import type { Auth } from './auth.js';
/**
 * Browser-side wrapper around the platform's per-app secret-injecting proxy.
 *
 * Pattern:
 *   const fas = initApp({ appId: 'weather' });
 *   const res = await fas.proxy.fetch(
 *     'api.openweathermap.org/data/2.5/weather?q=London',
 *   );
 *
 * The first segment is the upstream host; the rest is path + query. The
 * platform Worker authenticates the call with the user's session token,
 * matches the URL against the app's allowlist, decrypts the developer's
 * stored API key, and forwards the request server-side.
 *
 * The developer's secret never touches the browser.
 */
export declare class ApiProxy {
    private readonly appId;
    private readonly apiBase;
    private readonly auth;
    constructor(appId: string, apiBase: string, auth: Auth);
    /**
     * Fetch via the proxy. Accepts either:
     *   - "host/path?query"  (preferred, matches the SDK's CLI register form)
     *   - a full "https://host/path?query" URL (we strip the scheme)
     */
    fetch(target: string, init?: RequestInit): Promise<Response>;
}
/**
 * Strip a leading scheme (`https://`, `http://`) so callers can paste either
 * form and get the same result. Throws on schemes other than http(s) — the
 * proxy only ever forwards over https upstream and we want a loud error
 * rather than a silent rewrite.
 *
 * Scheme detection is case-insensitive: `HTTPS://api.example.com/x` should
 * normalize the same as `https://api.example.com/x`.
 */
export declare function normalizeTarget(target: string): string;
//# sourceMappingURL=proxy.d.ts.map