/**
 * HTTP client for Sophos Central APIs.
 * Handles region-aware routing, auth headers, retries, and error mapping.
 */
import type { TokenManager } from "../auth/token-manager.js";
import type { TenantResolver } from "./tenant-resolver.js";
export interface RequestOptions {
    /** HTTP method */
    method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
    /** Query parameters */
    params?: Record<string, string>;
    /** JSON request body */
    body?: unknown;
    /** Additional headers */
    headers?: Record<string, string>;
    /** "text" returns the body as a string, for downloads served as application/octet-stream */
    responseType?: "json" | "text";
}
/**
 * Tools build REST paths by interpolating ID arguments, and those arguments
 * come from the model, so a prompt-injected ID such as "../../common/v1/admins/x"
 * would turn an approved call into the same method on a different resource.
 * URL parsing resolves "." and ".." segments (percent-encoded too), treats a
 * backslash as a slash and drops tabs and newlines, and "?" or "#" would cut
 * the path short. No API path or ID needs any of these, and query strings go
 * through `params`, never the path, so a path carrying one is refused before
 * any token is fetched or request sent.
 */
export declare function assertSafeApiPath(path: string): void;
/** The HTTP status a SophosClient error carries, or undefined for any other error. */
export declare function errorStatus(error: unknown): number | undefined;
export declare class SophosClient {
    private tokenManager;
    private tenantResolver;
    constructor(tokenManager: TokenManager, tenantResolver: TenantResolver);
    /**
     * Make a request to a tenant-scoped API endpoint.
     * Automatically resolves the regional API host for the tenant.
     */
    tenantRequest<T>(tenantId: string, path: string, options?: RequestOptions): Promise<T>;
    /**
     * Make a request to a global API endpoint (partner/org level).
     */
    globalRequest<T>(path: string, options?: RequestOptions): Promise<T>;
    private executeWithRetry;
    private sleep;
}
//# sourceMappingURL=sophos-client.d.ts.map