import { type ChildProcess, type ExecFileException } from 'node:child_process';
import { accessSync } from 'node:fs';
/** Minimal `Response`-like shape consumed by the reference download paths. */
export type DocFetchResponse = {
    ok: boolean;
    status: number;
    headers?: Headers;
    url?: string;
    arrayBuffer(): Promise<ArrayBuffer>;
    text(): Promise<string>;
};
export type CurlFailureKind = 'unavailable' | 'aborted' | 'timeout' | 'tls' | 'http' | 'transfer' | 'read';
export declare class CurlTransportError extends Error {
    readonly kind: CurlFailureKind;
    readonly exitCode?: number | undefined;
    readonly stderr?: string | undefined;
    constructor(kind: CurlFailureKind, message: string, exitCode?: number | undefined, stderr?: string | undefined, options?: ErrorOptions);
}
type ExecFileRunner = (file: string, args: string[], options: {
    encoding: 'utf8';
    windowsHide: true;
}, callback: (error: ExecFileException | null, stdout: string, stderr: string) => void) => ChildProcess;
export declare const secureFetchRuntime: {
    execFile: ExecFileRunner;
    access: typeof accessSync;
    env: NodeJS.ProcessEnv;
    platform: NodeJS.Platform;
};
/**
 * True when `url`'s host is a Salesforce documentation CDN host that serves the
 * incomplete chain. A malformed URL is treated as not-a-doc-host (handled by the
 * caller / default fetch).
 */
export declare function isSalesforceDocHost(url: string): boolean;
export declare function resolveCurlExecutable(): string | undefined;
/**
 * Fetch `url` with a timeout. Salesforce doc CDN hosts go through curl (to work
 * around their incomplete TLS chain); every other host uses the global `fetch`
 * with default verification. curl failures remain typed and are never retried
 * through Node's known-broken TLS path.
 */
export declare function docFetch(url: string, timeoutMs: number, signal?: AbortSignal): Promise<DocFetchResponse>;
/**
 * Mutable indirection over {@link docFetch} so callers route downloads through a
 * single seam that tests can replace. A named ESM export binding is immutable
 * (`sinon.stub(module, 'docFetch')` throws `ES Modules cannot be stubbed` under
 * the ts-node/esm loader), but the *property* of an exported object is writable —
 * so command integration tests stub `docFetchProvider.docFetch` instead.
 */
export declare const docFetchProvider: {
    docFetch: typeof docFetch;
};
export {};