import type { AuthLocale } from '../../i18n/keys.js';
import type { CsrfClientOptions } from '../csrf.js';
/** Result of a JSON API call: HTTP ok-flag + parsed body (`{}` when the body wasn't JSON). */
export interface JsonResult {
    ok: boolean;
    data: Record<string, unknown>;
}
/**
 * POST a JSON body through the package's CSRF/fetcher plumbing and parse the
 * response tolerantly — the shared request core of the manager components
 * (was copied verbatim per component).
 */
export declare function postJson(url: string, body: unknown, options?: {
    csrf?: CsrfClientOptions;
    fetcher?: typeof globalThis.fetch;
}): Promise<JsonResult>;
/**
 * GET a JSON resource with the same tolerant body handling as {@link postJson}.
 * No CSRF header — reads are not state-changing; the optional `fetcher` keeps
 * mock backends and custom retry layers injectable.
 */
export declare function getJson(url: string, options?: {
    fetcher?: typeof globalThis.fetch;
}): Promise<JsonResult>;
/**
 * Tolerantly parse a response body: shields unparseable bodies AND non-object
 * JSON (`null`, arrays, strings — e.g. a proxy error page with a JSON content
 * type). Without it the cast would let `data.code` throw inside the caller's
 * error path, turning a failed request into a hung busy state instead of an
 * error message. Exported for callers that hold a raw `Response` (DELETEs).
 */
export declare function parseJsonBody(res: Response): Promise<Record<string, unknown>>;
/**
 * Narrow the wire-contract fields (`{ error, code }`) out of a tolerant-parsed
 * body — anything non-string (and the information-free empty string) becomes
 * `undefined` instead of leaking through.
 */
export declare function wireError(data: Record<string, unknown>): {
    error?: string;
    code?: string;
};
/**
 * The user out of a success body, or `null` when the `ok` response carries
 * none. A 2xx with no user is a malformed success — a captive portal, broken
 * proxy or mock answering with a body of its own — and treating it as a login
 * would report success while nothing is signed in: the consumer navigates, the
 * route guard bounces it back, and no message says why. Every place that turns
 * an `ok` login / 2FA / register body into a session checks through this one
 * function, so "was that really a success?" cannot be answered differently by
 * the store and the pages.
 */
export declare function userFromSuccess<U extends object = Record<string, unknown>>(data: Record<string, unknown>): U | null;
/**
 * Localized error text for an auth error body: the machine `code` maps
 * through the locale bundle, an unknown code falls back to the server's
 * English prose, and a body with neither yields the generic message. An empty
 * `error` string counts as absent — it must not defeat the generic fallback
 * and leave the error region blank.
 *
 * NOT a package export: the unguarded `t.common.error` read is safe only
 * because every caller resolves `t` through `mergeAuthLocale`. If this is
 * ever exported, give it the same read-tolerance as `errorMessageFromCode`.
 */
export declare function errorTextFromBody(data: Record<string, unknown>, t: AuthLocale): string;