/**
 * The HTTP core: a fetch wrapper that attaches the auth header, unwraps the
 * skeleton's `{ "data" }` / `{ "error" }` envelope, and validates the payload
 * against a per-endpoint zod schema. Every failure throws.
 *
 * Same-origin by default: the skeleton serves the built SPA, so requests use
 * relative `/api/...` URLs. `VITE_API_BASE_URL` can override for cross-origin
 * deployments (documented as requiring CORS on the skeleton).
 */
import type { z } from 'zod';
/** Supplies the current API key (in-memory or sessionStorage-backed) + base URL. */
export interface ApiConfig {
    /** Absolute base (e.g. `https://host`) or '' for same-origin relative `/api`. */
    readonly baseUrl?: string;
    /** Returns the pre-provisioned API key, or null when unauthenticated. */
    getToken: () => string | null;
    /** Optional fetch impl (tests inject one; defaults to global fetch). */
    fetch?: typeof fetch;
}
export interface RequestOptions {
    readonly method?: string;
    readonly body?: unknown;
    readonly query?: Record<string, string | number | string[] | undefined>;
    readonly signal?: AbortSignal;
}
/**
 * Whether a value can never be faithfully transmitted as a single URL path
 * segment. The browser's WHATWG URL parser removes dot-segments (`.`, `..`) from a
 * relative request path before it is sent — even percent-encoded — and reads an
 * empty or absolute (`/`-prefixed) value as a path boundary, so any of these would
 * silently retarget the request at an unrelated same-origin route. The path
 * encoders reject such a segment loudly at the client boundary instead of letting
 * it leave; the server enforces the same relative-path rule.
 */
export declare function isUnsafePathSegment(segment: string): boolean;
/**
 * Encode a single id (string or number) as ONE URL path segment.
 * `encodeURIComponent` already percent-encodes any interior `/`, so the value is
 * guaranteed to stay a single segment (spaces, `#`, `?`, … all escape). An empty,
 * `.`, `..`, or absolute id is REJECTED loudly rather than encoded (see
 * `isUnsafePathSegment`): the browser would collapse it and retarget the request
 * at a different route. A number stringifies to digits and is always safe.
 */
export declare function encodeSegment(value: string | number): string;
export declare function apiRequest<S extends z.ZodType>(config: ApiConfig, path: string, schema: S, options?: RequestOptions): Promise<z.infer<S>>;
/**
 * Fetch a plain-text endpoint (the skeleton's `/health` → `"OK"`). No `{ data }`
 * envelope, no zod — the body is returned verbatim. Non-2xx still throws loudly.
 */
export declare function apiText(config: ApiConfig, path: string, options?: RequestOptions): Promise<string>;
/**
 * Fetch a raw file download (the skeleton's backup export and observability
 * exports stream a document, NOT a `{ data }` envelope). Attaches the auth
 * header, serializes a JSON body when one is given (POST exports), and returns
 * the response as a `Blob`. Non-2xx throws loudly — no silent empty download.
 */
export declare function apiDownload(config: ApiConfig, path: string, options?: RequestOptions): Promise<Blob>;
/** Pull the `error` message and optional machine `code` from the failure envelope. */
export declare function extractError(value: unknown): {
    message: string | null;
    code: string | undefined;
};
//# sourceMappingURL=http.d.ts.map