Function parseConfig

Returns {
    authorization?: {
        default: "allow" | "deny";
        rules: {
            allow: string[];
            clientIds?: string[];
            deny: string[];
            id: string;
            principals?: string[];
            scopes?: string[];
        }[];
    };
    execution: {
        denoPath?: string;
        maxCodeBytes: number;
        maxConcurrent: number;
        maxLogBytes: number;
        maxQueue: number;
        maxResultBytes: number;
        maxSdkCalls: number;
        maxTimeoutMs: number;
        memoryMb: number;
        timeoutMs: number;
        typecheck: boolean;
    };
    http: {
        allowedHosts: string[];
        allowedOrigins: string[];
        host: string;
        maxBodyBytes: number;
        path: string;
        port: number;
        publicUrl?: string;
    };
    logging: {
        auditFailClosed?: boolean;
        auditFile?: string;
        file?: string;
        format?: "json"
        | "pretty";
        level?: "info" | "warn" | "error" | "fatal" | "debug" | "trace" | "silent";
    };
    mcpAuth: {
        mode: "oauth"
        | "static-bearer"
        | "none";
        oauth?: {
            algorithms: string[];
            allowInsecureIssuer: boolean;
            audience?: string[];
            clockToleranceSec: number;
            introspection?: {
                clientId: { env: string } | { secret: string };
                clientSecret: { env: string } | { secret: string };
                endpoint: string;
            };
            issuer: string;
            jwksUri?: string;
            principalIdKey?: { env: string }
            | { secret: string };
            requiredScopes: string[];
            resource?: string;
            scopesSupported?: string[];
        };
        staticBearer?: {
            tokens: {
                principal: string;
                scopes: string[];
                token: { env: string }
                | { secret: string };
            }[];
        };
        stdio: { principal: string; scopes: string[] };
    };
    upstream: {
        allowedOrigins: string[];
        baseUrl?: string;
        followRedirects: boolean;
        maxRedirects: number;
        maxRequestBytes: number;
        maxResponseBytes: number;
        timeoutMs: number;
    };
    upstreamAuth: {
        allowInsecureTokenUrl: boolean;
        provider: "service-identity";
        schemes: Record<
            string,
            {
                apiKey?: { env: string }
                | { secret: string };
                audience?: string;
                clientAuthMethod?: "client_secret_basic" | "client_secret_post";
                clientId?: { env: string } | { secret: string };
                clientSecret?: { env: string } | { secret: string };
                password?: { env: string } | { secret: string };
                scopes?: string[];
                token?: { env: string } | { secret: string };
                tokenUrl?: string;
                username?: { env: string } | { secret: string };
            },
        >;
        secretsFile?: string;
    };
}

validated configuration