/**
 * Session Auth — Ed25519 challenge-response authentication for SDN server.
 *
 * Implements the challenge-response flow matching sdn-server/internal/auth/handler.go:
 * 1. POST /api/auth/challenge with { client_pubkey_hex, ts }
 * 2. Sign the returned challenge bytes with Ed25519
 * 3. POST /api/auth/verify with { challenge_id, client_pubkey_hex, challenge, signature_hex }
 * 4. Server sets session cookie for subsequent requests
 */
import type { DerivedIdentity } from '../crypto/types';
/** Auth provider interface used by HttpTransport. */
export interface AuthProvider {
    /** Authenticate with the server (call before making authenticated requests). */
    authenticate(): Promise<void>;
    /** Get auth headers to include in requests. */
    getAuthHeaders(): Promise<Record<string, string>>;
    /** Whether the provider has an active session. */
    isAuthenticated(): boolean;
}
/**
 * Session-based authentication using Ed25519 challenge-response.
 *
 * After successful authentication, the server sets an HTTP-only session cookie.
 * Subsequent requests use `credentials: 'include'` to send the cookie automatically.
 */
export declare class SessionAuth implements AuthProvider {
    private baseUrl;
    private identity;
    private authenticated;
    private expiresAt;
    constructor(baseUrl: string, identity: DerivedIdentity);
    isAuthenticated(): boolean;
    authenticate(): Promise<void>;
    getAuthHeaders(): Promise<Record<string, string>>;
}
//# sourceMappingURL=auth.d.ts.map