Interface AuthenticatorOptions

interface AuthenticatorOptions {
    config: {
        authorization?: {
            default: "allow" | "deny";
            rules: {
                allow: string[];
                clientIds?: string[];
                deny: string[];
                id: string;
                principals?: string[];
                scopes?: string[];
            }[];
        };
        execution: {
            denoPath?: string;
            maxCodeBytes: number;
            maxConcurrent: number;
            maxLogBytes: number;
            maxQueue: number;
            maxResultBytes: number;
            maxSdkCalls: number;
            maxTimeoutMs: number;
            memoryMb: number;
            timeoutMs: number;
            typecheck: boolean;
        };
        http: {
            allowedHosts: string[];
            allowedOrigins: string[];
            host: string;
            maxBodyBytes: number;
            path: string;
            port: number;
            publicUrl?: string;
        };
        logging: {
            auditFailClosed?: boolean;
            auditFile?: string;
            file?: string;
            format?: "json"
            | "pretty";
            level?:
                | "info"
                | "warn"
                | "error"
                | "fatal"
                | "debug"
                | "trace"
                | "silent";
        };
        mcpAuth: {
            mode: "oauth"
            | "static-bearer"
            | "none";
            oauth?: {
                algorithms: string[];
                allowInsecureIssuer: boolean;
                audience?: string[];
                clockToleranceSec: number;
                introspection?: {
                    clientId: { env: string } | { secret: string };
                    clientSecret: { env: string } | { secret: string };
                    endpoint: string;
                };
                issuer: string;
                jwksUri?: string;
                principalIdKey?: { env: string }
                | { secret: string };
                requiredScopes: string[];
                resource?: string;
                scopesSupported?: string[];
            };
            staticBearer?: {
                tokens: {
                    principal: string;
                    scopes: string[];
                    token: { env: string }
                    | { secret: string };
                }[];
            };
            stdio: { principal: string; scopes: string[] };
        };
        upstream: {
            allowedOrigins: string[];
            baseUrl?: string;
            followRedirects: boolean;
            maxRedirects: number;
            maxRequestBytes: number;
            maxResponseBytes: number;
            timeoutMs: number;
        };
        upstreamAuth: {
            allowInsecureTokenUrl: boolean;
            provider: "service-identity";
            schemes: Record<
                string,
                {
                    apiKey?: { env: string }
                    | { secret: string };
                    audience?: string;
                    clientAuthMethod?: "client_secret_basic" | "client_secret_post";
                    clientId?: { env: string } | { secret: string };
                    clientSecret?: { env: string } | { secret: string };
                    password?: { env: string } | { secret: string };
                    scopes?: string[];
                    token?: { env: string } | { secret: string };
                    tokenUrl?: string;
                    username?: { env: string } | { secret: string };
                },
            >;
            secretsFile?: string;
        };
    };
    logs: Logs;
    registry: SecretRegistry;
    resolver: SecretResolver;
    resourceName: string;
    resourceUrl: URL;
}