/**
 * Shared HTTP-base helpers for the request/response sub-clients
 * (`InfoClient`, `SpecsClient`, `ManagedToolsClient`).
 *
 * QAR exposes most surfaces over WebSocket, but `info`, `specs`, and managed
 * tools are plain HTTP `fetch`. Each of those clients takes the same
 * consumer-supplied `baseUrl` (an `http(s)://` or `ws(s)://` origin) and must
 * derive the HTTP origin from it under the same scheme + insecure-transport
 * rules, then read error bodies under the same truncation cap. These two pure
 * functions are that shared logic, lifted out so the three clients don't carry
 * three byte-identical copies.
 */
import type { TraceContextProvider } from '../observability/traceContext.js';
/**
 * Map the consumer-supplied `baseUrl` (typically `https://qar.qodo.ai` or
 * `wss://qar.qodo.ai`) onto the HTTP origin used for the REST surfaces.
 * Symmetric with `QodoClient.deriveWsUrl`: trailing slashes are stripped,
 * `wss://` → `https://`, `ws://` → `http://`. Insecure schemes (`http://`,
 * `ws://`) are gated behind `allowInsecureTransport` so a misconfigured
 * production client doesn't transmit the bearer in plaintext.
 *
 * Throws `QodoClientOptionsError` on an unrecognized scheme or an
 * un-opted-in insecure scheme.
 */
export declare function deriveHttpBaseUrl(baseUrl: string, allowInsecureTransport: boolean): string;
/**
 * W3C trace-context headers (`traceparent` + optional `tracestate`) for an
 * outbound HTTP request, sourced from the same {@link TraceContextProvider}
 * the WebSocket path stamps onto every envelope. This continues an active OTel
 * trace over the HTTP surfaces (`info`, `specs`, managed tools).
 *
 * Returns `{}` when `provider` is absent or there's no active recording span —
 * so the no-OTel path sends exactly the headers it did before (no fabricated
 * `traceparent` on a trace that continues nowhere).
 */
export declare function traceHeaders(provider: TraceContextProvider | undefined): Record<string, string>;
/**
 * Read an error response body for inclusion in a thrown message, truncated to
 * 512 chars so a large HTML error page doesn't bloat the exception. Returns
 * `''` if the body can't be read — the caller already has status / statusText.
 */
export declare function readBodySafely(response: Response): Promise<string>;
//# sourceMappingURL=httpBase.d.ts.map