import { FindParams as TypesFindParams, FindResponse as TypesFindResponse } from "@rebasepro/types";
export { RebaseApiError } from "@rebasepro/types";
export type { RebaseErrorInit } from "@rebasepro/types";
export interface RebaseClientConfig {
    /**
     * Origin of the Rebase server — scheme, host and port **only**.
     *
     * {@link apiPath} is appended to this, so do not include it here:
     * `"http://localhost:3001"` is correct, while `"http://localhost:3001/api"`
     * silently builds `/api/api/…` and every request 404s. Omit entirely for
     * same-origin requests from the browser.
     */
    baseUrl?: string;
    /**
     * Bearer token sent as `Authorization` on every request.
     *
     * In the browser this is the signed-in user's access token, so row-level
     * security applies. Server-side callers — scripts, cron jobs, ETL — pass the
     * service key instead, which resolves to `{ uid: "service", roles: ["admin"] }`
     * and **bypasses RLS**: there is no user to constrain those queries, so scope
     * them explicitly.
     */
    token?: string;
    /**
     * Path the API is mounted under, appended to {@link baseUrl}.
     * Defaults to `"/api"`; override only if the server mounts it elsewhere.
     */
    apiPath?: string;
    /**
     * Origin to use instead of {@link baseUrl} for URLs that are handed to the
     * browser to fetch on its own — storage file downloads and previews.
     *
     * API *requests* always go to `baseUrl`; this only changes URLs the SDK
     * *returns* (e.g. `storage.getSignedUrl`). It exists for proxied setups:
     * when `baseUrl` routes through an authenticated middleman (the Rebase
     * console's Studio proxy), a plain `<img src>` or a copied link cannot
     * satisfy the middleman's auth — but the file route itself is reachable
     * directly at the origin server and secured by its own scoped `?token=`.
     * Set this to that server's public origin (no path; {@link apiPath} is
     * appended) and returned file URLs point straight at it.
     */
    storageUrlOrigin?: string;
    fetch?: typeof globalThis.fetch;
    onUnauthorized?: () => Promise<boolean>;
    websocketUrl?: string;
    /**
     * Open the realtime WebSocket. **Defaults to `true`.**
     *
     * The socket connects as soon as the client is constructed and keeps the
     * Node event loop alive, so a one-shot script (CLI, cron job, ETL) will not
     * exit on its own. Set this to `false` for any process that reads or writes
     * and then terminates — `.listen()` and `.listenById()` then throw instead
     * of silently doing nothing.
     *
     * Long-lived processes that do want realtime can instead call
     * `client.close()` when shutting down.
     */
    realtime?: boolean;
    /**
     * "Yes, I meant to be anonymous."
     *
     * Off-browser, a client with no credential can only ever call as an
     * anonymous user, and row-level security answers it with whatever is
     * public — usually nothing. That is almost always a mistake in a script or
     * cron job, so the SDK warns once on the first request (see
     * {@link ANONYMOUS_SERVER_CLIENT_WARNING}). Anonymous is a legitimate
     * choice for public reads, though; set this to `true` to say so and
     * silence the warning.
     *
     * Has no effect in the browser, where anonymous-before-sign-in is normal
     * and nothing is ever warned about.
     */
    anonymous?: boolean;
}
/**
 * Facts about the surrounding client that the transport cannot read off its own
 * config, but needs in order to decide whether a request is *meaningfully*
 * credential-less.
 */
export interface TransportEnvironment {
    /**
     * The credential reaches the server without an `Authorization` header —
     * i.e. `auth.authFlowMode: "cookie"`, where the refresh token lives in an
     * httpOnly cookie. Such a client looks tokenless to the transport but is
     * not anonymous, so it must never trip the guard.
     */
    credentialOutOfBand?: boolean;
}
/**
 * Emitted once per client. Kept as a constant so the wording is testable and
 * greppable — this is the string a user will paste into a search.
 */
export declare const ANONYMOUS_SERVER_CLIENT_WARNING: string;
/**
 * Re-export from `@rebasepro/types` for backward compatibility.
 *
 * Forwards the row type: without the parameter this alias flattened
 * `FindParams<M>` back to its `Record<string, unknown>` default, and `where` /
 * `orderBy` went back to accepting any column name — the alias, not the
 * definition, was where the typing was lost.
 */
export type FindParams<M extends Record<string, unknown> = Record<string, unknown>> = TypesFindParams<M>;
export type FindResponse<T> = TypesFindResponse<T extends Record<string, unknown> ? T : Record<string, unknown>>;
export declare function buildQueryString(params?: FindParams): string;
export interface Transport {
    request: <T = unknown>(path: string, init?: RequestInit) => Promise<T>;
    setToken: (newToken: string | null) => void;
    setAuthTokenGetter: (getter: () => Promise<string | null>) => void;
    setOnUnauthorized: (handler: () => Promise<boolean>) => void;
    readonly baseUrl: string;
    readonly apiPath: string;
    /** See {@link RebaseClientConfig.storageUrlOrigin}. Undefined = use `baseUrl`. */
    readonly storageUrlOrigin?: string;
    readonly fetchFn: typeof globalThis.fetch;
    getHeaders: (init?: RequestInit) => Record<string, string>;
    resolveToken: () => Promise<string | null>;
}
export declare function createTransport(config: RebaseClientConfig, environment?: TransportEnvironment): Transport;