import { ProviderConfig, KeyExchangeResponse } from './types';
/**
 * The request a bot signature authorises. Either `url`, or both `uri` and
 * `aud`, must be supplied — a bot signature that names no request is a bearer
 * token, which is the thing this shape exists to prevent.
 */
export interface BotAuthRequest {
    method?: string;
    uri?: string;
    aud?: string;
    url?: string;
    body?: string | Buffer | null;
}
/**
 * CliWallet - Manages wallet operations for CLI/bot contexts
 *
 * Uses Epistery's domain configuration system:
 * - Domain configs stored in ~/.epistery/{domain}/config.ini
 * - Each domain has its own wallet (like server-side)
 * - Default domain configurable in ~/.epistery/config.ini [cli] section
 * - Automatic wallet creation on initialize
 *
 * This matches the server-side model where each domain has a wallet,
 * making CLI usage consistent with server architecture.
 */
export interface SessionInfo {
    domain: string;
    cookie: string;
    authenticated: boolean;
    timestamp: string;
}
export declare class CliWallet {
    private config;
    private domainName;
    private domainConfig;
    private wallet;
    address: string;
    publicKey: string;
    private constructor();
    /**
     * Get the default domain from config.ini [cli] section
     */
    static getDefaultDomain(): Promise<string>;
    /**
     * Set the default domain in config.ini [cli] section.
     *
     * Loads the root config first so the rest of it ([profile], [default.provider],
     * …) is preserved on save. (Before the async migration, Config did not
     * auto-load on construction, so this wrote {cli:…} over the whole root file.)
     */
    static setDefaultDomain(domain: string): Promise<void>;
    /**
     * Initialize a new domain with wallet
     * Creates ~/.epistery/{domain}/config.ini with new wallet
     */
    static initialize(domain: string, provider?: ProviderConfig): Promise<CliWallet>;
    /**
     * Point an already-initialized domain at a different chain.
     *
     * Only the domain's [provider] block changes — the wallet (and therefore the
     * address) is chain-agnostic and is left exactly as it is. Returns the
     * previous provider config so callers can report the change.
     */
    static setChain(domain: string, provider: ProviderConfig): Promise<ProviderConfig | undefined>;
    /**
     * Load domain wallet from config
     * Throws if domain doesn't exist - use initialize() first
     */
    static load(domain?: string): Promise<CliWallet>;
    /**
     * Get domain name
     */
    getDomain(): string;
    /**
     * Get provider info
     */
    getProvider(): ProviderConfig | undefined;
    /**
     * Sign a message
     */
    sign(message: string): Promise<string>;
    readonly canPeerEncrypt = true;
    /** ethers-Signer-shaped alias of sign(), for member code (storage, inbox,
     *  group commits) that takes a wallet. */
    signMessage(message: string): Promise<string>;
    /** Raw ECDH shared secret (32-byte X) with a peer's uncompressed secp256k1
     *  public key — the value the TreeKEM key schedule consumes. */
    computeSharedSecret(peerPublicKey: string, _ethers?: unknown): Promise<Uint8Array>;
    /**
     * Perform key exchange with an Epistery server
     * Automatically saves session cookie to domain config
     */
    performKeyExchange(serverUrl: string): Promise<KeyExchangeResponse>;
    /** The host's handshake URL, from its well-known discovery answer. */
    static discoverConnect(baseUrl: string): Promise<string>;
    /**
     * The saved session for a server URL, or null when there is none (or the
     * file is not a session). Sessions are files of the wallet's domain config —
     * read through Config, wherever that config lives.
     */
    getSession(serverUrl: string): Promise<SessionInfo | null>;
    /** Save a session as a file of the domain config, keyed by server URL. */
    private saveSession;
    /** One file per server, named by a digest of its URL: `session-<md5>.json`. */
    private static sessionFileName;
    /**
     * Create bot authentication header for a specific request.
     *
     * The signature covers the request: method, URI, audience host and a digest
     * of the body, plus a timestamp and a single-use nonce. A header minted for
     * one call cannot be replayed against a different endpoint, a different host,
     * or the same endpoint with a different body.
     *
     * The signed bytes are built by `client/bot-auth-message.mjs`, which is also
     * what the server verifier uses. Never inline the message here.
     *
     * Format: Authorization: Bot <base64-json>
     *
     * @param req.method  HTTP method
     * @param req.uri     path + query exactly as it will be sent
     * @param req.url     alternative to uri: a full URL, from which the uri and
     *                    audience host are derived
     * @param req.aud     audience host; defaults to the host in `req.url`
     * @param req.body    request body as sent — string, Buffer or undefined
     */
    createBotAuthHeader(req?: BotAuthRequest): Promise<string>;
    /**
     * Export wallet data (for migration or backup)
     */
    toJSON(): {
        domain: string;
        address: string;
        publicKey: string;
        provider: ProviderConfig | undefined;
    };
}
//# sourceMappingURL=CliWallet.d.ts.map