import type { Nullable } from "../util.ts";
export declare const DEFAULT_CONFIG_FILENAME = ".hblog.json";
/**
 * The shape of the optional `~/.hblog.json` config file. Every field is optional; unknown keys in the file are ignored. The file deliberately carries no `otp` field - a
 * one-time passcode is, by definition, single-use and time-bound, so it only ever comes from the `--otp` flag or the `HBLOG_OTP` environment variable, never from a
 * persisted file.
 *
 * @property host     - The hostname or IP of the homebridge-config-ui-x server.
 * @property password - The account password, for username/password authentication.
 * @property port     - The TCP port the server listens on.
 * @property tls      - Whether to use the secure (`https`/`wss`) schemes.
 * @property token    - A pre-acquired bearer token, used verbatim.
 * @property username - The account username, for username/password authentication.
 *
 * @category Log Client
 */
export interface HblogConfigFile {
    readonly host?: string;
    readonly password?: string;
    readonly port?: number;
    readonly tls?: boolean;
    readonly token?: string;
    readonly username?: string;
}
/**
 * The environment-variable slice consulted by {@link resolveConnection}. The CLI reads these from `process.env` (`HBLOG_HOST`, `HBLOG_PORT`, `HBLOG_USER`, `HBLOG_PASS`,
 * `HBLOG_TOKEN`, `HBLOG_OTP`) and passes them here as already-extracted values so the resolver itself touches no globals.
 *
 * @property host     - The `HBLOG_HOST` value.
 * @property otp      - The `HBLOG_OTP` value (a one-time passcode).
 * @property password - The `HBLOG_PASS` value.
 * @property port     - The `HBLOG_PORT` value (still a string here; parsed during resolution).
 * @property token    - The `HBLOG_TOKEN` value.
 * @property username - The `HBLOG_USER` value.
 *
 * @category Log Client
 */
export interface HblogEnv {
    readonly host?: string;
    readonly otp?: string;
    readonly password?: string;
    readonly port?: string;
    readonly token?: string;
    readonly username?: string;
}
/**
 * The command-line connection flags consulted by {@link resolveConnection}. These are the parsed `--host`, `--port`, `--tls`, `--user`, `--pass`, `--token`, and `--otp`
 * values. They take the highest precedence in the merge.
 *
 * @property host     - The `--host` value.
 * @property otp      - The `--otp` value.
 * @property password - The `--pass` value.
 * @property port     - The `--port` value (already parsed to a number by the flag parser, or omitted).
 * @property tls      - The `--tls` value.
 * @property token    - The `--token` value.
 * @property username - The `--user` value.
 *
 * @category Log Client
 */
export interface HblogConnectionFlags {
    readonly host?: string;
    readonly otp?: string;
    readonly password?: string;
    readonly port?: number;
    readonly tls?: boolean;
    readonly token?: string;
    readonly username?: string;
}
/**
 * The fully-resolved connection produced by {@link resolveConnection}: the connection target plus the credential material the CLI uses to build a
 * {@link logclient/types!LogClientCredentials | LogClientCredentials} discriminated union. `host`, `port`, and `tls` always carry a concrete value (defaults applied);
 * the credential fields are {@link Nullable} because none, some, or all of them may have been supplied across the three sources.
 *
 * @property host     - The resolved hostname or IP.
 * @property otp      - The resolved one-time passcode, or `null` when none was supplied.
 * @property password - The resolved password, or `null` when none was supplied.
 * @property port     - The resolved TCP port.
 * @property tls      - The resolved TLS flag.
 * @property token    - The resolved bearer token, or `null` when none was supplied.
 * @property username - The resolved username, or `null` when none was supplied.
 *
 * @category Log Client
 */
export interface ResolvedConnection {
    readonly host: string;
    readonly otp: Nullable<string>;
    readonly password: Nullable<string>;
    readonly port: number;
    readonly tls: boolean;
    readonly token: Nullable<string>;
    readonly username: Nullable<string>;
}
/**
 * Options accepted by {@link loadConfigFile}: the injectable filesystem and warning seams. All default to the real Node implementations / a `process.stderr` writer, so a
 * caller (the CLI) can omit them in production and a test can supply doubles.
 *
 * @property readFile - Reads the file's UTF-8 text. Defaults to `node:fs/promises` `readFile`. A rejection whose `code` is `ENOENT` is treated as "file absent."
 * @property stat     - Stats the file for its permission mode. Defaults to `node:fs/promises` `stat`. Used only for the group/other-readable security warning.
 * @property warn     - Sink for the single one-line security warning. Defaults to a `process.stderr` writer. Injected so a test asserts the warning without capturing
 *                      real stderr.
 *
 * @category Log Client
 */
export interface LoadConfigFileOptions {
    readonly readFile?: (path: string) => Promise<string>;
    readonly stat?: (path: string) => Promise<{
        readonly mode: number;
    }>;
    readonly warn?: (message: string) => void;
}
/**
 * Load and parse the optional `~/.hblog.json` config file.
 *
 * The file is optional: when it does not exist (ENOENT) this resolves to `undefined` silently. Every other failure is thrown as a clear, actionable error naming the
 * path: a non-ENOENT read failure (a permission or I/O fault), a file that cannot be parsed as JSON, or a file whose top-level value is not a JSON object. Recognized
 * keys ({@link HblogConfigFile}) are picked out by type (a wrong-typed field is ignored, not coerced); any unknown key is ignored. As a security courtesy, if the file's
 * permissions allow group or other access (`mode & 0o077`), a single one-line warning recommending `chmod 600` is emitted through the `warn` seam, because the file may
 * store a password or a long-lived token in plaintext.
 *
 * @param path    - The absolute path of the config file to load (the CLI resolves `~/.hblog.json`, or honors `HBLOG_CONFIG`).
 * @param options - The injectable filesystem and warning seams. See {@link LoadConfigFileOptions}.
 *
 * @returns The parsed {@link HblogConfigFile}, or `undefined` when the file is absent (ENOENT).
 *
 * @throws `Error` when the file exists but cannot be read (a non-ENOENT read failure), contains malformed JSON, or whose top-level value is not a JSON object.
 *
 * @category Log Client
 */
export declare function loadConfigFile(path: string, options?: LoadConfigFileOptions): Promise<HblogConfigFile | undefined>;
/**
 * Resolve the absolute path of the config file to load.
 *
 * The `HBLOG_CONFIG` environment variable overrides everything when set to a non-empty value (handy for tests and non-standard layouts); otherwise the default
 * {@link DEFAULT_CONFIG_FILENAME} (`.hblog.json`) under the supplied home directory is used. Home-dir only - there is no project-local config file, so a config carrying
 * a password or token is never tempting to commit alongside a plugin's source. The join uses a single forward slash, which both POSIX and Windows accept in a path passed
 * to `readFile`, so no `node:path` import is needed on this hot setup path.
 *
 * @param sources         - The path inputs.
 * @param sources.env     - The environment map; only `HBLOG_CONFIG` is consulted.
 * @param sources.homedir - The user's home directory, the anchor for the default config-file path.
 *
 * @returns The absolute path to load the config file from.
 *
 * @category Log Client
 */
export declare function resolveConfigPath(sources: {
    env: NodeJS.ProcessEnv;
    homedir: string;
}): string;
/**
 * Resolve the three configuration sources into a single {@link ResolvedConnection}, applying the precedence flags > environment > file > defaults.
 *
 * This is a PURE function: it reads only its arguments and allocates only the result, performing no I/O. The caller is responsible for having loaded the file (via
 * {@link loadConfigFile}), extracted the environment slice, and parsed the flags. `host`, `port`, and `tls` always resolve to a concrete value (their defaults are
 * `localhost`, `8581`, and `false`); the credential fields resolve to `null` when no source supplied them, leaving the CLI to decide which
 * {@link logclient/types!LogClientCredentials | LogClientCredentials} arm the resolved material implies. The `port` from the environment is a string, so it is
 * parsed here; a non-numeric `HBLOG_PORT` is ignored (falls through to the next source) rather than producing a `NaN` port.
 *
 * @param sources       - The three configuration sources.
 * @param sources.env   - The environment slice. See {@link HblogEnv}.
 * @param sources.file  - The loaded config file, or `undefined` when absent. See {@link HblogConfigFile}.
 * @param sources.flags - The parsed command-line flags. See {@link HblogConnectionFlags}.
 *
 * @returns The fully-resolved connection.
 *
 * @category Log Client
 */
export declare function resolveConnection(sources: {
    env: HblogEnv;
    file: HblogConfigFile | undefined;
    flags: HblogConnectionFlags;
}): ResolvedConnection;
//# sourceMappingURL=config.d.ts.map