/**
 * @fileoverview HTTP client for the ntfy publish/subscribe API. Wraps
 * `fetchWithTimeout` + `withRetry` so the publish, manage, and fetch calls
 * share one transient-failure boundary. Auth headers are scoped to specific
 * registered base URLs — per-call `baseUrl` overrides that match a registered
 * base forward that base's credentials, anything else goes out unauthenticated
 * to avoid leaking credentials to arbitrary hosts the agent picks.
 *
 * Overrides are also validated before they are dereferenced: absolute
 * `http(s)` form always, plus a public-address requirement and a redirect block
 * when `NTFY_BLOCK_PRIVATE_HOSTS` is on — see `base-url-guard.ts`.
 * @module services/ntfy/ntfy-service
 */
import type { ServerConfig } from '../../config/server-config.js';
import type { ManageOperation, NtfyCallOptions, NtfyFetchParams, NtfyManageResponse, NtfyMessage, NtfyPublishRequest, NtfyPublishResponse } from './types.js';
export declare class NtfyService {
    private readonly cfg;
    private readonly authByBase;
    private readonly defaultBase;
    /**
     * Every configured base, credentialed or not — the SSRF-guard bypass set.
     * `authByBase` holds only entries that produced an auth header, so a
     * registered no-auth LAN server would otherwise fail the address check.
     */
    private readonly registeredBases;
    constructor(cfg: ServerConfig);
    /** Visible for tests / resources that need to render canonical topic URLs. */
    get baseUrl(): string;
    /**
     * Resolve the base URL for one call and decide what the transport may do
     * with it. A caller-supplied override is validated here — the choke point
     * every tool and the topic resource shares. Configured bases are the
     * operator's own choice, URL-validated at config load, so they skip it.
     */
    private resolveBase;
    private buildHeaders;
    /**
     * `POST /` with a JSON body. Returns the upstream message envelope echoing
     * the published values plus the server-assigned `id`/`time`/`expires`.
     */
    publish(body: NtfyPublishRequest, opts?: NtfyCallOptions): Promise<NtfyPublishResponse>;
    /**
     * `PUT /<topic>/<id>/clear` or `DELETE /<topic>/<id>`. Returns the event
     * envelope subscribers see.
     */
    manage(topic: string, sequenceId: string, operation: ManageOperation, opts?: NtfyCallOptions): Promise<NtfyManageResponse>;
    /**
     * `GET /<topic>/json?poll=1&...`. Parses the NDJSON line-delimited stream
     * into an array; `open` and `keepalive` frames are filtered out by the
     * caller (they're connection-level, not notification data).
     */
    fetch(params: NtfyFetchParams, opts?: NtfyCallOptions): Promise<NtfyMessage[]>;
    private run;
}
export declare function initNtfyService(cfg: ServerConfig): NtfyService;
export declare function getNtfyService(): NtfyService;
export declare function resetNtfyService(): void;
//# sourceMappingURL=ntfy-service.d.ts.map