/**
 * `fetch`-compatible function. Accepts any callable matching the standard
 * fetch signature; `preconnect` is optional because non-Bun runtimes
 * (browsers, test mocks) won't expose it.
 */
export type FetchImpl = ((input: string | URL | Request, init?: RequestInit) => Promise<Response>) & {
    preconnect?: typeof globalThis.fetch.preconnect;
};
/**
 * `NODE_EXTRA_CA_CERTS` was set but unusable (path does not exist). This is
 * a config/contract error, not a transient transport fault — it is never
 * retried.
 */
export declare class ExtraCaError extends Error {
    constructor(message: string, options?: {
        cause?: unknown;
    });
}
/** Test seam: drop the cached PEM so a follow-up call re-reads the env. */
export declare function __resetExtraCaCache(): void;
/**
 * Wrap `fetchImpl` so every call honours `NODE_EXTRA_CA_CERTS`. Idempotent:
 * a fetch already wrapped is returned unchanged so repeated composition
 * (Anthropic auth-retry replays, request-debug fan-out) never stacks
 * wrappers. When the env var is unset the original fetch is returned, so
 * default deployments pay nothing.
 */
export declare function wrapFetchForExtraCa(fetchImpl: FetchImpl): FetchImpl;
/**
 * Convenience for options-bag composition (e.g. the stream-entry path in
 * `jeopi-ai`'s `stream.ts`, which mirrors `withRequestDebugFetch` so
 * the proxy/debug/extra-CA wrappers compose uniformly). No-op when the env
 * var is unset.
 */
export declare function withExtraCaFetch<T extends {
    fetch?: FetchImpl;
} | undefined>(options: T): T;