@viaalink/caddy-api-client 0.0.0-stage → 0.10.0

package/dist/index-Q5Jc47QL.d.ts

@@ -0,0 +1,3025 @@
+import { k as CaddyRoute, A as AuthenticationPortal$1, f as AuthorizationPolicy$1, I as IdentityStore, g as LdapIdentityStore$1, L as LocalIdentityStore$1, O as OAuth2IdentityProvider$1, h as OidcIdentityProvider$1, d as SecurityApp$1, S as SecurityAuthenticatorHandler$1, b as SecurityAuthorizationHandler$1, a as SecurityAuthorizerProvider, e as SecurityConfig$1, c as SecurityHandler } from './types-DIjkvykh.js';
+import { z } from 'zod';
+
+/**
+ * Zod schemas for caddy-security plugin
+ *
+ * Provides runtime validation for caddy-security handler configurations.
+ *
+ * Base types are generated from Go source via tygo + ts-to-zod.
+ * Handler schemas extend these with the `handler` discriminator field
+ * that Caddy adds based on the module namespace.
+ *
+ * @see https://github.com/greenpau/caddy-security
+ * @see src/generated/plugins/caddy-security.ts (generated types)
+ * @see src/generated/plugins/caddy-security.zod.ts (generated schemas)
+ */
+
+/**
+ * Authenticator portal handler schema
+ *
+ * Extends the generated AuthnMiddleware with the handler discriminator.
+ * Module ID: `http.handlers.authenticator`
+ *
+ * @example
+ * ```typescript
+ * const handler = SecurityAuthenticatorHandlerSchema.parse({
+ *   handler: "authenticator",
+ *   portal_name: "myportal",
+ * });
+ * ```
+ */
+declare const SecurityAuthenticatorHandlerSchema: z.ZodObject<{
+    handler: z.ZodLiteral<"authenticator">;
+    portal_name: z.ZodOptional<z.ZodString>;
+    route_matcher: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    handler: "authenticator";
+    route_matcher?: string | undefined;
+    portal_name?: string | undefined;
+}, {
+    handler: "authenticator";
+    route_matcher?: string | undefined;
+    portal_name?: string | undefined;
+}>;
+/**
+ * Authorizer provider schema
+ *
+ * Based on generated AuthzMiddleware (without handler field since it's a provider).
+ * Module ID: `http.authentication.providers.authorizer`
+ *
+ * @example
+ * ```typescript
+ * const provider = SecurityAuthorizerProviderSchema.parse({
+ *   gatekeeper_name: "mygatekeeper",
+ *   route_matcher: "*",
+ * });
+ * ```
+ */
+declare const SecurityAuthorizerProviderSchema: z.ZodObject<{
+    gatekeeper_name: z.ZodOptional<z.ZodString>;
+    route_matcher: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    route_matcher?: string | undefined;
+    gatekeeper_name?: string | undefined;
+}, {
+    route_matcher?: string | undefined;
+    gatekeeper_name?: string | undefined;
+}>;
+/**
+ * Authorization handler schema
+ *
+ * Uses Caddy's built-in `authentication` handler with the `authorizer` provider.
+ * The provider config is based on the generated AuthzMiddleware.
+ *
+ * @example
+ * ```typescript
+ * const handler = SecurityAuthorizationHandlerSchema.parse({
+ *   handler: "authentication",
+ *   providers: {
+ *     authorizer: {
+ *       gatekeeper_name: "mygatekeeper",
+ *     },
+ *   },
+ * });
+ * ```
+ */
+declare const SecurityAuthorizationHandlerSchema: z.ZodObject<{
+    handler: z.ZodLiteral<"authentication">;
+    providers: z.ZodObject<{
+        authorizer: z.ZodObject<{
+            gatekeeper_name: z.ZodOptional<z.ZodString>;
+            route_matcher: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            route_matcher?: string | undefined;
+            gatekeeper_name?: string | undefined;
+        }, {
+            route_matcher?: string | undefined;
+            gatekeeper_name?: string | undefined;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        authorizer: {
+            route_matcher?: string | undefined;
+            gatekeeper_name?: string | undefined;
+        };
+    }, {
+        authorizer: {
+            route_matcher?: string | undefined;
+            gatekeeper_name?: string | undefined;
+        };
+    }>;
+}, "strip", z.ZodTypeAny, {
+    handler: "authentication";
+    providers: {
+        authorizer: {
+            route_matcher?: string | undefined;
+            gatekeeper_name?: string | undefined;
+        };
+    };
+}, {
+    handler: "authentication";
+    providers: {
+        authorizer: {
+            route_matcher?: string | undefined;
+            gatekeeper_name?: string | undefined;
+        };
+    };
+}>;
+/**
+ * Combined security handler schema (discriminated union)
+ *
+ * - `authenticator` - Portal handler that serves login UI
+ * - `authentication` - Caddy's handler with the authorizer provider for token validation
+ */
+declare const SecurityHandlerSchema: z.ZodDiscriminatedUnion<"handler", [z.ZodObject<{
+    handler: z.ZodLiteral<"authenticator">;
+    portal_name: z.ZodOptional<z.ZodString>;
+    route_matcher: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    handler: "authenticator";
+    route_matcher?: string | undefined;
+    portal_name?: string | undefined;
+}, {
+    handler: "authenticator";
+    route_matcher?: string | undefined;
+    portal_name?: string | undefined;
+}>, z.ZodObject<{
+    handler: z.ZodLiteral<"authentication">;
+    providers: z.ZodObject<{
+        authorizer: z.ZodObject<{
+            gatekeeper_name: z.ZodOptional<z.ZodString>;
+            route_matcher: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            route_matcher?: string | undefined;
+            gatekeeper_name?: string | undefined;
+        }, {
+            route_matcher?: string | undefined;
+            gatekeeper_name?: string | undefined;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        authorizer: {
+            route_matcher?: string | undefined;
+            gatekeeper_name?: string | undefined;
+        };
+    }, {
+        authorizer: {
+            route_matcher?: string | undefined;
+            gatekeeper_name?: string | undefined;
+        };
+    }>;
+}, "strip", z.ZodTypeAny, {
+    handler: "authentication";
+    providers: {
+        authorizer: {
+            route_matcher?: string | undefined;
+            gatekeeper_name?: string | undefined;
+        };
+    };
+}, {
+    handler: "authentication";
+    providers: {
+        authorizer: {
+            route_matcher?: string | undefined;
+            gatekeeper_name?: string | undefined;
+        };
+    };
+}>]>;
+/**
+ * Local identity store schema
+ * Uses the authcrunch wrapper structure: name, kind, params
+ */
+declare const LocalIdentityStoreSchema: z.ZodObject<{
+    name: z.ZodString;
+    kind: z.ZodLiteral<"local">;
+    params: z.ZodObject<{
+        realm: z.ZodOptional<z.ZodString>;
+        path: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        realm?: string | undefined;
+    }, {
+        path: string;
+        realm?: string | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    params: {
+        path: string;
+        realm?: string | undefined;
+    };
+    name: string;
+    kind: "local";
+}, {
+    params: {
+        path: string;
+        realm?: string | undefined;
+    };
+    name: string;
+    kind: "local";
+}>;
+/**
+ * LDAP identity store schema
+ * Uses the authcrunch wrapper structure: name, kind, params
+ * Uses passthrough() on params to ensure nested fields like groups are preserved
+ */
+declare const LdapIdentityStoreSchema: z.ZodObject<{
+    name: z.ZodString;
+    kind: z.ZodLiteral<"ldap">;
+    params: z.ZodObject<{
+        realm: z.ZodOptional<z.ZodString>;
+        servers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            address: z.ZodString;
+            port: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            address: string;
+            port?: number | undefined;
+        }, {
+            address: string;
+            port?: number | undefined;
+        }>, "many">>;
+        bind_username: z.ZodOptional<z.ZodString>;
+        bind_password: z.ZodOptional<z.ZodString>;
+        search_base_dn: z.ZodOptional<z.ZodString>;
+        search_user_filter: z.ZodOptional<z.ZodString>;
+        groups: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            dn: z.ZodString;
+            roles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            dn: string;
+            roles?: string[] | undefined;
+        }, {
+            dn: string;
+            roles?: string[] | undefined;
+        }>, "many">>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        realm: z.ZodOptional<z.ZodString>;
+        servers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            address: z.ZodString;
+            port: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            address: string;
+            port?: number | undefined;
+        }, {
+            address: string;
+            port?: number | undefined;
+        }>, "many">>;
+        bind_username: z.ZodOptional<z.ZodString>;
+        bind_password: z.ZodOptional<z.ZodString>;
+        search_base_dn: z.ZodOptional<z.ZodString>;
+        search_user_filter: z.ZodOptional<z.ZodString>;
+        groups: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            dn: z.ZodString;
+            roles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            dn: string;
+            roles?: string[] | undefined;
+        }, {
+            dn: string;
+            roles?: string[] | undefined;
+        }>, "many">>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        realm: z.ZodOptional<z.ZodString>;
+        servers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            address: z.ZodString;
+            port: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            address: string;
+            port?: number | undefined;
+        }, {
+            address: string;
+            port?: number | undefined;
+        }>, "many">>;
+        bind_username: z.ZodOptional<z.ZodString>;
+        bind_password: z.ZodOptional<z.ZodString>;
+        search_base_dn: z.ZodOptional<z.ZodString>;
+        search_user_filter: z.ZodOptional<z.ZodString>;
+        groups: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            dn: z.ZodString;
+            roles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            dn: string;
+            roles?: string[] | undefined;
+        }, {
+            dn: string;
+            roles?: string[] | undefined;
+        }>, "many">>;
+    }, z.ZodTypeAny, "passthrough">>;
+}, "strip", z.ZodTypeAny, {
+    params: {
+        servers?: {
+            address: string;
+            port?: number | undefined;
+        }[] | undefined;
+        realm?: string | undefined;
+        bind_username?: string | undefined;
+        bind_password?: string | undefined;
+        search_base_dn?: string | undefined;
+        search_user_filter?: string | undefined;
+        groups?: {
+            dn: string;
+            roles?: string[] | undefined;
+        }[] | undefined;
+    } & {
+        [k: string]: unknown;
+    };
+    name: string;
+    kind: "ldap";
+}, {
+    params: {
+        servers?: {
+            address: string;
+            port?: number | undefined;
+        }[] | undefined;
+        realm?: string | undefined;
+        bind_username?: string | undefined;
+        bind_password?: string | undefined;
+        search_base_dn?: string | undefined;
+        search_user_filter?: string | undefined;
+        groups?: {
+            dn: string;
+            roles?: string[] | undefined;
+        }[] | undefined;
+    } & {
+        [k: string]: unknown;
+    };
+    name: string;
+    kind: "ldap";
+}>;
+/**
+ * OAuth 2.0 identity provider schema
+ * Uses the authcrunch wrapper structure: name, kind, params
+ */
+declare const OAuth2IdentityProviderSchema: z.ZodObject<{
+    name: z.ZodString;
+    kind: z.ZodLiteral<"oauth">;
+    params: z.ZodObject<{
+        driver: z.ZodOptional<z.ZodString>;
+        realm: z.ZodOptional<z.ZodString>;
+        client_id: z.ZodOptional<z.ZodString>;
+        client_secret: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        authorization_url: z.ZodOptional<z.ZodString>;
+        token_url: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        realm?: string | undefined;
+        driver?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scopes?: string[] | undefined;
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+    }, {
+        realm?: string | undefined;
+        driver?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scopes?: string[] | undefined;
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    params: {
+        realm?: string | undefined;
+        driver?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scopes?: string[] | undefined;
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+    };
+    name: string;
+    kind: "oauth";
+}, {
+    params: {
+        realm?: string | undefined;
+        driver?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scopes?: string[] | undefined;
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+    };
+    name: string;
+    kind: "oauth";
+}>;
+/**
+ * OIDC identity provider schema
+ * Uses the authcrunch wrapper structure: name, kind, params
+ */
+declare const OidcIdentityProviderSchema: z.ZodObject<{
+    name: z.ZodString;
+    kind: z.ZodLiteral<"oauth">;
+    params: z.ZodObject<{
+        driver: z.ZodOptional<z.ZodString>;
+        realm: z.ZodOptional<z.ZodString>;
+        client_id: z.ZodOptional<z.ZodString>;
+        client_secret: z.ZodOptional<z.ZodString>;
+        metadata_url: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        realm?: string | undefined;
+        driver?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scopes?: string[] | undefined;
+        metadata_url?: string | undefined;
+    }, {
+        realm?: string | undefined;
+        driver?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scopes?: string[] | undefined;
+        metadata_url?: string | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    params: {
+        realm?: string | undefined;
+        driver?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scopes?: string[] | undefined;
+        metadata_url?: string | undefined;
+    };
+    name: string;
+    kind: "oauth";
+}, {
+    params: {
+        realm?: string | undefined;
+        driver?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scopes?: string[] | undefined;
+        metadata_url?: string | undefined;
+    };
+    name: string;
+    kind: "oauth";
+}>;
+/**
+ * Identity store union schema
+ */
+declare const IdentityStoreSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+    name: z.ZodString;
+    kind: z.ZodLiteral<"local">;
+    params: z.ZodObject<{
+        realm: z.ZodOptional<z.ZodString>;
+        path: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        realm?: string | undefined;
+    }, {
+        path: string;
+        realm?: string | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    params: {
+        path: string;
+        realm?: string | undefined;
+    };
+    name: string;
+    kind: "local";
+}, {
+    params: {
+        path: string;
+        realm?: string | undefined;
+    };
+    name: string;
+    kind: "local";
+}>, z.ZodObject<{
+    name: z.ZodString;
+    kind: z.ZodLiteral<"ldap">;
+    params: z.ZodObject<{
+        realm: z.ZodOptional<z.ZodString>;
+        servers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            address: z.ZodString;
+            port: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            address: string;
+            port?: number | undefined;
+        }, {
+            address: string;
+            port?: number | undefined;
+        }>, "many">>;
+        bind_username: z.ZodOptional<z.ZodString>;
+        bind_password: z.ZodOptional<z.ZodString>;
+        search_base_dn: z.ZodOptional<z.ZodString>;
+        search_user_filter: z.ZodOptional<z.ZodString>;
+        groups: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            dn: z.ZodString;
+            roles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            dn: string;
+            roles?: string[] | undefined;
+        }, {
+            dn: string;
+            roles?: string[] | undefined;
+        }>, "many">>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        realm: z.ZodOptional<z.ZodString>;
+        servers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            address: z.ZodString;
+            port: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            address: string;
+            port?: number | undefined;
+        }, {
+            address: string;
+            port?: number | undefined;
+        }>, "many">>;
+        bind_username: z.ZodOptional<z.ZodString>;
+        bind_password: z.ZodOptional<z.ZodString>;
+        search_base_dn: z.ZodOptional<z.ZodString>;
+        search_user_filter: z.ZodOptional<z.ZodString>;
+        groups: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            dn: z.ZodString;
+            roles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            dn: string;
+            roles?: string[] | undefined;
+        }, {
+            dn: string;
+            roles?: string[] | undefined;
+        }>, "many">>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        realm: z.ZodOptional<z.ZodString>;
+        servers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            address: z.ZodString;
+            port: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            address: string;
+            port?: number | undefined;
+        }, {
+            address: string;
+            port?: number | undefined;
+        }>, "many">>;
+        bind_username: z.ZodOptional<z.ZodString>;
+        bind_password: z.ZodOptional<z.ZodString>;
+        search_base_dn: z.ZodOptional<z.ZodString>;
+        search_user_filter: z.ZodOptional<z.ZodString>;
+        groups: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            dn: z.ZodString;
+            roles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            dn: string;
+            roles?: string[] | undefined;
+        }, {
+            dn: string;
+            roles?: string[] | undefined;
+        }>, "many">>;
+    }, z.ZodTypeAny, "passthrough">>;
+}, "strip", z.ZodTypeAny, {
+    params: {
+        servers?: {
+            address: string;
+            port?: number | undefined;
+        }[] | undefined;
+        realm?: string | undefined;
+        bind_username?: string | undefined;
+        bind_password?: string | undefined;
+        search_base_dn?: string | undefined;
+        search_user_filter?: string | undefined;
+        groups?: {
+            dn: string;
+            roles?: string[] | undefined;
+        }[] | undefined;
+    } & {
+        [k: string]: unknown;
+    };
+    name: string;
+    kind: "ldap";
+}, {
+    params: {
+        servers?: {
+            address: string;
+            port?: number | undefined;
+        }[] | undefined;
+        realm?: string | undefined;
+        bind_username?: string | undefined;
+        bind_password?: string | undefined;
+        search_base_dn?: string | undefined;
+        search_user_filter?: string | undefined;
+        groups?: {
+            dn: string;
+            roles?: string[] | undefined;
+        }[] | undefined;
+    } & {
+        [k: string]: unknown;
+    };
+    name: string;
+    kind: "ldap";
+}>]>;
+/**
+ * Authentication portal schema
+ * @see https://pkg.go.dev/github.com/greenpau/go-authcrunch/pkg/authn#PortalConfig
+ */
+declare const AuthenticationPortalSchema: z.ZodObject<{
+    name: z.ZodString;
+    ui: z.ZodOptional<z.ZodObject<{
+        theme: z.ZodOptional<z.ZodString>;
+        logo_url: z.ZodOptional<z.ZodString>;
+        custom_css: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        theme?: string | undefined;
+        logo_url?: string | undefined;
+        custom_css?: string | undefined;
+    }, {
+        theme?: string | undefined;
+        logo_url?: string | undefined;
+        custom_css?: string | undefined;
+    }>>;
+    cookie_config: z.ZodOptional<z.ZodObject<{
+        domains: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            lifetime: z.ZodOptional<z.ZodNumber>;
+            insecure: z.ZodOptional<z.ZodBoolean>;
+            same_site: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            lifetime?: number | undefined;
+            insecure?: boolean | undefined;
+            same_site?: string | undefined;
+        }, {
+            lifetime?: number | undefined;
+            insecure?: boolean | undefined;
+            same_site?: string | undefined;
+        }>>>;
+        path: z.ZodOptional<z.ZodString>;
+        lifetime: z.ZodOptional<z.ZodNumber>;
+        insecure: z.ZodOptional<z.ZodBoolean>;
+        same_site: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path?: string | undefined;
+        domains?: Record<string, {
+            lifetime?: number | undefined;
+            insecure?: boolean | undefined;
+            same_site?: string | undefined;
+        }> | undefined;
+        lifetime?: number | undefined;
+        insecure?: boolean | undefined;
+        same_site?: string | undefined;
+    }, {
+        path?: string | undefined;
+        domains?: Record<string, {
+            lifetime?: number | undefined;
+            insecure?: boolean | undefined;
+            same_site?: string | undefined;
+        }> | undefined;
+        lifetime?: number | undefined;
+        insecure?: boolean | undefined;
+        same_site?: string | undefined;
+    }>>;
+    identity_stores: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    identity_providers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    user_transformer_configs: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    ui?: {
+        theme?: string | undefined;
+        logo_url?: string | undefined;
+        custom_css?: string | undefined;
+    } | undefined;
+    cookie_config?: {
+        path?: string | undefined;
+        domains?: Record<string, {
+            lifetime?: number | undefined;
+            insecure?: boolean | undefined;
+            same_site?: string | undefined;
+        }> | undefined;
+        lifetime?: number | undefined;
+        insecure?: boolean | undefined;
+        same_site?: string | undefined;
+    } | undefined;
+    identity_stores?: string[] | undefined;
+    identity_providers?: string[] | undefined;
+    user_transformer_configs?: Record<string, unknown>[] | undefined;
+}, {
+    name: string;
+    ui?: {
+        theme?: string | undefined;
+        logo_url?: string | undefined;
+        custom_css?: string | undefined;
+    } | undefined;
+    cookie_config?: {
+        path?: string | undefined;
+        domains?: Record<string, {
+            lifetime?: number | undefined;
+            insecure?: boolean | undefined;
+            same_site?: string | undefined;
+        }> | undefined;
+        lifetime?: number | undefined;
+        insecure?: boolean | undefined;
+        same_site?: string | undefined;
+    } | undefined;
+    identity_stores?: string[] | undefined;
+    identity_providers?: string[] | undefined;
+    user_transformer_configs?: Record<string, unknown>[] | undefined;
+}>;
+/**
+ * Authorization policy (gatekeeper) schema
+ * @see https://pkg.go.dev/github.com/greenpau/go-authcrunch/pkg/authz#PolicyConfig
+ */
+declare const AuthorizationPolicySchema: z.ZodObject<{
+    name: z.ZodString;
+    access_list_rules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        comment: z.ZodOptional<z.ZodString>;
+        conditions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        action: z.ZodOptional<z.ZodEnum<["allow", "deny"]>>;
+    }, "strip", z.ZodTypeAny, {
+        comment?: string | undefined;
+        conditions?: string[] | undefined;
+        action?: "allow" | "deny" | undefined;
+    }, {
+        comment?: string | undefined;
+        conditions?: string[] | undefined;
+        action?: "allow" | "deny" | undefined;
+    }>, "many">>;
+    crypto_key_configs: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        token_name: z.ZodOptional<z.ZodString>;
+        source: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        source?: string | undefined;
+        token_name?: string | undefined;
+    }, {
+        source?: string | undefined;
+        token_name?: string | undefined;
+    }>, "many">>;
+    bypass_configs: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        match_type: z.ZodString;
+        uri: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        match_type: string;
+        uri?: string | undefined;
+    }, {
+        match_type: string;
+        uri?: string | undefined;
+    }>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    access_list_rules?: {
+        comment?: string | undefined;
+        conditions?: string[] | undefined;
+        action?: "allow" | "deny" | undefined;
+    }[] | undefined;
+    crypto_key_configs?: {
+        source?: string | undefined;
+        token_name?: string | undefined;
+    }[] | undefined;
+    bypass_configs?: {
+        match_type: string;
+        uri?: string | undefined;
+    }[] | undefined;
+}, {
+    name: string;
+    access_list_rules?: {
+        comment?: string | undefined;
+        conditions?: string[] | undefined;
+        action?: "allow" | "deny" | undefined;
+    }[] | undefined;
+    crypto_key_configs?: {
+        source?: string | undefined;
+        token_name?: string | undefined;
+    }[] | undefined;
+    bypass_configs?: {
+        match_type: string;
+        uri?: string | undefined;
+    }[] | undefined;
+}>;
+/**
+ * Security configuration schema
+ *
+ * Validates the config object at `/config/apps/security/config`
+ */
+declare const SecurityConfigSchema: z.ZodObject<{
+    authentication_portals: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        ui: z.ZodOptional<z.ZodObject<{
+            theme: z.ZodOptional<z.ZodString>;
+            logo_url: z.ZodOptional<z.ZodString>;
+            custom_css: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            theme?: string | undefined;
+            logo_url?: string | undefined;
+            custom_css?: string | undefined;
+        }, {
+            theme?: string | undefined;
+            logo_url?: string | undefined;
+            custom_css?: string | undefined;
+        }>>;
+        cookie_config: z.ZodOptional<z.ZodObject<{
+            domains: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                lifetime: z.ZodOptional<z.ZodNumber>;
+                insecure: z.ZodOptional<z.ZodBoolean>;
+                same_site: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                lifetime?: number | undefined;
+                insecure?: boolean | undefined;
+                same_site?: string | undefined;
+            }, {
+                lifetime?: number | undefined;
+                insecure?: boolean | undefined;
+                same_site?: string | undefined;
+            }>>>;
+            path: z.ZodOptional<z.ZodString>;
+            lifetime: z.ZodOptional<z.ZodNumber>;
+            insecure: z.ZodOptional<z.ZodBoolean>;
+            same_site: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            path?: string | undefined;
+            domains?: Record<string, {
+                lifetime?: number | undefined;
+                insecure?: boolean | undefined;
+                same_site?: string | undefined;
+            }> | undefined;
+            lifetime?: number | undefined;
+            insecure?: boolean | undefined;
+            same_site?: string | undefined;
+        }, {
+            path?: string | undefined;
+            domains?: Record<string, {
+                lifetime?: number | undefined;
+                insecure?: boolean | undefined;
+                same_site?: string | undefined;
+            }> | undefined;
+            lifetime?: number | undefined;
+            insecure?: boolean | undefined;
+            same_site?: string | undefined;
+        }>>;
+        identity_stores: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        identity_providers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        user_transformer_configs: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        name: string;
+        ui?: {
+            theme?: string | undefined;
+            logo_url?: string | undefined;
+            custom_css?: string | undefined;
+        } | undefined;
+        cookie_config?: {
+            path?: string | undefined;
+            domains?: Record<string, {
+                lifetime?: number | undefined;
+                insecure?: boolean | undefined;
+                same_site?: string | undefined;
+            }> | undefined;
+            lifetime?: number | undefined;
+            insecure?: boolean | undefined;
+            same_site?: string | undefined;
+        } | undefined;
+        identity_stores?: string[] | undefined;
+        identity_providers?: string[] | undefined;
+        user_transformer_configs?: Record<string, unknown>[] | undefined;
+    }, {
+        name: string;
+        ui?: {
+            theme?: string | undefined;
+            logo_url?: string | undefined;
+            custom_css?: string | undefined;
+        } | undefined;
+        cookie_config?: {
+            path?: string | undefined;
+            domains?: Record<string, {
+                lifetime?: number | undefined;
+                insecure?: boolean | undefined;
+                same_site?: string | undefined;
+            }> | undefined;
+            lifetime?: number | undefined;
+            insecure?: boolean | undefined;
+            same_site?: string | undefined;
+        } | undefined;
+        identity_stores?: string[] | undefined;
+        identity_providers?: string[] | undefined;
+        user_transformer_configs?: Record<string, unknown>[] | undefined;
+    }>, "many">>;
+    authorization_policies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        access_list_rules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            comment: z.ZodOptional<z.ZodString>;
+            conditions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            action: z.ZodOptional<z.ZodEnum<["allow", "deny"]>>;
+        }, "strip", z.ZodTypeAny, {
+            comment?: string | undefined;
+            conditions?: string[] | undefined;
+            action?: "allow" | "deny" | undefined;
+        }, {
+            comment?: string | undefined;
+            conditions?: string[] | undefined;
+            action?: "allow" | "deny" | undefined;
+        }>, "many">>;
+        crypto_key_configs: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            token_name: z.ZodOptional<z.ZodString>;
+            source: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            source?: string | undefined;
+            token_name?: string | undefined;
+        }, {
+            source?: string | undefined;
+            token_name?: string | undefined;
+        }>, "many">>;
+        bypass_configs: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            match_type: z.ZodString;
+            uri: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            match_type: string;
+            uri?: string | undefined;
+        }, {
+            match_type: string;
+            uri?: string | undefined;
+        }>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        name: string;
+        access_list_rules?: {
+            comment?: string | undefined;
+            conditions?: string[] | undefined;
+            action?: "allow" | "deny" | undefined;
+        }[] | undefined;
+        crypto_key_configs?: {
+            source?: string | undefined;
+            token_name?: string | undefined;
+        }[] | undefined;
+        bypass_configs?: {
+            match_type: string;
+            uri?: string | undefined;
+        }[] | undefined;
+    }, {
+        name: string;
+        access_list_rules?: {
+            comment?: string | undefined;
+            conditions?: string[] | undefined;
+            action?: "allow" | "deny" | undefined;
+        }[] | undefined;
+        crypto_key_configs?: {
+            source?: string | undefined;
+            token_name?: string | undefined;
+        }[] | undefined;
+        bypass_configs?: {
+            match_type: string;
+            uri?: string | undefined;
+        }[] | undefined;
+    }>, "many">>;
+    credentials: z.ZodOptional<z.ZodObject<{
+        generic: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        generic?: Record<string, unknown> | undefined;
+    }, {
+        generic?: Record<string, unknown> | undefined;
+    }>>;
+    identity_stores: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+        name: z.ZodString;
+        kind: z.ZodLiteral<"local">;
+        params: z.ZodObject<{
+            realm: z.ZodOptional<z.ZodString>;
+            path: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            path: string;
+            realm?: string | undefined;
+        }, {
+            path: string;
+            realm?: string | undefined;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        params: {
+            path: string;
+            realm?: string | undefined;
+        };
+        name: string;
+        kind: "local";
+    }, {
+        params: {
+            path: string;
+            realm?: string | undefined;
+        };
+        name: string;
+        kind: "local";
+    }>, z.ZodObject<{
+        name: z.ZodString;
+        kind: z.ZodLiteral<"ldap">;
+        params: z.ZodObject<{
+            realm: z.ZodOptional<z.ZodString>;
+            servers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                address: z.ZodString;
+                port: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                address: string;
+                port?: number | undefined;
+            }, {
+                address: string;
+                port?: number | undefined;
+            }>, "many">>;
+            bind_username: z.ZodOptional<z.ZodString>;
+            bind_password: z.ZodOptional<z.ZodString>;
+            search_base_dn: z.ZodOptional<z.ZodString>;
+            search_user_filter: z.ZodOptional<z.ZodString>;
+            groups: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                dn: z.ZodString;
+                roles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, "strip", z.ZodTypeAny, {
+                dn: string;
+                roles?: string[] | undefined;
+            }, {
+                dn: string;
+                roles?: string[] | undefined;
+            }>, "many">>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            realm: z.ZodOptional<z.ZodString>;
+            servers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                address: z.ZodString;
+                port: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                address: string;
+                port?: number | undefined;
+            }, {
+                address: string;
+                port?: number | undefined;
+            }>, "many">>;
+            bind_username: z.ZodOptional<z.ZodString>;
+            bind_password: z.ZodOptional<z.ZodString>;
+            search_base_dn: z.ZodOptional<z.ZodString>;
+            search_user_filter: z.ZodOptional<z.ZodString>;
+            groups: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                dn: z.ZodString;
+                roles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, "strip", z.ZodTypeAny, {
+                dn: string;
+                roles?: string[] | undefined;
+            }, {
+                dn: string;
+                roles?: string[] | undefined;
+            }>, "many">>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            realm: z.ZodOptional<z.ZodString>;
+            servers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                address: z.ZodString;
+                port: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                address: string;
+                port?: number | undefined;
+            }, {
+                address: string;
+                port?: number | undefined;
+            }>, "many">>;
+            bind_username: z.ZodOptional<z.ZodString>;
+            bind_password: z.ZodOptional<z.ZodString>;
+            search_base_dn: z.ZodOptional<z.ZodString>;
+            search_user_filter: z.ZodOptional<z.ZodString>;
+            groups: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                dn: z.ZodString;
+                roles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, "strip", z.ZodTypeAny, {
+                dn: string;
+                roles?: string[] | undefined;
+            }, {
+                dn: string;
+                roles?: string[] | undefined;
+            }>, "many">>;
+        }, z.ZodTypeAny, "passthrough">>;
+    }, "strip", z.ZodTypeAny, {
+        params: {
+            servers?: {
+                address: string;
+                port?: number | undefined;
+            }[] | undefined;
+            realm?: string | undefined;
+            bind_username?: string | undefined;
+            bind_password?: string | undefined;
+            search_base_dn?: string | undefined;
+            search_user_filter?: string | undefined;
+            groups?: {
+                dn: string;
+                roles?: string[] | undefined;
+            }[] | undefined;
+        } & {
+            [k: string]: unknown;
+        };
+        name: string;
+        kind: "ldap";
+    }, {
+        params: {
+            servers?: {
+                address: string;
+                port?: number | undefined;
+            }[] | undefined;
+            realm?: string | undefined;
+            bind_username?: string | undefined;
+            bind_password?: string | undefined;
+            search_base_dn?: string | undefined;
+            search_user_filter?: string | undefined;
+            groups?: {
+                dn: string;
+                roles?: string[] | undefined;
+            }[] | undefined;
+        } & {
+            [k: string]: unknown;
+        };
+        name: string;
+        kind: "ldap";
+    }>]>, "many">>;
+    identity_providers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        kind: z.ZodLiteral<"oauth">;
+        params: z.ZodUnion<[z.ZodObject<{
+            driver: z.ZodOptional<z.ZodString>;
+            realm: z.ZodOptional<z.ZodString>;
+            client_id: z.ZodOptional<z.ZodString>;
+            client_secret: z.ZodOptional<z.ZodString>;
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            authorization_url: z.ZodOptional<z.ZodString>;
+            token_url: z.ZodOptional<z.ZodString>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            driver: z.ZodOptional<z.ZodString>;
+            realm: z.ZodOptional<z.ZodString>;
+            client_id: z.ZodOptional<z.ZodString>;
+            client_secret: z.ZodOptional<z.ZodString>;
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            authorization_url: z.ZodOptional<z.ZodString>;
+            token_url: z.ZodOptional<z.ZodString>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            driver: z.ZodOptional<z.ZodString>;
+            realm: z.ZodOptional<z.ZodString>;
+            client_id: z.ZodOptional<z.ZodString>;
+            client_secret: z.ZodOptional<z.ZodString>;
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            authorization_url: z.ZodOptional<z.ZodString>;
+            token_url: z.ZodOptional<z.ZodString>;
+        }, z.ZodTypeAny, "passthrough">>, z.ZodObject<{
+            driver: z.ZodOptional<z.ZodString>;
+            realm: z.ZodOptional<z.ZodString>;
+            client_id: z.ZodOptional<z.ZodString>;
+            client_secret: z.ZodOptional<z.ZodString>;
+            metadata_url: z.ZodOptional<z.ZodString>;
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            driver: z.ZodOptional<z.ZodString>;
+            realm: z.ZodOptional<z.ZodString>;
+            client_id: z.ZodOptional<z.ZodString>;
+            client_secret: z.ZodOptional<z.ZodString>;
+            metadata_url: z.ZodOptional<z.ZodString>;
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            driver: z.ZodOptional<z.ZodString>;
+            realm: z.ZodOptional<z.ZodString>;
+            client_id: z.ZodOptional<z.ZodString>;
+            client_secret: z.ZodOptional<z.ZodString>;
+            metadata_url: z.ZodOptional<z.ZodString>;
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">>]>;
+    }, "strip", z.ZodTypeAny, {
+        params: z.objectOutputType<{
+            driver: z.ZodOptional<z.ZodString>;
+            realm: z.ZodOptional<z.ZodString>;
+            client_id: z.ZodOptional<z.ZodString>;
+            client_secret: z.ZodOptional<z.ZodString>;
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            authorization_url: z.ZodOptional<z.ZodString>;
+            token_url: z.ZodOptional<z.ZodString>;
+        }, z.ZodTypeAny, "passthrough"> | z.objectOutputType<{
+            driver: z.ZodOptional<z.ZodString>;
+            realm: z.ZodOptional<z.ZodString>;
+            client_id: z.ZodOptional<z.ZodString>;
+            client_secret: z.ZodOptional<z.ZodString>;
+            metadata_url: z.ZodOptional<z.ZodString>;
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">;
+        name: string;
+        kind: "oauth";
+    }, {
+        params: z.objectInputType<{
+            driver: z.ZodOptional<z.ZodString>;
+            realm: z.ZodOptional<z.ZodString>;
+            client_id: z.ZodOptional<z.ZodString>;
+            client_secret: z.ZodOptional<z.ZodString>;
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            authorization_url: z.ZodOptional<z.ZodString>;
+            token_url: z.ZodOptional<z.ZodString>;
+        }, z.ZodTypeAny, "passthrough"> | z.objectInputType<{
+            driver: z.ZodOptional<z.ZodString>;
+            realm: z.ZodOptional<z.ZodString>;
+            client_id: z.ZodOptional<z.ZodString>;
+            client_secret: z.ZodOptional<z.ZodString>;
+            metadata_url: z.ZodOptional<z.ZodString>;
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">;
+        name: string;
+        kind: "oauth";
+    }>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    identity_stores?: ({
+        params: {
+            path: string;
+            realm?: string | undefined;
+        };
+        name: string;
+        kind: "local";
+    } | {
+        params: {
+            servers?: {
+                address: string;
+                port?: number | undefined;
+            }[] | undefined;
+            realm?: string | undefined;
+            bind_username?: string | undefined;
+            bind_password?: string | undefined;
+            search_base_dn?: string | undefined;
+            search_user_filter?: string | undefined;
+            groups?: {
+                dn: string;
+                roles?: string[] | undefined;
+            }[] | undefined;
+        } & {
+            [k: string]: unknown;
+        };
+        name: string;
+        kind: "ldap";
+    })[] | undefined;
+    identity_providers?: {
+        params: z.objectOutputType<{
+            driver: z.ZodOptional<z.ZodString>;
+            realm: z.ZodOptional<z.ZodString>;
+            client_id: z.ZodOptional<z.ZodString>;
+            client_secret: z.ZodOptional<z.ZodString>;
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            authorization_url: z.ZodOptional<z.ZodString>;
+            token_url: z.ZodOptional<z.ZodString>;
+        }, z.ZodTypeAny, "passthrough"> | z.objectOutputType<{
+            driver: z.ZodOptional<z.ZodString>;
+            realm: z.ZodOptional<z.ZodString>;
+            client_id: z.ZodOptional<z.ZodString>;
+            client_secret: z.ZodOptional<z.ZodString>;
+            metadata_url: z.ZodOptional<z.ZodString>;
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">;
+        name: string;
+        kind: "oauth";
+    }[] | undefined;
+    authentication_portals?: {
+        name: string;
+        ui?: {
+            theme?: string | undefined;
+            logo_url?: string | undefined;
+            custom_css?: string | undefined;
+        } | undefined;
+        cookie_config?: {
+            path?: string | undefined;
+            domains?: Record<string, {
+                lifetime?: number | undefined;
+                insecure?: boolean | undefined;
+                same_site?: string | undefined;
+            }> | undefined;
+            lifetime?: number | undefined;
+            insecure?: boolean | undefined;
+            same_site?: string | undefined;
+        } | undefined;
+        identity_stores?: string[] | undefined;
+        identity_providers?: string[] | undefined;
+        user_transformer_configs?: Record<string, unknown>[] | undefined;
+    }[] | undefined;
+    authorization_policies?: {
+        name: string;
+        access_list_rules?: {
+            comment?: string | undefined;
+            conditions?: string[] | undefined;
+            action?: "allow" | "deny" | undefined;
+        }[] | undefined;
+        crypto_key_configs?: {
+            source?: string | undefined;
+            token_name?: string | undefined;
+        }[] | undefined;
+        bypass_configs?: {
+            match_type: string;
+            uri?: string | undefined;
+        }[] | undefined;
+    }[] | undefined;
+    credentials?: {
+        generic?: Record<string, unknown> | undefined;
+    } | undefined;
+}, {
+    identity_stores?: ({
+        params: {
+            path: string;
+            realm?: string | undefined;
+        };
+        name: string;
+        kind: "local";
+    } | {
+        params: {
+            servers?: {
+                address: string;
+                port?: number | undefined;
+            }[] | undefined;
+            realm?: string | undefined;
+            bind_username?: string | undefined;
+            bind_password?: string | undefined;
+            search_base_dn?: string | undefined;
+            search_user_filter?: string | undefined;
+            groups?: {
+                dn: string;
+                roles?: string[] | undefined;
+            }[] | undefined;
+        } & {
+            [k: string]: unknown;
+        };
+        name: string;
+        kind: "ldap";
+    })[] | undefined;
+    identity_providers?: {
+        params: z.objectInputType<{
+            driver: z.ZodOptional<z.ZodString>;
+            realm: z.ZodOptional<z.ZodString>;
+            client_id: z.ZodOptional<z.ZodString>;
+            client_secret: z.ZodOptional<z.ZodString>;
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            authorization_url: z.ZodOptional<z.ZodString>;
+            token_url: z.ZodOptional<z.ZodString>;
+        }, z.ZodTypeAny, "passthrough"> | z.objectInputType<{
+            driver: z.ZodOptional<z.ZodString>;
+            realm: z.ZodOptional<z.ZodString>;
+            client_id: z.ZodOptional<z.ZodString>;
+            client_secret: z.ZodOptional<z.ZodString>;
+            metadata_url: z.ZodOptional<z.ZodString>;
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, z.ZodTypeAny, "passthrough">;
+        name: string;
+        kind: "oauth";
+    }[] | undefined;
+    authentication_portals?: {
+        name: string;
+        ui?: {
+            theme?: string | undefined;
+            logo_url?: string | undefined;
+            custom_css?: string | undefined;
+        } | undefined;
+        cookie_config?: {
+            path?: string | undefined;
+            domains?: Record<string, {
+                lifetime?: number | undefined;
+                insecure?: boolean | undefined;
+                same_site?: string | undefined;
+            }> | undefined;
+            lifetime?: number | undefined;
+            insecure?: boolean | undefined;
+            same_site?: string | undefined;
+        } | undefined;
+        identity_stores?: string[] | undefined;
+        identity_providers?: string[] | undefined;
+        user_transformer_configs?: Record<string, unknown>[] | undefined;
+    }[] | undefined;
+    authorization_policies?: {
+        name: string;
+        access_list_rules?: {
+            comment?: string | undefined;
+            conditions?: string[] | undefined;
+            action?: "allow" | "deny" | undefined;
+        }[] | undefined;
+        crypto_key_configs?: {
+            source?: string | undefined;
+            token_name?: string | undefined;
+        }[] | undefined;
+        bypass_configs?: {
+            match_type: string;
+            uri?: string | undefined;
+        }[] | undefined;
+    }[] | undefined;
+    credentials?: {
+        generic?: Record<string, unknown> | undefined;
+    } | undefined;
+}>;
+/**
+ * Security app schema
+ *
+ * Validates the full security app at `/config/apps/security`
+ *
+ * @example
+ * ```typescript
+ * const securityApp = SecurityAppSchema.parse({
+ *   config: {
+ *     authentication_portals: [{
+ *       name: "myportal",
+ *       identity_stores: ["localdb"],
+ *     }],
+ *   },
+ * });
+ * ```
+ */
+declare const SecurityAppSchema: z.ZodObject<{
+    config: z.ZodOptional<z.ZodObject<{
+        authentication_portals: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            ui: z.ZodOptional<z.ZodObject<{
+                theme: z.ZodOptional<z.ZodString>;
+                logo_url: z.ZodOptional<z.ZodString>;
+                custom_css: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                theme?: string | undefined;
+                logo_url?: string | undefined;
+                custom_css?: string | undefined;
+            }, {
+                theme?: string | undefined;
+                logo_url?: string | undefined;
+                custom_css?: string | undefined;
+            }>>;
+            cookie_config: z.ZodOptional<z.ZodObject<{
+                domains: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                    lifetime: z.ZodOptional<z.ZodNumber>;
+                    insecure: z.ZodOptional<z.ZodBoolean>;
+                    same_site: z.ZodOptional<z.ZodString>;
+                }, "strip", z.ZodTypeAny, {
+                    lifetime?: number | undefined;
+                    insecure?: boolean | undefined;
+                    same_site?: string | undefined;
+                }, {
+                    lifetime?: number | undefined;
+                    insecure?: boolean | undefined;
+                    same_site?: string | undefined;
+                }>>>;
+                path: z.ZodOptional<z.ZodString>;
+                lifetime: z.ZodOptional<z.ZodNumber>;
+                insecure: z.ZodOptional<z.ZodBoolean>;
+                same_site: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                path?: string | undefined;
+                domains?: Record<string, {
+                    lifetime?: number | undefined;
+                    insecure?: boolean | undefined;
+                    same_site?: string | undefined;
+                }> | undefined;
+                lifetime?: number | undefined;
+                insecure?: boolean | undefined;
+                same_site?: string | undefined;
+            }, {
+                path?: string | undefined;
+                domains?: Record<string, {
+                    lifetime?: number | undefined;
+                    insecure?: boolean | undefined;
+                    same_site?: string | undefined;
+                }> | undefined;
+                lifetime?: number | undefined;
+                insecure?: boolean | undefined;
+                same_site?: string | undefined;
+            }>>;
+            identity_stores: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            identity_providers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            user_transformer_configs: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            name: string;
+            ui?: {
+                theme?: string | undefined;
+                logo_url?: string | undefined;
+                custom_css?: string | undefined;
+            } | undefined;
+            cookie_config?: {
+                path?: string | undefined;
+                domains?: Record<string, {
+                    lifetime?: number | undefined;
+                    insecure?: boolean | undefined;
+                    same_site?: string | undefined;
+                }> | undefined;
+                lifetime?: number | undefined;
+                insecure?: boolean | undefined;
+                same_site?: string | undefined;
+            } | undefined;
+            identity_stores?: string[] | undefined;
+            identity_providers?: string[] | undefined;
+            user_transformer_configs?: Record<string, unknown>[] | undefined;
+        }, {
+            name: string;
+            ui?: {
+                theme?: string | undefined;
+                logo_url?: string | undefined;
+                custom_css?: string | undefined;
+            } | undefined;
+            cookie_config?: {
+                path?: string | undefined;
+                domains?: Record<string, {
+                    lifetime?: number | undefined;
+                    insecure?: boolean | undefined;
+                    same_site?: string | undefined;
+                }> | undefined;
+                lifetime?: number | undefined;
+                insecure?: boolean | undefined;
+                same_site?: string | undefined;
+            } | undefined;
+            identity_stores?: string[] | undefined;
+            identity_providers?: string[] | undefined;
+            user_transformer_configs?: Record<string, unknown>[] | undefined;
+        }>, "many">>;
+        authorization_policies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            access_list_rules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                comment: z.ZodOptional<z.ZodString>;
+                conditions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                action: z.ZodOptional<z.ZodEnum<["allow", "deny"]>>;
+            }, "strip", z.ZodTypeAny, {
+                comment?: string | undefined;
+                conditions?: string[] | undefined;
+                action?: "allow" | "deny" | undefined;
+            }, {
+                comment?: string | undefined;
+                conditions?: string[] | undefined;
+                action?: "allow" | "deny" | undefined;
+            }>, "many">>;
+            crypto_key_configs: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                token_name: z.ZodOptional<z.ZodString>;
+                source: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                source?: string | undefined;
+                token_name?: string | undefined;
+            }, {
+                source?: string | undefined;
+                token_name?: string | undefined;
+            }>, "many">>;
+            bypass_configs: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                match_type: z.ZodString;
+                uri: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                match_type: string;
+                uri?: string | undefined;
+            }, {
+                match_type: string;
+                uri?: string | undefined;
+            }>, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            name: string;
+            access_list_rules?: {
+                comment?: string | undefined;
+                conditions?: string[] | undefined;
+                action?: "allow" | "deny" | undefined;
+            }[] | undefined;
+            crypto_key_configs?: {
+                source?: string | undefined;
+                token_name?: string | undefined;
+            }[] | undefined;
+            bypass_configs?: {
+                match_type: string;
+                uri?: string | undefined;
+            }[] | undefined;
+        }, {
+            name: string;
+            access_list_rules?: {
+                comment?: string | undefined;
+                conditions?: string[] | undefined;
+                action?: "allow" | "deny" | undefined;
+            }[] | undefined;
+            crypto_key_configs?: {
+                source?: string | undefined;
+                token_name?: string | undefined;
+            }[] | undefined;
+            bypass_configs?: {
+                match_type: string;
+                uri?: string | undefined;
+            }[] | undefined;
+        }>, "many">>;
+        credentials: z.ZodOptional<z.ZodObject<{
+            generic: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, "strip", z.ZodTypeAny, {
+            generic?: Record<string, unknown> | undefined;
+        }, {
+            generic?: Record<string, unknown> | undefined;
+        }>>;
+        identity_stores: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+            name: z.ZodString;
+            kind: z.ZodLiteral<"local">;
+            params: z.ZodObject<{
+                realm: z.ZodOptional<z.ZodString>;
+                path: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                path: string;
+                realm?: string | undefined;
+            }, {
+                path: string;
+                realm?: string | undefined;
+            }>;
+        }, "strip", z.ZodTypeAny, {
+            params: {
+                path: string;
+                realm?: string | undefined;
+            };
+            name: string;
+            kind: "local";
+        }, {
+            params: {
+                path: string;
+                realm?: string | undefined;
+            };
+            name: string;
+            kind: "local";
+        }>, z.ZodObject<{
+            name: z.ZodString;
+            kind: z.ZodLiteral<"ldap">;
+            params: z.ZodObject<{
+                realm: z.ZodOptional<z.ZodString>;
+                servers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    address: z.ZodString;
+                    port: z.ZodOptional<z.ZodNumber>;
+                }, "strip", z.ZodTypeAny, {
+                    address: string;
+                    port?: number | undefined;
+                }, {
+                    address: string;
+                    port?: number | undefined;
+                }>, "many">>;
+                bind_username: z.ZodOptional<z.ZodString>;
+                bind_password: z.ZodOptional<z.ZodString>;
+                search_base_dn: z.ZodOptional<z.ZodString>;
+                search_user_filter: z.ZodOptional<z.ZodString>;
+                groups: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    dn: z.ZodString;
+                    roles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                }, "strip", z.ZodTypeAny, {
+                    dn: string;
+                    roles?: string[] | undefined;
+                }, {
+                    dn: string;
+                    roles?: string[] | undefined;
+                }>, "many">>;
+            }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+                realm: z.ZodOptional<z.ZodString>;
+                servers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    address: z.ZodString;
+                    port: z.ZodOptional<z.ZodNumber>;
+                }, "strip", z.ZodTypeAny, {
+                    address: string;
+                    port?: number | undefined;
+                }, {
+                    address: string;
+                    port?: number | undefined;
+                }>, "many">>;
+                bind_username: z.ZodOptional<z.ZodString>;
+                bind_password: z.ZodOptional<z.ZodString>;
+                search_base_dn: z.ZodOptional<z.ZodString>;
+                search_user_filter: z.ZodOptional<z.ZodString>;
+                groups: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    dn: z.ZodString;
+                    roles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                }, "strip", z.ZodTypeAny, {
+                    dn: string;
+                    roles?: string[] | undefined;
+                }, {
+                    dn: string;
+                    roles?: string[] | undefined;
+                }>, "many">>;
+            }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+                realm: z.ZodOptional<z.ZodString>;
+                servers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    address: z.ZodString;
+                    port: z.ZodOptional<z.ZodNumber>;
+                }, "strip", z.ZodTypeAny, {
+                    address: string;
+                    port?: number | undefined;
+                }, {
+                    address: string;
+                    port?: number | undefined;
+                }>, "many">>;
+                bind_username: z.ZodOptional<z.ZodString>;
+                bind_password: z.ZodOptional<z.ZodString>;
+                search_base_dn: z.ZodOptional<z.ZodString>;
+                search_user_filter: z.ZodOptional<z.ZodString>;
+                groups: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    dn: z.ZodString;
+                    roles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                }, "strip", z.ZodTypeAny, {
+                    dn: string;
+                    roles?: string[] | undefined;
+                }, {
+                    dn: string;
+                    roles?: string[] | undefined;
+                }>, "many">>;
+            }, z.ZodTypeAny, "passthrough">>;
+        }, "strip", z.ZodTypeAny, {
+            params: {
+                servers?: {
+                    address: string;
+                    port?: number | undefined;
+                }[] | undefined;
+                realm?: string | undefined;
+                bind_username?: string | undefined;
+                bind_password?: string | undefined;
+                search_base_dn?: string | undefined;
+                search_user_filter?: string | undefined;
+                groups?: {
+                    dn: string;
+                    roles?: string[] | undefined;
+                }[] | undefined;
+            } & {
+                [k: string]: unknown;
+            };
+            name: string;
+            kind: "ldap";
+        }, {
+            params: {
+                servers?: {
+                    address: string;
+                    port?: number | undefined;
+                }[] | undefined;
+                realm?: string | undefined;
+                bind_username?: string | undefined;
+                bind_password?: string | undefined;
+                search_base_dn?: string | undefined;
+                search_user_filter?: string | undefined;
+                groups?: {
+                    dn: string;
+                    roles?: string[] | undefined;
+                }[] | undefined;
+            } & {
+                [k: string]: unknown;
+            };
+            name: string;
+            kind: "ldap";
+        }>]>, "many">>;
+        identity_providers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            kind: z.ZodLiteral<"oauth">;
+            params: z.ZodUnion<[z.ZodObject<{
+                driver: z.ZodOptional<z.ZodString>;
+                realm: z.ZodOptional<z.ZodString>;
+                client_id: z.ZodOptional<z.ZodString>;
+                client_secret: z.ZodOptional<z.ZodString>;
+                scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                authorization_url: z.ZodOptional<z.ZodString>;
+                token_url: z.ZodOptional<z.ZodString>;
+            }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+                driver: z.ZodOptional<z.ZodString>;
+                realm: z.ZodOptional<z.ZodString>;
+                client_id: z.ZodOptional<z.ZodString>;
+                client_secret: z.ZodOptional<z.ZodString>;
+                scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                authorization_url: z.ZodOptional<z.ZodString>;
+                token_url: z.ZodOptional<z.ZodString>;
+            }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+                driver: z.ZodOptional<z.ZodString>;
+                realm: z.ZodOptional<z.ZodString>;
+                client_id: z.ZodOptional<z.ZodString>;
+                client_secret: z.ZodOptional<z.ZodString>;
+                scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                authorization_url: z.ZodOptional<z.ZodString>;
+                token_url: z.ZodOptional<z.ZodString>;
+            }, z.ZodTypeAny, "passthrough">>, z.ZodObject<{
+                driver: z.ZodOptional<z.ZodString>;
+                realm: z.ZodOptional<z.ZodString>;
+                client_id: z.ZodOptional<z.ZodString>;
+                client_secret: z.ZodOptional<z.ZodString>;
+                metadata_url: z.ZodOptional<z.ZodString>;
+                scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+                driver: z.ZodOptional<z.ZodString>;
+                realm: z.ZodOptional<z.ZodString>;
+                client_id: z.ZodOptional<z.ZodString>;
+                client_secret: z.ZodOptional<z.ZodString>;
+                metadata_url: z.ZodOptional<z.ZodString>;
+                scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+                driver: z.ZodOptional<z.ZodString>;
+                realm: z.ZodOptional<z.ZodString>;
+                client_id: z.ZodOptional<z.ZodString>;
+                client_secret: z.ZodOptional<z.ZodString>;
+                metadata_url: z.ZodOptional<z.ZodString>;
+                scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, z.ZodTypeAny, "passthrough">>]>;
+        }, "strip", z.ZodTypeAny, {
+            params: z.objectOutputType<{
+                driver: z.ZodOptional<z.ZodString>;
+                realm: z.ZodOptional<z.ZodString>;
+                client_id: z.ZodOptional<z.ZodString>;
+                client_secret: z.ZodOptional<z.ZodString>;
+                scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                authorization_url: z.ZodOptional<z.ZodString>;
+                token_url: z.ZodOptional<z.ZodString>;
+            }, z.ZodTypeAny, "passthrough"> | z.objectOutputType<{
+                driver: z.ZodOptional<z.ZodString>;
+                realm: z.ZodOptional<z.ZodString>;
+                client_id: z.ZodOptional<z.ZodString>;
+                client_secret: z.ZodOptional<z.ZodString>;
+                metadata_url: z.ZodOptional<z.ZodString>;
+                scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, z.ZodTypeAny, "passthrough">;
+            name: string;
+            kind: "oauth";
+        }, {
+            params: z.objectInputType<{
+                driver: z.ZodOptional<z.ZodString>;
+                realm: z.ZodOptional<z.ZodString>;
+                client_id: z.ZodOptional<z.ZodString>;
+                client_secret: z.ZodOptional<z.ZodString>;
+                scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                authorization_url: z.ZodOptional<z.ZodString>;
+                token_url: z.ZodOptional<z.ZodString>;
+            }, z.ZodTypeAny, "passthrough"> | z.objectInputType<{
+                driver: z.ZodOptional<z.ZodString>;
+                realm: z.ZodOptional<z.ZodString>;
+                client_id: z.ZodOptional<z.ZodString>;
+                client_secret: z.ZodOptional<z.ZodString>;
+                metadata_url: z.ZodOptional<z.ZodString>;
+                scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, z.ZodTypeAny, "passthrough">;
+            name: string;
+            kind: "oauth";
+        }>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        identity_stores?: ({
+            params: {
+                path: string;
+                realm?: string | undefined;
+            };
+            name: string;
+            kind: "local";
+        } | {
+            params: {
+                servers?: {
+                    address: string;
+                    port?: number | undefined;
+                }[] | undefined;
+                realm?: string | undefined;
+                bind_username?: string | undefined;
+                bind_password?: string | undefined;
+                search_base_dn?: string | undefined;
+                search_user_filter?: string | undefined;
+                groups?: {
+                    dn: string;
+                    roles?: string[] | undefined;
+                }[] | undefined;
+            } & {
+                [k: string]: unknown;
+            };
+            name: string;
+            kind: "ldap";
+        })[] | undefined;
+        identity_providers?: {
+            params: z.objectOutputType<{
+                driver: z.ZodOptional<z.ZodString>;
+                realm: z.ZodOptional<z.ZodString>;
+                client_id: z.ZodOptional<z.ZodString>;
+                client_secret: z.ZodOptional<z.ZodString>;
+                scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                authorization_url: z.ZodOptional<z.ZodString>;
+                token_url: z.ZodOptional<z.ZodString>;
+            }, z.ZodTypeAny, "passthrough"> | z.objectOutputType<{
+                driver: z.ZodOptional<z.ZodString>;
+                realm: z.ZodOptional<z.ZodString>;
+                client_id: z.ZodOptional<z.ZodString>;
+                client_secret: z.ZodOptional<z.ZodString>;
+                metadata_url: z.ZodOptional<z.ZodString>;
+                scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, z.ZodTypeAny, "passthrough">;
+            name: string;
+            kind: "oauth";
+        }[] | undefined;
+        authentication_portals?: {
+            name: string;
+            ui?: {
+                theme?: string | undefined;
+                logo_url?: string | undefined;
+                custom_css?: string | undefined;
+            } | undefined;
+            cookie_config?: {
+                path?: string | undefined;
+                domains?: Record<string, {
+                    lifetime?: number | undefined;
+                    insecure?: boolean | undefined;
+                    same_site?: string | undefined;
+                }> | undefined;
+                lifetime?: number | undefined;
+                insecure?: boolean | undefined;
+                same_site?: string | undefined;
+            } | undefined;
+            identity_stores?: string[] | undefined;
+            identity_providers?: string[] | undefined;
+            user_transformer_configs?: Record<string, unknown>[] | undefined;
+        }[] | undefined;
+        authorization_policies?: {
+            name: string;
+            access_list_rules?: {
+                comment?: string | undefined;
+                conditions?: string[] | undefined;
+                action?: "allow" | "deny" | undefined;
+            }[] | undefined;
+            crypto_key_configs?: {
+                source?: string | undefined;
+                token_name?: string | undefined;
+            }[] | undefined;
+            bypass_configs?: {
+                match_type: string;
+                uri?: string | undefined;
+            }[] | undefined;
+        }[] | undefined;
+        credentials?: {
+            generic?: Record<string, unknown> | undefined;
+        } | undefined;
+    }, {
+        identity_stores?: ({
+            params: {
+                path: string;
+                realm?: string | undefined;
+            };
+            name: string;
+            kind: "local";
+        } | {
+            params: {
+                servers?: {
+                    address: string;
+                    port?: number | undefined;
+                }[] | undefined;
+                realm?: string | undefined;
+                bind_username?: string | undefined;
+                bind_password?: string | undefined;
+                search_base_dn?: string | undefined;
+                search_user_filter?: string | undefined;
+                groups?: {
+                    dn: string;
+                    roles?: string[] | undefined;
+                }[] | undefined;
+            } & {
+                [k: string]: unknown;
+            };
+            name: string;
+            kind: "ldap";
+        })[] | undefined;
+        identity_providers?: {
+            params: z.objectInputType<{
+                driver: z.ZodOptional<z.ZodString>;
+                realm: z.ZodOptional<z.ZodString>;
+                client_id: z.ZodOptional<z.ZodString>;
+                client_secret: z.ZodOptional<z.ZodString>;
+                scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                authorization_url: z.ZodOptional<z.ZodString>;
+                token_url: z.ZodOptional<z.ZodString>;
+            }, z.ZodTypeAny, "passthrough"> | z.objectInputType<{
+                driver: z.ZodOptional<z.ZodString>;
+                realm: z.ZodOptional<z.ZodString>;
+                client_id: z.ZodOptional<z.ZodString>;
+                client_secret: z.ZodOptional<z.ZodString>;
+                metadata_url: z.ZodOptional<z.ZodString>;
+                scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, z.ZodTypeAny, "passthrough">;
+            name: string;
+            kind: "oauth";
+        }[] | undefined;
+        authentication_portals?: {
+            name: string;
+            ui?: {
+                theme?: string | undefined;
+                logo_url?: string | undefined;
+                custom_css?: string | undefined;
+            } | undefined;
+            cookie_config?: {
+                path?: string | undefined;
+                domains?: Record<string, {
+                    lifetime?: number | undefined;
+                    insecure?: boolean | undefined;
+                    same_site?: string | undefined;
+                }> | undefined;
+                lifetime?: number | undefined;
+                insecure?: boolean | undefined;
+                same_site?: string | undefined;
+            } | undefined;
+            identity_stores?: string[] | undefined;
+            identity_providers?: string[] | undefined;
+            user_transformer_configs?: Record<string, unknown>[] | undefined;
+        }[] | undefined;
+        authorization_policies?: {
+            name: string;
+            access_list_rules?: {
+                comment?: string | undefined;
+                conditions?: string[] | undefined;
+                action?: "allow" | "deny" | undefined;
+            }[] | undefined;
+            crypto_key_configs?: {
+                source?: string | undefined;
+                token_name?: string | undefined;
+            }[] | undefined;
+            bypass_configs?: {
+                match_type: string;
+                uri?: string | undefined;
+            }[] | undefined;
+        }[] | undefined;
+        credentials?: {
+            generic?: Record<string, unknown> | undefined;
+        } | undefined;
+    }>>;
+    secrets_managers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        driver: z.ZodString;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        driver: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        driver: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    config?: {
+        identity_stores?: ({
+            params: {
+                path: string;
+                realm?: string | undefined;
+            };
+            name: string;
+            kind: "local";
+        } | {
+            params: {
+                servers?: {
+                    address: string;
+                    port?: number | undefined;
+                }[] | undefined;
+                realm?: string | undefined;
+                bind_username?: string | undefined;
+                bind_password?: string | undefined;
+                search_base_dn?: string | undefined;
+                search_user_filter?: string | undefined;
+                groups?: {
+                    dn: string;
+                    roles?: string[] | undefined;
+                }[] | undefined;
+            } & {
+                [k: string]: unknown;
+            };
+            name: string;
+            kind: "ldap";
+        })[] | undefined;
+        identity_providers?: {
+            params: z.objectOutputType<{
+                driver: z.ZodOptional<z.ZodString>;
+                realm: z.ZodOptional<z.ZodString>;
+                client_id: z.ZodOptional<z.ZodString>;
+                client_secret: z.ZodOptional<z.ZodString>;
+                scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                authorization_url: z.ZodOptional<z.ZodString>;
+                token_url: z.ZodOptional<z.ZodString>;
+            }, z.ZodTypeAny, "passthrough"> | z.objectOutputType<{
+                driver: z.ZodOptional<z.ZodString>;
+                realm: z.ZodOptional<z.ZodString>;
+                client_id: z.ZodOptional<z.ZodString>;
+                client_secret: z.ZodOptional<z.ZodString>;
+                metadata_url: z.ZodOptional<z.ZodString>;
+                scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, z.ZodTypeAny, "passthrough">;
+            name: string;
+            kind: "oauth";
+        }[] | undefined;
+        authentication_portals?: {
+            name: string;
+            ui?: {
+                theme?: string | undefined;
+                logo_url?: string | undefined;
+                custom_css?: string | undefined;
+            } | undefined;
+            cookie_config?: {
+                path?: string | undefined;
+                domains?: Record<string, {
+                    lifetime?: number | undefined;
+                    insecure?: boolean | undefined;
+                    same_site?: string | undefined;
+                }> | undefined;
+                lifetime?: number | undefined;
+                insecure?: boolean | undefined;
+                same_site?: string | undefined;
+            } | undefined;
+            identity_stores?: string[] | undefined;
+            identity_providers?: string[] | undefined;
+            user_transformer_configs?: Record<string, unknown>[] | undefined;
+        }[] | undefined;
+        authorization_policies?: {
+            name: string;
+            access_list_rules?: {
+                comment?: string | undefined;
+                conditions?: string[] | undefined;
+                action?: "allow" | "deny" | undefined;
+            }[] | undefined;
+            crypto_key_configs?: {
+                source?: string | undefined;
+                token_name?: string | undefined;
+            }[] | undefined;
+            bypass_configs?: {
+                match_type: string;
+                uri?: string | undefined;
+            }[] | undefined;
+        }[] | undefined;
+        credentials?: {
+            generic?: Record<string, unknown> | undefined;
+        } | undefined;
+    } | undefined;
+    secrets_managers?: z.objectOutputType<{
+        driver: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">[] | undefined;
+}, {
+    config?: {
+        identity_stores?: ({
+            params: {
+                path: string;
+                realm?: string | undefined;
+            };
+            name: string;
+            kind: "local";
+        } | {
+            params: {
+                servers?: {
+                    address: string;
+                    port?: number | undefined;
+                }[] | undefined;
+                realm?: string | undefined;
+                bind_username?: string | undefined;
+                bind_password?: string | undefined;
+                search_base_dn?: string | undefined;
+                search_user_filter?: string | undefined;
+                groups?: {
+                    dn: string;
+                    roles?: string[] | undefined;
+                }[] | undefined;
+            } & {
+                [k: string]: unknown;
+            };
+            name: string;
+            kind: "ldap";
+        })[] | undefined;
+        identity_providers?: {
+            params: z.objectInputType<{
+                driver: z.ZodOptional<z.ZodString>;
+                realm: z.ZodOptional<z.ZodString>;
+                client_id: z.ZodOptional<z.ZodString>;
+                client_secret: z.ZodOptional<z.ZodString>;
+                scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                authorization_url: z.ZodOptional<z.ZodString>;
+                token_url: z.ZodOptional<z.ZodString>;
+            }, z.ZodTypeAny, "passthrough"> | z.objectInputType<{
+                driver: z.ZodOptional<z.ZodString>;
+                realm: z.ZodOptional<z.ZodString>;
+                client_id: z.ZodOptional<z.ZodString>;
+                client_secret: z.ZodOptional<z.ZodString>;
+                metadata_url: z.ZodOptional<z.ZodString>;
+                scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, z.ZodTypeAny, "passthrough">;
+            name: string;
+            kind: "oauth";
+        }[] | undefined;
+        authentication_portals?: {
+            name: string;
+            ui?: {
+                theme?: string | undefined;
+                logo_url?: string | undefined;
+                custom_css?: string | undefined;
+            } | undefined;
+            cookie_config?: {
+                path?: string | undefined;
+                domains?: Record<string, {
+                    lifetime?: number | undefined;
+                    insecure?: boolean | undefined;
+                    same_site?: string | undefined;
+                }> | undefined;
+                lifetime?: number | undefined;
+                insecure?: boolean | undefined;
+                same_site?: string | undefined;
+            } | undefined;
+            identity_stores?: string[] | undefined;
+            identity_providers?: string[] | undefined;
+            user_transformer_configs?: Record<string, unknown>[] | undefined;
+        }[] | undefined;
+        authorization_policies?: {
+            name: string;
+            access_list_rules?: {
+                comment?: string | undefined;
+                conditions?: string[] | undefined;
+                action?: "allow" | "deny" | undefined;
+            }[] | undefined;
+            crypto_key_configs?: {
+                source?: string | undefined;
+                token_name?: string | undefined;
+            }[] | undefined;
+            bypass_configs?: {
+                match_type: string;
+                uri?: string | undefined;
+            }[] | undefined;
+        }[] | undefined;
+        credentials?: {
+            generic?: Record<string, unknown> | undefined;
+        } | undefined;
+    } | undefined;
+    secrets_managers?: z.objectInputType<{
+        driver: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">[] | undefined;
+}>;
+type SecurityAuthenticatorHandler = z.infer<typeof SecurityAuthenticatorHandlerSchema>;
+type SecurityAuthorizationHandler = z.infer<typeof SecurityAuthorizationHandlerSchema>;
+type LocalIdentityStore = z.infer<typeof LocalIdentityStoreSchema>;
+type LdapIdentityStore = z.infer<typeof LdapIdentityStoreSchema>;
+type OAuth2IdentityProvider = z.infer<typeof OAuth2IdentityProviderSchema>;
+type OidcIdentityProvider = z.infer<typeof OidcIdentityProviderSchema>;
+type AuthenticationPortal = z.infer<typeof AuthenticationPortalSchema>;
+type AuthorizationPolicy = z.infer<typeof AuthorizationPolicySchema>;
+type SecurityConfig = z.infer<typeof SecurityConfigSchema>;
+type SecurityApp = z.infer<typeof SecurityAppSchema>;
+
+/**
+ * Options for building a local identity store
+ */
+interface BuildLocalIdentityStoreOptions {
+    /**
+     * Name of the identity store (used to reference it in portals)
+     * @default "local"
+     */
+    name?: string;
+    /**
+     * Path to the JSON file containing user credentials
+     */
+    path: string;
+    /**
+     * Realm name for this identity store
+     * @default "local"
+     */
+    realm?: string;
+}
+/**
+ * Build a local identity store configuration
+ *
+ * Creates a local JSON file-based identity store for user credentials.
+ * Uses the authcrunch wrapper structure: name, kind, params
+ *
+ * @param options - Store options
+ * @returns Validated local identity store configuration
+ *
+ * @example
+ * ```typescript
+ * import { buildLocalIdentityStore } from "@.../caddy-api-client/plugins/caddy-security";
+ *
+ * const store = buildLocalIdentityStore({
+ *   name: "localdb",
+ *   path: "/etc/caddy/users.json",
+ *   realm: "local",
+ * });
+ * ```
+ */
+declare function buildLocalIdentityStore(options: BuildLocalIdentityStoreOptions): LocalIdentityStore;
+/**
+ * LDAP server configuration
+ */
+interface LdapServerConfig {
+    /**
+     * LDAP server address
+     */
+    address: string;
+    /**
+     * LDAP server port
+     * @default 389
+     */
+    port?: number;
+}
+/**
+ * LDAP group to role mapping
+ */
+interface LdapGroupConfig {
+    /**
+     * LDAP group DN
+     * @example "CN=Admins,OU=Groups,DC=example,DC=com"
+     */
+    groupDn?: string;
+    /**
+     * Roles to assign when user is member of this group
+     */
+    roles?: string[];
+}
+/**
+ * Options for building an LDAP identity store
+ */
+interface BuildLdapIdentityStoreOptions {
+    /**
+     * Name of the identity store (used to reference it in portals)
+     * @default "ldapdb"
+     */
+    name?: string;
+    /**
+     * Realm name for this identity store
+     * @default "ldap"
+     */
+    realm?: string;
+    /**
+     * LDAP server(s) to connect to
+     */
+    servers: LdapServerConfig[];
+    /**
+     * Bind username for LDAP queries (full DN)
+     * @example "cn=admin,dc=example,dc=com"
+     */
+    bindUsername: string;
+    /**
+     * Bind password for LDAP authentication
+     */
+    bindPassword: string;
+    /**
+     * Base DN for user searches
+     * @example "ou=users,dc=example,dc=com"
+     */
+    searchBaseDn: string;
+    /**
+     * LDAP search filter template for users
+     * @default "(uid={username})"
+     */
+    searchUserFilter?: string;
+    /**
+     * Group to role mappings
+     * @default []
+     */
+    groups?: LdapGroupConfig[];
+}
+/**
+ * Build an LDAP identity store configuration
+ *
+ * Creates an LDAP-based identity store for user authentication.
+ * Uses the authcrunch wrapper structure: name, kind, params
+ *
+ * @param options - Store options
+ * @returns Validated LDAP identity store configuration
+ *
+ * @example
+ * ```typescript
+ * import { buildLdapIdentityStore } from "@.../caddy-api-client/plugins/caddy-security";
+ *
+ * const store = buildLdapIdentityStore({
+ *   name: "ldapdb",
+ *   servers: [{ address: "ldap.example.com", port: 389 }],
+ *   bindUsername: "cn=admin,dc=example,dc=com",
+ *   bindPassword: "secret",
+ *   searchBaseDn: "ou=users,dc=example,dc=com",
+ *   searchUserFilter: "(uid={username})",
+ * });
+ * ```
+ */
+declare function buildLdapIdentityStore(options: BuildLdapIdentityStoreOptions): LdapIdentityStore;
+/**
+ * Options for building an OAuth2 identity provider
+ */
+interface BuildOAuth2ProviderOptions {
+    /**
+     * Name of the identity provider (used to reference it in portals)
+     */
+    name?: string;
+    /**
+     * Realm name for this provider
+     */
+    realm?: string;
+    /**
+     * Provider name/driver (github, google, facebook, etc.)
+     */
+    provider: string;
+    /**
+     * OAuth client ID
+     */
+    clientId: string;
+    /**
+     * OAuth client secret
+     */
+    clientSecret: string;
+    /**
+     * OAuth scopes to request
+     * @default ["openid", "email", "profile"]
+     */
+    scopes?: string[];
+    /**
+     * Authorization URL (for non-standard providers)
+     */
+    authorizationUrl?: string;
+    /**
+     * Token URL (for non-standard providers)
+     */
+    tokenUrl?: string;
+}
+/**
+ * Build an OAuth2 identity provider configuration
+ *
+ * Uses the authcrunch wrapper structure: name, kind, params
+ *
+ * @param options - Provider options
+ * @returns Validated OAuth2 provider configuration
+ *
+ * @example
+ * ```typescript
+ * import { buildOAuth2Provider } from "@.../caddy-api-client/plugins/caddy-security";
+ *
+ * const provider = buildOAuth2Provider({
+ *   name: "github",
+ *   provider: "github",
+ *   clientId: "your-client-id",
+ *   clientSecret: "your-client-secret",
+ *   scopes: ["user:email", "read:user"],
+ * });
+ * ```
+ */
+declare function buildOAuth2Provider(options: BuildOAuth2ProviderOptions): OAuth2IdentityProvider;
+/**
+ * Options for building an OIDC identity provider
+ */
+interface BuildOidcProviderOptions {
+    /**
+     * Name of the identity provider (used to reference it in portals)
+     */
+    name?: string;
+    /**
+     * Realm name for this provider
+     */
+    realm?: string;
+    /**
+     * OIDC provider name (keycloak, okta, auth0, etc.)
+     */
+    provider: string;
+    /**
+     * Client ID
+     */
+    clientId: string;
+    /**
+     * Client secret
+     */
+    clientSecret: string;
+    /**
+     * OIDC metadata/discovery URL (.well-known/openid-configuration)
+     * @example "https://keycloak.example.com/realms/myrealm/.well-known/openid-configuration"
+     */
+    metadataUrl: string;
+    /**
+     * Scopes to request
+     * @default ["openid", "email", "profile"]
+     */
+    scopes?: string[];
+}
+/**
+ * Build an OIDC identity provider configuration
+ *
+ * Uses the authcrunch wrapper structure: name, kind, params
+ *
+ * @param options - Provider options
+ * @returns Validated OIDC provider configuration
+ *
+ * @example
+ * ```typescript
+ * import { buildOidcProvider } from "@.../caddy-api-client/plugins/caddy-security";
+ *
+ * const provider = buildOidcProvider({
+ *   name: "keycloak",
+ *   provider: "keycloak",
+ *   clientId: "my-app",
+ *   clientSecret: "secret",
+ *   metadataUrl: "https://keycloak.example.com/realms/myrealm/.well-known/openid-configuration",
+ * });
+ * ```
+ */
+declare function buildOidcProvider(options: BuildOidcProviderOptions): OidcIdentityProvider;
+/**
+ * UI customization options for authentication portal
+ */
+interface PortalUiOptions {
+    /**
+     * Theme name
+     */
+    theme?: string;
+    /**
+     * Logo URL
+     */
+    logoUrl?: string;
+    /**
+     * Custom CSS
+     */
+    customCss?: string;
+}
+/**
+ * Cookie configuration options
+ */
+interface CookieOptions {
+    /**
+     * Cookie domain (optional - used to create domain-specific config)
+     */
+    domain?: string;
+    /**
+     * Cookie path
+     * @default "/"
+     */
+    path?: string;
+    /**
+     * Cookie lifetime in seconds
+     * @default 86400 (24 hours)
+     */
+    lifetime?: number | string;
+    /**
+     * Whether to allow insecure cookies (HTTP)
+     * @default false
+     */
+    insecure?: boolean;
+    /**
+     * SameSite attribute
+     */
+    sameSite?: string;
+}
+/**
+ * Options for building an authentication portal
+ */
+interface BuildAuthenticationPortalOptions {
+    /**
+     * Portal name (referenced by portal_name in handlers)
+     */
+    name: string;
+    /**
+     * UI customization settings
+     */
+    ui?: PortalUiOptions;
+    /**
+     * Cookie settings
+     */
+    cookie?: CookieOptions;
+    /**
+     * Identity store names enabled for this portal
+     */
+    identityStores?: string[];
+    /**
+     * Identity provider names enabled for this portal
+     */
+    identityProviders?: string[];
+    /**
+     * Transform rules for user claims
+     */
+    transformUser?: Record<string, unknown>;
+}
+/**
+ * Build an authentication portal configuration
+ *
+ * @param options - Portal options
+ * @returns Validated authentication portal configuration
+ *
+ * @example
+ * ```typescript
+ * import { buildAuthenticationPortal } from "@.../caddy-api-client/plugins/caddy-security";
+ *
+ * const portal = buildAuthenticationPortal({
+ *   name: "myportal",
+ *   identityStores: ["localdb"],
+ *   identityProviders: ["keycloak"],
+ *   cookie: { domain: ".example.com", lifetime: "24h" },
+ * });
+ * ```
+ */
+declare function buildAuthenticationPortal(options: BuildAuthenticationPortalOptions): AuthenticationPortal;
+/**
+ * Access list entry configuration
+ */
+interface AccessListEntry {
+    /**
+     * Action: allow or deny
+     * @default "allow"
+     */
+    action?: "allow" | "deny";
+    /**
+     * Claim to check
+     * @example "roles"
+     */
+    claim: string;
+    /**
+     * Required values for the claim
+     */
+    values: string[];
+}
+/**
+ * Crypto key configuration
+ */
+interface CryptoKeyConfig {
+    /**
+     * Token name
+     * @default "access_token"
+     */
+    tokenName?: string;
+    /**
+     * Token source (header, cookie, query)
+     * @default "cookie"
+     */
+    source?: string;
+}
+/**
+ * Options for building an authorization policy
+ */
+interface BuildAuthorizationPolicyOptions {
+    /**
+     * Policy name (referenced by gatekeeper_name in handlers)
+     */
+    name: string;
+    /**
+     * Access control lists
+     */
+    accessLists?: AccessListEntry[];
+    /**
+     * Crypto key configuration for JWT validation
+     */
+    cryptoKey?: CryptoKeyConfig;
+    /**
+     * Bypass paths (no auth required)
+     */
+    bypass?: string[];
+}
+/**
+ * Build an authorization policy (gatekeeper) configuration
+ *
+ * @param options - Policy options
+ * @returns Validated authorization policy configuration
+ *
+ * @example
+ * ```typescript
+ * import { buildAuthorizationPolicy } from "@.../caddy-api-client/plugins/caddy-security";
+ *
+ * const policy = buildAuthorizationPolicy({
+ *   name: "admin-policy",
+ *   accessLists: [
+ *     { claim: "roles", values: ["admin", "editor"], action: "allow" },
+ *   ],
+ *   bypass: ["/health", "/metrics"],
+ * });
+ * ```
+ */
+declare function buildAuthorizationPolicy(options: BuildAuthorizationPolicyOptions): AuthorizationPolicy;
+/**
+ * Options for building a security configuration
+ */
+interface BuildSecurityConfigOptions {
+    /**
+     * Authentication portals
+     */
+    portals?: AuthenticationPortal[];
+    /**
+     * Authorization policies (gatekeepers)
+     */
+    policies?: AuthorizationPolicy[];
+    /**
+     * Identity stores
+     */
+    identityStores?: (LocalIdentityStore | LdapIdentityStore)[];
+    /**
+     * Identity providers
+     */
+    identityProviders?: (OAuth2IdentityProvider | OidcIdentityProvider)[];
+}
+/**
+ * Build a security configuration
+ *
+ * @param options - Configuration options
+ * @returns Validated security configuration
+ *
+ * @example
+ * ```typescript
+ * import {
+ *   buildSecurityConfig,
+ *   buildLocalIdentityStore,
+ *   buildAuthenticationPortal,
+ *   buildAuthorizationPolicy,
+ * } from "@.../caddy-api-client/plugins/caddy-security";
+ *
+ * const config = buildSecurityConfig({
+ *   identityStores: [
+ *     buildLocalIdentityStore({ path: "/etc/caddy/users.json" }),
+ *   ],
+ *   portals: [
+ *     buildAuthenticationPortal({
+ *       name: "myportal",
+ *       identityStores: ["local"],
+ *     }),
+ *   ],
+ *   policies: [
+ *     buildAuthorizationPolicy({
+ *       name: "mypolicy",
+ *       accessLists: [{ claim: "roles", values: ["user"] }],
+ *     }),
+ *   ],
+ * });
+ * ```
+ */
+declare function buildSecurityConfig(options: BuildSecurityConfigOptions): SecurityConfig;
+/**
+ * Options for building a complete security app configuration
+ */
+interface BuildSecurityAppOptions {
+    /**
+     * Security configuration
+     */
+    config: SecurityConfig;
+}
+/**
+ * Build a complete security app configuration
+ *
+ * Creates the full security app configuration for `/config/apps/security`.
+ *
+ * @param options - App options
+ * @returns Validated security app configuration
+ *
+ * @example
+ * ```typescript
+ * import { buildSecurityApp, buildSecurityConfig } from "@.../caddy-api-client/plugins/caddy-security";
+ *
+ * const app = buildSecurityApp({
+ *   config: buildSecurityConfig({
+ *     // ... config options
+ *   }),
+ * });
+ *
+ * // Apply to Caddy
+ * await client.request("/config/apps/security", {
+ *   method: "PUT",
+ *   body: JSON.stringify(app),
+ * });
+ * ```
+ */
+declare function buildSecurityApp(options: BuildSecurityAppOptions): SecurityApp;
+/**
+ * Options for building an authenticator handler
+ */
+interface BuildAuthenticatorHandlerOptions {
+    /**
+     * Name of the authentication portal defined in security app config
+     */
+    portalName: string;
+    /**
+     * Optional route matcher pattern
+     */
+    routeMatcher?: string;
+}
+/**
+ * Build an authenticator portal handler
+ *
+ * Creates a caddy-security authenticator handler that serves the login portal
+ * and handles credential validation.
+ *
+ * @param options - Handler options
+ * @returns Validated authenticator handler configuration
+ *
+ * @example
+ * ```typescript
+ * import { buildAuthenticatorHandler } from "@.../caddy-api-client/plugins/caddy-security";
+ *
+ * const handler = buildAuthenticatorHandler({
+ *   portalName: "myportal",
+ * });
+ *
+ * // Use in a route
+ * const route: CaddyRoute = {
+ *   match: [{ host: ["auth.example.com"] }],
+ *   handle: [handler],
+ *   terminal: true,
+ * };
+ * ```
+ */
+declare function buildAuthenticatorHandler(options: BuildAuthenticatorHandlerOptions): SecurityAuthenticatorHandler;
+/**
+ * Options for building an authorization handler
+ */
+interface BuildAuthorizationHandlerOptions {
+    /**
+     * Name of the gatekeeper/policy defined in security app config
+     */
+    gatekeeperName: string;
+    /**
+     * Optional route matcher pattern
+     */
+    routeMatcher?: string;
+}
+/**
+ * Build an authorization handler
+ *
+ * Creates a caddy-security authorization handler that validates JWT/PASETO
+ * tokens and enforces access control policies.
+ *
+ * This uses Caddy's built-in `authentication` handler with the caddy-security
+ * `authorizer` provider.
+ *
+ * @param options - Handler options
+ * @returns Validated authorization handler configuration
+ *
+ * @example
+ * ```typescript
+ * import { buildAuthorizationHandler } from "@.../caddy-api-client/plugins/caddy-security";
+ *
+ * const handler = buildAuthorizationHandler({
+ *   gatekeeperName: "mygatekeeper",
+ * });
+ *
+ * // Protect a route
+ * const route: CaddyRoute = {
+ *   match: [{ host: ["api.example.com"] }],
+ *   handle: [
+ *     handler,  // Check auth first
+ *     { handler: "reverse_proxy", upstreams: [{ dial: "localhost:3000" }] },
+ *   ],
+ *   terminal: true,
+ * };
+ * ```
+ */
+declare function buildAuthorizationHandler(options: BuildAuthorizationHandlerOptions): SecurityAuthorizationHandler;
+/**
+ * Options for building an authentication portal route
+ */
+interface BuildAuthenticationRouteOptions {
+    /**
+     * Host(s) to match for the authentication portal
+     */
+    hosts: string[];
+    /**
+     * Name of the authentication portal
+     */
+    portalName: string;
+    /**
+     * Route ID for tracking
+     */
+    routeId?: string;
+}
+/**
+ * Build a complete authentication portal route
+ *
+ * Creates a Caddy route that serves the authentication portal on specified hosts.
+ *
+ * @param options - Route options
+ * @returns Complete Caddy route configuration
+ *
+ * @example
+ * ```typescript
+ * import { buildAuthenticatorRoute } from "@.../caddy-api-client/plugins/caddy-security";
+ *
+ * const route = buildAuthenticatorRoute({
+ *   hosts: ["auth.example.com"],
+ *   portalName: "myportal",
+ *   routeId: "auth-portal",
+ * });
+ *
+ * await client.addRoute("https_server", route);
+ * ```
+ */
+declare function buildAuthenticatorRoute(options: BuildAuthenticationRouteOptions): CaddyRoute;
+/**
+ * Options for building a protected route
+ */
+interface BuildProtectedRouteOptions {
+    /**
+     * Host(s) to match
+     */
+    hosts: string[];
+    /**
+     * Path(s) to match (optional)
+     */
+    paths?: string[];
+    /**
+     * Name of the gatekeeper/policy for authorization
+     */
+    gatekeeperName: string;
+    /**
+     * Upstream dial address (host:port)
+     */
+    dial: string;
+    /**
+     * Route ID for tracking
+     */
+    routeId?: string;
+}
+/**
+ * Build a protected route with authorization
+ *
+ * Creates a Caddy route that requires valid JWT/PASETO tokens before
+ * proxying to the upstream service.
+ *
+ * @param options - Route options
+ * @returns Complete Caddy route configuration
+ *
+ * @example
+ * ```typescript
+ * import { buildProtectedRoute } from "@.../caddy-api-client/plugins/caddy-security";
+ *
+ * const route = buildProtectedRoute({
+ *   hosts: ["api.example.com"],
+ *   paths: ["/admin/*"],
+ *   gatekeeperName: "admin-policy",
+ *   dial: "localhost:3000",
+ *   routeId: "protected-admin-api",
+ * });
+ *
+ * await client.addRoute("https_server", route);
+ * ```
+ */
+declare function buildProtectedRoute(options: BuildProtectedRouteOptions): CaddyRoute;
+
+/**
+ * Caddy Security Configuration Templates
+ *
+ * IMPORTANT: These templates serve as the SINGLE SOURCE OF TRUTH for:
+ * 1. VSCode snippets (auto-generated from these templates)
+ * 2. Documentation examples
+ * 3. Test fixtures
+ *
+ * All templates are validated by templates.test.ts to ensure they produce
+ * valid Caddy configurations. If you add a new template, it will automatically:
+ * - Be tested for validity
+ * - Be exported as a VSCode snippet
+ *
+ * @see templates.test.ts - Validates all templates
+ * @see vscode-extension/scripts/generate-snippets.js - Generates snippets from templates
+ */
+interface TemplateVariable {
+    name: string;
+    description: string;
+    default: string;
+    placeholder?: string;
+}
+interface SecurityTemplate {
+    /** Template identifier (used as snippet prefix) */
+    id: string;
+    /** Display name */
+    name: string;
+    /** Description shown in IntelliSense */
+    description: string;
+    /** Category for grouping */
+    category: "identity-store" | "identity-provider" | "portal" | "policy" | "route" | "full-setup";
+    /** Variables that users can customize */
+    variables: TemplateVariable[];
+    /** Function that builds the configuration (used for testing) */
+    build: () => unknown;
+    /** Raw snippet body for VSCode (with $1, $2 placeholders) */
+    snippet: string[];
+}
+/**
+ * All available security templates.
+ * This is the SINGLE SOURCE OF TRUTH for snippets and tests.
+ */
+declare const SECURITY_TEMPLATES: SecurityTemplate[];
+/**
+ * Get templates by category
+ */
+declare function getTemplatesByCategory(category: SecurityTemplate["category"]): SecurityTemplate[];
+/**
+ * Get a template by ID
+ */
+declare function getTemplateById(id: string): SecurityTemplate | undefined;
+
+/**
+ * caddy-security plugin integration
+ *
+ * Provides types, schemas, and builders for the caddy-security plugin,
+ * enabling type-safe authentication and authorization configurations.
+ *
+ * @see https://github.com/greenpau/caddy-security
+ * @see https://docs.authcrunch.com
+ *
+ * @example
+ * ```typescript
+ * import {
+ *   buildAuthenticatorHandler,
+ *   buildAuthorizationHandler,
+ *   buildProtectedRoute,
+ *   SecurityAuthenticatorHandlerSchema,
+ * } from "@viaalink/caddy-api-client/plugins/caddy-security";
+ *
+ * // Build handlers with validation
+ * const authHandler = buildAuthenticatorHandler({ portalName: "myportal" });
+ * const authzHandler = buildAuthorizationHandler({ gatekeeperName: "mypolicy" });
+ *
+ * // Or build complete protected routes
+ * const protectedRoute = buildProtectedRoute({
+ *   hosts: ["api.example.com"],
+ *   gatekeeperName: "api-policy",
+ *   dial: "localhost:3000",
+ * });
+ * ```
+ *
+ * @packageDocumentation
+ */
+
+type index_AccessListEntry = AccessListEntry;
+declare const index_AuthenticationPortalSchema: typeof AuthenticationPortalSchema;
+declare const index_AuthorizationPolicySchema: typeof AuthorizationPolicySchema;
+type index_BuildAuthenticationPortalOptions = BuildAuthenticationPortalOptions;
+type index_BuildAuthenticationRouteOptions = BuildAuthenticationRouteOptions;
+type index_BuildAuthenticatorHandlerOptions = BuildAuthenticatorHandlerOptions;
+type index_BuildAuthorizationHandlerOptions = BuildAuthorizationHandlerOptions;
+type index_BuildAuthorizationPolicyOptions = BuildAuthorizationPolicyOptions;
+type index_BuildLdapIdentityStoreOptions = BuildLdapIdentityStoreOptions;
+type index_BuildLocalIdentityStoreOptions = BuildLocalIdentityStoreOptions;
+type index_BuildOAuth2ProviderOptions = BuildOAuth2ProviderOptions;
+type index_BuildOidcProviderOptions = BuildOidcProviderOptions;
+type index_BuildProtectedRouteOptions = BuildProtectedRouteOptions;
+type index_BuildSecurityAppOptions = BuildSecurityAppOptions;
+type index_BuildSecurityConfigOptions = BuildSecurityConfigOptions;
+type index_CookieOptions = CookieOptions;
+type index_CryptoKeyConfig = CryptoKeyConfig;
+declare const index_IdentityStore: typeof IdentityStore;
+declare const index_IdentityStoreSchema: typeof IdentityStoreSchema;
+declare const index_LdapIdentityStoreSchema: typeof LdapIdentityStoreSchema;
+type index_LdapServerConfig = LdapServerConfig;
+declare const index_LocalIdentityStoreSchema: typeof LocalIdentityStoreSchema;
+declare const index_OAuth2IdentityProviderSchema: typeof OAuth2IdentityProviderSchema;
+declare const index_OidcIdentityProviderSchema: typeof OidcIdentityProviderSchema;
+type index_PortalUiOptions = PortalUiOptions;
+declare const index_SECURITY_TEMPLATES: typeof SECURITY_TEMPLATES;
+declare const index_SecurityAppSchema: typeof SecurityAppSchema;
+declare const index_SecurityAuthenticatorHandlerSchema: typeof SecurityAuthenticatorHandlerSchema;
+declare const index_SecurityAuthorizationHandlerSchema: typeof SecurityAuthorizationHandlerSchema;
+declare const index_SecurityAuthorizerProvider: typeof SecurityAuthorizerProvider;
+declare const index_SecurityAuthorizerProviderSchema: typeof SecurityAuthorizerProviderSchema;
+declare const index_SecurityConfigSchema: typeof SecurityConfigSchema;
+declare const index_SecurityHandler: typeof SecurityHandler;
+declare const index_SecurityHandlerSchema: typeof SecurityHandlerSchema;
+type index_SecurityTemplate = SecurityTemplate;
+type index_TemplateVariable = TemplateVariable;
+declare const index_buildAuthenticationPortal: typeof buildAuthenticationPortal;
+declare const index_buildAuthenticatorHandler: typeof buildAuthenticatorHandler;
+declare const index_buildAuthenticatorRoute: typeof buildAuthenticatorRoute;
+declare const index_buildAuthorizationHandler: typeof buildAuthorizationHandler;
+declare const index_buildAuthorizationPolicy: typeof buildAuthorizationPolicy;
+declare const index_buildLdapIdentityStore: typeof buildLdapIdentityStore;
+declare const index_buildLocalIdentityStore: typeof buildLocalIdentityStore;
+declare const index_buildOAuth2Provider: typeof buildOAuth2Provider;
+declare const index_buildOidcProvider: typeof buildOidcProvider;
+declare const index_buildProtectedRoute: typeof buildProtectedRoute;
+declare const index_buildSecurityApp: typeof buildSecurityApp;
+declare const index_buildSecurityConfig: typeof buildSecurityConfig;
+declare const index_getTemplateById: typeof getTemplateById;
+declare const index_getTemplatesByCategory: typeof getTemplatesByCategory;
+declare namespace index {
+  export { type index_AccessListEntry as AccessListEntry, AuthenticationPortal$1 as AuthenticationPortal, index_AuthenticationPortalSchema as AuthenticationPortalSchema, AuthorizationPolicy$1 as AuthorizationPolicy, index_AuthorizationPolicySchema as AuthorizationPolicySchema, type index_BuildAuthenticationPortalOptions as BuildAuthenticationPortalOptions, type index_BuildAuthenticationRouteOptions as BuildAuthenticationRouteOptions, type index_BuildAuthenticatorHandlerOptions as BuildAuthenticatorHandlerOptions, type index_BuildAuthorizationHandlerOptions as BuildAuthorizationHandlerOptions, type index_BuildAuthorizationPolicyOptions as BuildAuthorizationPolicyOptions, type index_BuildLdapIdentityStoreOptions as BuildLdapIdentityStoreOptions, type index_BuildLocalIdentityStoreOptions as BuildLocalIdentityStoreOptions, type index_BuildOAuth2ProviderOptions as BuildOAuth2ProviderOptions, type index_BuildOidcProviderOptions as BuildOidcProviderOptions, type index_BuildProtectedRouteOptions as BuildProtectedRouteOptions, type index_BuildSecurityAppOptions as BuildSecurityAppOptions, type index_BuildSecurityConfigOptions as BuildSecurityConfigOptions, type index_CookieOptions as CookieOptions, type index_CryptoKeyConfig as CryptoKeyConfig, index_IdentityStore as IdentityStore, index_IdentityStoreSchema as IdentityStoreSchema, LdapIdentityStore$1 as LdapIdentityStore, index_LdapIdentityStoreSchema as LdapIdentityStoreSchema, type index_LdapServerConfig as LdapServerConfig, LocalIdentityStore$1 as LocalIdentityStore, index_LocalIdentityStoreSchema as LocalIdentityStoreSchema, OAuth2IdentityProvider$1 as OAuth2IdentityProvider, index_OAuth2IdentityProviderSchema as OAuth2IdentityProviderSchema, OidcIdentityProvider$1 as OidcIdentityProvider, index_OidcIdentityProviderSchema as OidcIdentityProviderSchema, type index_PortalUiOptions as PortalUiOptions, index_SECURITY_TEMPLATES as SECURITY_TEMPLATES, SecurityApp$1 as SecurityApp, index_SecurityAppSchema as SecurityAppSchema, SecurityAuthenticatorHandler$1 as SecurityAuthenticatorHandler, index_SecurityAuthenticatorHandlerSchema as SecurityAuthenticatorHandlerSchema, SecurityAuthorizationHandler$1 as SecurityAuthorizationHandler, index_SecurityAuthorizationHandlerSchema as SecurityAuthorizationHandlerSchema, index_SecurityAuthorizerProvider as SecurityAuthorizerProvider, index_SecurityAuthorizerProviderSchema as SecurityAuthorizerProviderSchema, SecurityConfig$1 as SecurityConfig, index_SecurityConfigSchema as SecurityConfigSchema, index_SecurityHandler as SecurityHandler, index_SecurityHandlerSchema as SecurityHandlerSchema, type index_SecurityTemplate as SecurityTemplate, type index_TemplateVariable as TemplateVariable, index_buildAuthenticationPortal as buildAuthenticationPortal, index_buildAuthenticatorHandler as buildAuthenticatorHandler, index_buildAuthenticatorRoute as buildAuthenticatorRoute, index_buildAuthorizationHandler as buildAuthorizationHandler, index_buildAuthorizationPolicy as buildAuthorizationPolicy, index_buildLdapIdentityStore as buildLdapIdentityStore, index_buildLocalIdentityStore as buildLocalIdentityStore, index_buildOAuth2Provider as buildOAuth2Provider, index_buildOidcProvider as buildOidcProvider, index_buildProtectedRoute as buildProtectedRoute, index_buildSecurityApp as buildSecurityApp, index_buildSecurityConfig as buildSecurityConfig, index_getTemplateById as getTemplateById, index_getTemplatesByCategory as getTemplatesByCategory };
+}
+
+export { AuthenticationPortalSchema as A, type BuildLocalIdentityStoreOptions as B, type CookieOptions as C, type BuildSecurityAppOptions as D, buildAuthenticatorHandler as E, buildAuthorizationHandler as F, type BuildAuthenticatorHandlerOptions as G, type BuildAuthorizationHandlerOptions as H, IdentityStoreSchema as I, buildAuthenticatorRoute as J, buildProtectedRoute as K, LocalIdentityStoreSchema as L, type BuildAuthenticationRouteOptions as M, type BuildProtectedRouteOptions as N, OAuth2IdentityProviderSchema as O, type PortalUiOptions as P, SECURITY_TEMPLATES as Q, getTemplatesByCategory as R, SecurityAuthenticatorHandlerSchema as S, getTemplateById as T, type SecurityTemplate as U, type TemplateVariable as V, SecurityAuthorizerProviderSchema as a, SecurityAuthorizationHandlerSchema as b, SecurityHandlerSchema as c, SecurityAppSchema as d, SecurityConfigSchema as e, AuthorizationPolicySchema as f, LdapIdentityStoreSchema as g, OidcIdentityProviderSchema as h, index as i, buildLocalIdentityStore as j, buildLdapIdentityStore as k, type BuildLdapIdentityStoreOptions as l, type LdapServerConfig as m, buildOAuth2Provider as n, buildOidcProvider as o, type BuildOAuth2ProviderOptions as p, type BuildOidcProviderOptions as q, buildAuthenticationPortal as r, buildAuthorizationPolicy as s, type BuildAuthenticationPortalOptions as t, type BuildAuthorizationPolicyOptions as u, type AccessListEntry as v, type CryptoKeyConfig as w, buildSecurityConfig as x, buildSecurityApp as y, type BuildSecurityConfigOptions as z };