import { ProviderConfig } from './types';
/**
 * The request a bot signature authorises. Either `url`, or both `uri` and
 * `aud`, must be supplied — a bot signature that names no request is a bearer
 * token, which is the thing this shape exists to prevent.
 */
export interface BotAuthRequest {
    method?: string;
    uri?: string;
    aud?: string;
    url?: string;
    body?: string | Buffer | null;
}
/**
 * CliWallet - Manages wallet operations for CLI/bot contexts
 *
 * Uses Epistery's domain configuration system:
 * - Domain configs stored in ~/.epistery/{domain}/config.ini
 * - Each domain has its own wallet (like server-side)
 * - Default domain configurable in ~/.epistery/config.ini [cli] section
 * - Automatic wallet creation on initialize
 *
 * This matches the server-side model where each domain has a wallet,
 * making CLI usage consistent with server architecture.
 */
export interface KeyExchangeRequest {
    signerAddress: string;
    signerPublicKey: string;
    contractAddress?: string | null;
    challenge: string;
    message: string;
    signature: string;
    walletSource: string;
}
export interface KeyExchangeResponse {
    serverAddress: string;
    serverPublicKey: string;
    services: string[];
    challenge: string;
    signature: string;
    identified: boolean;
    authenticated?: boolean;
    profile?: any;
}
export interface SessionInfo {
    domain: string;
    cookie: string;
    authenticated: boolean;
    timestamp: string;
}
export declare class CliWallet {
    private config;
    private domainName;
    private domainConfig;
    private wallet;
    address: string;
    publicKey: string;
    private constructor();
    /**
     * Get the default domain from config.ini [cli] section
     */
    static getDefaultDomain(): Promise<string>;
    /**
     * Set the default domain in config.ini [cli] section.
     *
     * Loads the root config first so the rest of it ([profile], [default.provider],
     * …) is preserved on save. (Before the async migration, Config did not
     * auto-load on construction, so this wrote {cli:…} over the whole root file.)
     */
    static setDefaultDomain(domain: string): Promise<void>;
    /**
     * Initialize a new domain with wallet
     * Creates ~/.epistery/{domain}/config.ini with new wallet
     */
    static initialize(domain: string, provider?: ProviderConfig): Promise<CliWallet>;
    /**
     * Point an already-initialized domain at a different chain.
     *
     * Only the domain's [provider] block changes — the wallet (and therefore the
     * address) is chain-agnostic and is left exactly as it is. Returns the
     * previous provider config so callers can report the change.
     */
    static setChain(domain: string, provider: ProviderConfig): Promise<ProviderConfig | undefined>;
    /**
     * Load domain wallet from config
     * Throws if domain doesn't exist - use initialize() first
     */
    static load(domain?: string): Promise<CliWallet>;
    /**
     * Get domain name
     */
    getDomain(): string;
    /**
     * Get provider info
     */
    getProvider(): ProviderConfig | undefined;
    /**
     * Sign a message
     */
    sign(message: string): Promise<string>;
    /**
     * Perform key exchange with an Epistery server
     * Automatically saves session cookie to domain config
     */
    performKeyExchange(serverUrl: string): Promise<KeyExchangeResponse>;
    /**
     * Get saved session for a specific server URL
     */
    getSession(serverUrl: string): SessionInfo | null;
    /**
     * Save session info to domain directory, keyed by server URL
     */
    private saveSession;
    /**
     * Clear saved session for a server URL
     */
    clearSession(serverUrl: string): void;
    /**
     * Get session file path for a server URL
     * Hashes the server URL to create a safe filename
     */
    private getSessionFilePath;
    /**
     * Create bot authentication header for a specific request.
     *
     * The signature covers the request: method, URI, audience host and a digest
     * of the body, plus a timestamp and a single-use nonce. A header minted for
     * one call cannot be replayed against a different endpoint, a different host,
     * or the same endpoint with a different body.
     *
     * The signed bytes are built by `client/bot-auth-message.mjs`, which is also
     * what the server verifier uses. Never inline the message here.
     *
     * Format: Authorization: Bot <base64-json>
     *
     * @param req.method  HTTP method
     * @param req.uri     path + query exactly as it will be sent
     * @param req.url     alternative to uri: a full URL, from which the uri and
     *                    audience host are derived
     * @param req.aud     audience host; defaults to the host in `req.url`
     * @param req.body    request body as sent — string, Buffer or undefined
     */
    createBotAuthHeader(req?: BotAuthRequest): Promise<string>;
    /**
     * Export wallet data (for migration or backup)
     */
    toJSON(): {
        domain: string;
        address: string;
        publicKey: string;
        provider: ProviderConfig | undefined;
    };
}
//# sourceMappingURL=CliWallet.d.ts.map