/**
 * strategies/vocabulary — the ONE list of strategy names and config keys.
 *
 * Every name a deployment can write is here, including the ones a later
 * release reads. That is deliberate: a key this release does not read yet is
 * REFUSED by name ("not in this release"), never ignored, because a setting
 * that silently does nothing is a deployment that believes it is protected.
 */
/** The five ways of proving who is calling. One per deployment. */
export type IdentityStrategyName = 'open' | 'oidc-token' | 'proxy-token' | 'directory-password' | 'local-password';
export declare const IDENTITY_STRATEGIES: readonly IdentityStrategyName[];
/** The strategies this release can start. The others are refused by name. */
export declare const STRATEGIES_IN_THIS_RELEASE: readonly IdentityStrategyName[];
/** How an environment value becomes a config value. */
export type EnvReading = 'text' | 'strategy' | 'clients' | 'list' | 'claim-path' | 'whole-number';
/** One key this release reads: its env name, its config field, how it parses. */
export interface ConfigKey {
    readonly env: string;
    readonly field: string;
    readonly reading: EnvReading;
    /** The strategies that read it (absent for `IDENTITY_STRATEGY`). */
    readonly owners?: readonly IdentityStrategyName[];
}
/** The keys this release reads, each owned by the strategies that read it (and `IDENTITY_STRATEGY`). */
export declare const KEYS_IN_THIS_RELEASE: readonly ConfigKey[];
/** What a key a later release reads belongs to — named in its refusal. */
export type LaterFeature = 'the first-token report' | 'the role gate' | 'the proxy sign-out link';
/**
 * Keys named in the design and read by a later release. Refused by name.
 *
 * (Browser sign-in for `oidc-token` has moved in, and with it the two boot
 * refusals it needs — design §3 H1, door hardening, and §5.3, `IDENTITY_AUDIENCE`
 * never equal to `IDENTITY_CLIENT_ID`: see `browserChoice.ts · browserSettings`.)
 */
export declare const KEYS_IN_A_LATER_RELEASE: Readonly<Record<string, LaterFeature>>;
/** `issuer` → `IDENTITY_ISSUER (issuer)`: both spellings, so either reader finds it. */
export declare function keyLabel(field: string): string;
//# sourceMappingURL=vocabulary.d.ts.map