/**
 * Epistery Config — async path-based configuration store.
 *
 * Filesystem-like config management, now async so the same interface can be
 * served by a remote authority:
 * - setPath('/') → ~/.epistery/config.ini
 * - setPath('/domain') → ~/.epistery/domain/config.ini
 * - setPath('/.ssl/domain') → ~/.epistery/.ssl/domain/config.ini
 *
 * `Config` is a thin facade that picks a backend at construction:
 *   - if the local bootstrap ~/.epistery/config.ini has [authority] url=…,
 *     or EPISTERY_CONFIG_URL is set → RemoteConfig (talks to epistery-authority)
 *   - otherwise → LocalConfig (the filesystem store; unchanged semantics)
 *
 * Every IO method is async because a remote/HSM custodian cannot answer
 * synchronously. `data` holds the snapshot from the last awaited load()/setPath().
 *
 * Usage:
 *   const config = new Config('epistery');
 *   await config.setPath('/wiki.rootz.global');   // loads
 *   config.data.verified = true;
 *   await config.save();
 */
export interface ConfigStore {
    data: any;
    getPath(): string;
    setPath(path: string): Promise<void>;
    load(): Promise<void>;
    read(path: string): Promise<any>;
    save(): Promise<void>;
    readFile(filename: string): Promise<Buffer>;
    writeFile(filename: string, data: string | Buffer): Promise<void>;
    exists(): Promise<boolean>;
    listPaths(): Promise<string[]>;
}
/**
 * LocalConfig — the filesystem backend under ~/.epistery. This is the original
 * Config behavior, with all IO made async. It is also what the epistery-authority
 * server mounts as its own storage backend (one implementation, not two).
 *
 * The tree holds wallet mnemonics and private keys in cleartext, so every
 * directory it creates is 0700 and every file it writes is 0600 — and a file
 * that already exists too open is tightened on write (see utils/Permissions).
 * `epistery permissions [--fix]` audits/repairs what is already on disk.
 */
export declare class LocalConfig implements ConfigStore {
    readonly rootName: string;
    readonly homeDir: string;
    readonly configDir: string;
    private currentPath;
    private currentDir;
    private currentFile;
    data: any;
    constructor(rootName?: string);
    private initializeSync;
    getPath(): string;
    setPath(path: string): Promise<void>;
    load(): Promise<void>;
    read(path: string): Promise<any>;
    save(): Promise<void>;
    readFile(filename: string): Promise<Buffer>;
    writeFile(filename: string, data: string | Buffer): Promise<void>;
    exists(): Promise<boolean>;
    listPaths(): Promise<string[]>;
}
/**
 * RemoteConfig — HTTP client to an epistery-authority server. Implements the
 * same ConfigStore interface; the authority mounts a LocalConfig behind it.
 *
 * Auth is the rivet key-exchange: the machine signs a challenge with its
 * device key, and the authority issues a bearer token (see epistery-authority
 * lib/auth.mjs). In Phase 1 config data (including the wallet mnemonic) is
 * still served; Phase 2 splits public from secret and adds /sign/*.
 */
export declare class RemoteConfig implements ConfigStore {
    private readonly baseUrl;
    private readonly machineAddress;
    private readonly signChallenge;
    data: any;
    private currentPath;
    private token;
    private readonly basePath;
    constructor(baseUrl: string, machineAddress: string, signChallenge: (message: string) => Promise<string>, basePath?: string);
    getPath(): string;
    /** Map a client path into the authority's namespace under basePath. */
    private prefixed;
    private authenticate;
    private authedFetch;
    setPath(path: string): Promise<void>;
    load(): Promise<void>;
    read(path: string): Promise<any>;
    save(): Promise<void>;
    private filePrefix;
    readFile(filename: string): Promise<Buffer>;
    writeFile(filename: string, data: string | Buffer): Promise<void>;
    exists(): Promise<boolean>;
    listPaths(): Promise<string[]>;
}
/**
 * Config — the public facade. `new Config()` selects the backend synchronously
 * (reading only the local bootstrap), then delegates every async operation.
 * Existing call sites change only by adding `await`.
 */
export declare class Config implements ConfigStore {
    private readonly backend;
    private readonly local;
    constructor(rootName?: string);
    /** Read the local bootstrap config.ini synchronously (authority selection only). */
    private static readBootstrap;
    private static resolveAuthorityUrl;
    /**
     * Build the machine signer used to authenticate to the authority. The machine
     * rivet key lives in the local bootstrap [authority] section (Phase 1). A
     * future TPM-backed key replaces this without changing the call site.
     */
    private static machineSigner;
    get rootName(): string;
    get homeDir(): string;
    get configDir(): string;
    get data(): any;
    set data(v: any);
    getPath(): string;
    setPath(path: string): Promise<void>;
    load(): Promise<void>;
    read(path: string): Promise<any>;
    save(): Promise<void>;
    readFile(filename: string): Promise<Buffer>;
    writeFile(filename: string, data: string | Buffer): Promise<void>;
    exists(): Promise<boolean>;
    listPaths(): Promise<string[]>;
}
//# sourceMappingURL=Config.d.ts.map