/**
 * Join client for zero-knowledge cluster bootstrap.
 *
 * Provides the joiner-side logic for `kici-admin join`:
 * 1. Connect to Platform relay (WS) or direct peer (HTTP POST)
 * 2. Send join.request with the join token
 * 3. Receive join.response with encrypted config bundle
 * 4. Decrypt bundle using token-derived AES-256-GCM key
 * 5. Write decrypted config as local YAML file
 *
 * The token carries routing info (cleartext for Platform relay) and a secret
 * (used for HKDF key derivation). Only the joiner and the token creator
 * can derive the encryption key -- the Platform relay sees only ciphertext.
 */
import { type JoinRequest, type JoinResponse } from '@kici-dev/engine';
import type { ConfigBundle } from './join-handler.js';
interface JoinClientOptions {
    token: string;
    /** Platform WebSocket URL for relay mode (e.g., wss://platform.kici.dev/ws) */
    platformUrl?: string;
    /** Peer HTTP URL for direct mode (e.g., https://orch-1:8080) */
    peerUrl?: string;
    /** API key for Platform authentication (required for --platform mode) */
    apiKey?: string;
    /** Path to write the resulting local config YAML */
    configPath?: string;
}
/**
 * Local config structure written by the join client.
 * Compatible with loadLocalConfig() from config/loader.ts.
 */
interface JoinLocalConfig {
    database: {
        url: string;
    };
    storage?: ConfigBundle['storage'];
    secrets?: {
        key: string;
    };
}
/**
 * Decrypt a base64-encoded encrypted config bundle using a derived encryption key.
 */
export declare function decryptAndParseBundle(encryptedB64: string, encryptionKey: Buffer): ConfigBundle;
/**
 * Build a JoinLocalConfig from a decrypted ConfigBundle.
 * Maps bundle fields to the structure expected by loadLocalConfig().
 */
export declare function buildLocalConfig(bundle: ConfigBundle): JoinLocalConfig;
/**
 * Write a local config object to a YAML file.
 */
export declare function writeConfigFile(path: string, config: Record<string, unknown>): Promise<void>;
export declare class JoinClient {
    private readonly options;
    constructor(options: JoinClientOptions);
    /**
     * Execute the join flow:
     * 1. Send join.request with token to Platform relay or direct peer
     * 2. Receive join.response with encrypted config bundle
     * 3. Decrypt bundle using token-derived key
     * 4. Write local config YAML
     */
    join(): Promise<void>;
    /**
     * Join via Platform relay: connect WS, authenticate, send join.request, receive join.response.
     */
    joinViaPlatform(request: JoinRequest): Promise<JoinResponse>;
    /**
     * Join via direct peer: POST to peer's join endpoint.
     */
    joinViaPeer(request: JoinRequest): Promise<JoinResponse>;
}
export {};
//# sourceMappingURL=join-client.d.ts.map