+    walCheckpointIntervalMs?: number | undefined;
+    encryption?: {
+      enabled?: boolean | undefined;
+      cipher?: string | undefined;
+      passphraseRef?: string | undefined;
+    } | undefined;
+  } | undefined;
+  audit?: {
+    path?: string | undefined;
+    enabled?: boolean | undefined;
+    cipher?: string | undefined;
+    passphraseRef?: string | undefined;
+  } | undefined;
+  secrets?: {
+    strict?: boolean | undefined;
+    source?: "auto" | "keyring" | "encrypted-file" | "env" | undefined;
+  } | undefined;
+  auth?: {
+    kind?: "token" | "none" | undefined;
+    pepperRef?: string | undefined;
+    tokenPrefix?: string | undefined;
+    tokenEnvironments?: string[] | undefined;
+    perIpFailureThreshold?: number | undefined;
+    perIpLockoutMs?: number | undefined;
+  } | undefined;
+  observability?: {
+    logger?: "json" | "pretty" | "silent" | undefined;
+  } | undefined;
+  hardening?: {
+    applyOnStart?: boolean | undefined;
+    refuseRoot?: boolean | undefined;
+    umask?: number | undefined;
+  } | undefined;
+  metrics?: {
+    path?: string | undefined;
+    enabled?: boolean | undefined;
+    requireAuth?: boolean | undefined;
+  } | undefined;
+  health?: {
+    walWarnThresholdBytes?: number | undefined;
+  } | undefined;
+}>>;
+/**
+ * Input shape accepted by {@link defineConfig}. Every field is
+ * optional; missing values fall back to a documented default.
+ *
+ * @stable
+ */
+type ServerConfigInput = z.input<typeof ServerConfigSchema>;
+/**
+ * Helper for `graphorin.config.ts` files. Pure pass-through that
+ * provides editor autocomplete; the actual parsing happens at server
+ * startup so callers always see the same error path regardless of
+ * which loader (TS / JS / JSON) the operator picked.
+ *
+ * @stable
+ */
+declare function defineConfig(input: ServerConfigInput): ServerConfigInput;
+/**
+ * Parse + validate user input. Returns a strongly-typed
+ * {@link ServerConfigSpec}; throws {@link ConfigInvalidError} on
+ * any invalid field with a flattened issue list.
+ *
+ * @stable
+ */
+declare function parseServerConfig(input: unknown): ServerConfigSpec;
+//#endregion
+export { DeliveryCommentaryPolicyConfig, IdempotencyRequireKeyMode, SecretRefString, SecretsSource, ServerConfigInput, ServerConfigSchema, ServerConfigSpec, defineConfig, parseServerConfig };
+//# sourceMappingURL=config.d.ts.map