/** A pending by-name invite: armed by `/dap invite <name>` for a user not
 *  yet on the hub; delivered automatically when that name comes online. */
export interface PendingInvite {
    name: string;
    channel: string;
}
/** Optional persisted settings: ~/.dap/config.json (all fields optional). */
export interface DapFileConfig {
    url?: string;
    name?: string;
    keyPath?: string;
    channelsFile?: string;
    /** Default rooms: ensured (keygen if unknown) and auto-joined after connect. */
    channels?: string[];
    /** LEGACY hub-issued client secret: one shared field for the whole host.
    *  Superseded by `clientSecrets` — kept so single-identity hosts upgrade
    *  without re-enrolling, and wiped once a per-identity entry replaces it. */
    clientSecret?: string;
    /** Hub-issued client secrets PER IDENTITY, keyed by the identity's key
    *  file path (one key file = one identity = one name). The hub binds each
    *  issued secret to the hello name it enrolled under, so two identities
    * sharing one field dial with a secret the hub rejects — this map gives
    * every identity on the host its own slot. The master secret is never
    *  persisted. */
    clientSecrets?: Record<string, string>;
    /** Armed invite-by-name entries; removed once delivered. */
    invites?: PendingInvite[];
}
export declare const DEFAULT_URL = "ws://127.0.0.1:8787/ws";
export declare const optStr: (v: unknown) => string | undefined;
/** Read ~/.dap/config.json; a missing or invalid file counts as absent.
 *  `invites` is normalized to [] (files written before the key lack it). */
export declare function readDapConfig(file?: string): DapFileConfig;
/** Merge `update` into ~/.dap/config.json (read-modify-write, mkdir on
 *  demand): dap_connect persists host/name/default-rooms so the next
 *  launch auto-connects with the same identity. `invites` is the
 *  authoritative list — delivered entries are removed by the caller.
 *  A `clientSecret` string with an `identityKey` upserts that identity's
 *  slot in `clientSecrets` (and retires the legacy shared field — a fresh
 *  enrollment supersedes any cached one); without an `identityKey` it
 *  writes the legacy top-level field (standalone DapClient back-compat).
 *  `null` deletes the identity's slot AND the legacy field: a stale wipe
 *  must clear every path a later dial could re-resolve the secret from. */
export declare function persistDapConfig(update: {
    url?: string;
    name?: string;
    channels?: string[];
    invites?: PendingInvite[];
    /** A string upserts; null deletes the key (stale-secret wipe). */
    clientSecret?: string | null;
    /** Which identity's clientSecrets slot the update targets (the resolved
     *  keyPath — one key file per identity). */
    identityKey?: string;
}, file?: string): void;
export interface SettingsOverrides {
    url?: string;
    keyPath?: string;
    name?: string;
    channelsFile?: string;
    clientSecret?: string;
}
export interface DapSettings {
    url: string;
    keyPath: string;
    name?: string;
    channelsFile: string;
    clientSecret?: string;
    /** Where clientSecret came from: 'env' (DAP_CLIENT_SECRET or explicit
     *  override — user intent) | 'config' (persisted cache) | undefined. */
    clientSecretSource?: ClientSecretSource;
}
/** Provenance of a resolved clientSecret: 'env' = DAP_CLIENT_SECRET or an
 *  explicit override (user intent — never eligible for the stale-cache
 *  wipe); 'config' = persisted ~/.dap/config.json cache (a hub 401 may
 *  recover it via one enroll-mode re-enroll). */
export type ClientSecretSource = 'env' | 'config';
/** Default identity file is derived from the agent name:
 *  ~/.dap/keys/<name>.key — auto-generated by loadOrCreateKeys, so a second
 *  agent on the same machine needs nothing but DAP_AGENT_NAME (or its own
 *  generated name) to get its own identity. */
export declare function defaultKeyPath(name: string | undefined): string;
/** Random, readable default agent name: <sanitized hostname>-<4 hex>.
 *  Pure — every call draws fresh (two draws never collide in tests). */
export declare function randomAgentName(): string;
export declare function defaultAgentName(): string;
/** Per-identity client secret lookup: the identity's own clientSecrets slot
 *  first, then the legacy shared field (single-identity hosts predating
 *  per-identity storage keep connecting without re-enrolling). */
export declare function clientSecretForKey(file: DapFileConfig, keyPath: string): string | undefined;
/** Precedence: explicit override > env var > ~/.dap/config.json > defaults.
 *  channelsFile defaults to ~/.dap/channels.json so no env is needed at all. */
export declare function resolveDapSettings(overrides?: SettingsOverrides): DapSettings;