@takeal/cusfront-sdk 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,66 @@
+# Changelog
+
+All notable changes to `@takeal/cusfront-sdk` are documented here. The format
+follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project
+adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Added
+
+- `client.blog.list()` / `client.blog.get(slug)` — public posts returned as
+  structured blocks (`body_blocks`) plus raw Markdown, so a site renders them
+  in its own components instead of fighting server-side HTML.
+- `client.subscriptions.get()` / `.set(channels)` — the user's announcement
+  channels, with `available` reflecting what the deployment can deliver.
+- `client.deposits.quote()` + `quote_id` on `initiate()` — cross-currency
+  top-ups now execute against a rate-locked quote (the wallet holds a single
+  local currency; the API converts on funding). `Deposit` gains
+  `quote_id` / `fx_rate` / `fx_spread_bps` / `credited_currency` /
+  `credited_amount`.
+- `client.branding.get()` — fetches the deployment's public runtime brand
+  config (`GET /branding`): platform / portal names, logo, favicon and the new
+  `wallet_label` (how the end-user's balance is called, e.g. "Acme Wallet").
+- `BrandConfig.walletLabel` — build-time fallback for the same label.
+
+### Changed
+
+- Docs: "master balance" wording replaced by "wallet balance" everywhere. No
+  API field names changed.
+- Generated types refreshed from the current API spec (card-transaction
+  billing fields, issuing metrics, branding). `refresh-types` now scrubs
+  internal references from doc comments before generating.
+
+## [0.1.0] — first public release
+
+Initial release of the typed client for the Takeal end-user API.
+
+### Added
+
+- `createClient({ baseUrl, brand?, tokenStore?, fetch?, validate? })` — the
+  entry point; resources hang off the returned client.
+- **Auth** (`client.auth`) — staged login (`login` → optional `verifyTotp` /
+  `verifyOtp` / `switchMethod`), `me`, `signOut`. JWT auto-stored on success.
+- **Deposits** (`client.deposits`) — `initiate` / `get` / `list` / `refund`
+  (money in via a funder connector), with `Idempotency-Key` support.
+- **Cards** (`client.cards`) — `create` / `get` / `list` / `balance` plus the
+  ownership-gated `freeze` / `unfreeze` / `terminate`, and the security-gated
+  `reveal` (re-auth with password + optional TOTP).
+- **Balance** (`client.balance`) — per-currency wallet balance lookup.
+- **Telegram Mini App** (`@takeal/cusfront-sdk/telegram`) — `fromTelegramWebApp`
+  / `fromInitData` exchange a Telegram-signed `initData` for an authenticated
+  client; `parseInitData` / `assertWellFormed` helpers; `client.auth.exchangeTelegram`
+  + `client.auth.linkEmail` for the auto-provision-then-attach-email flow.
+- **Webhooks** (`@takeal/cusfront-sdk/webhooks`) — isomorphic, no-network
+  HMAC-SHA256 signature verifier (`verifyWebhook`).
+- **React** (`@takeal/cusfront-sdk/react`) — optional `ClientProvider` +
+  `useMe` / `useDeposits` / `useCards` / `useBalance` hooks (React is a peer dep,
+  never bundled).
+- Pluggable token storage (`defaultBrowserStore` / `inMemoryStore` / custom
+  `TokenStore`), typed `ApiError` / `NetworkError`, and runtime `BrandConfig`
+  for whitelabel theming.
+- Dual ESM + CJS builds with `.d.ts` types; per-resource sub-entrypoints for
+  tree-shaking.
+
+[Unreleased]: https://git.wiseless.xyz/takeal/cusfront-sdk/compare/v0.1.0...HEAD
+[0.1.0]: https://git.wiseless.xyz/takeal/cusfront-sdk/releases/tag/v0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Takeal
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,283 @@
+# @takeal/cusfront-sdk
+
+Typed TypeScript client for the **Takeal end-user API** — auth, deposits, cards, balance, and webhook signature verification.
+
+The SDK powers any "Cusfront" (consumer front-end) on top of a Takeal deployment: a PWA, a Capacitor-wrapped mobile app, a Telegram Mini App, or anything else that talks to the `/auth/*` + `/me/*` surface. One client, runtime brand swap, zero runtime deps in the core.
+
+> **Status:** 0.x — pre-release scaffold. Auth resource lands first; deposits + cards + balance + webhook verifier ship in subsequent releases.
+
+## Install
+
+```sh
+pnpm add @takeal/cusfront-sdk
+# optional peer dep for runtime validation
+pnpm add zod
+```
+
+Native `fetch` is required. Node ≥ 18, modern browsers, Bun, Deno, and React Native ≥ 0.74 (Hermes) all ship it out of the box. For older runtimes inject a polyfill via `createClient({ fetch })`.
+
+## Quick start
+
+```ts
+import { createClient } from "@takeal/cusfront-sdk";
+
+const client = createClient({
+  baseUrl: "https://api.your-deployment.example.com",
+  brand: {
+    name: "Your Brand",
+    logoUrl: "/logo.svg",
+    primaryColor: "#0047AB",
+  },
+});
+
+const result = await client.auth.login({
+  email: "user@example.com",
+  password: "secret",
+});
+
+if (result.stage === "jwt") {
+  // Authenticated — JWT auto-stored.
+  const me = await client.auth.me();
+  console.log("hello", me.email);
+} else if (result.stage === "totp_required") {
+  // Step-up required. Prompt the user for their TOTP code,
+  // then call client.auth.verifyTotp({ challenge_token, code }).
+}
+```
+
+## Telegram Mini App
+
+Run inside a Telegram Mini App? Exchange the Telegram-signed `initData` for a
+session in one call — no password:
+
+```ts
+import { fromTelegramWebApp } from "@takeal/cusfront-sdk/telegram";
+
+// Reads window.Telegram.WebApp.initData, exchanges it, returns a ready client.
+const client = await fromTelegramWebApp({
+  baseUrl: "https://api.your-deployment.example.com",
+});
+
+const me = await client.auth.me();
+if (me.email_pending) {
+  // First-time Telegram users are auto-provisioned without an email.
+  // Collect a real address and attach it:
+  await client.auth.linkEmail({ email: "user@example.com" });
+}
+```
+
+Already hold the raw string (e.g. from a custom launch)? Use `fromInitData`:
+
+```ts
+import { fromInitData, parseInitData } from "@takeal/cusfront-sdk/telegram";
+
+const client = await fromInitData(initData, {
+  baseUrl: "https://api.your-deployment.example.com",
+});
+```
+
+How it works end-to-end:
+
+1. **Telegram** signs `initData` with the bot token when it launches your Mini App.
+2. The SDK does a fast **structural** check (`hash` + `auth_date` present, not
+   stale) and POSTs the raw string to the API's exchange endpoint. The SDK
+   **cannot** verify the cryptographic signature — only the server holds the bot
+   token, so the API performs the authoritative HMAC check. A forged or stale
+   payload is rejected there with a `401 ApiError`.
+3. On success the JWT is stored in the configured token store; the returned
+   client is authenticated for all `client.*` calls.
+4. First-time Telegram users are **auto-provisioned**. They have no email yet, so
+   `me.email_pending === true` — prompt for an address and call
+   `client.auth.linkEmail` to clear it.
+
+For the lower-level call returning the raw session envelope (including
+`email_pending`), use `client.auth.exchangeTelegram({ initData })` on a client
+you built yourself.
+
+## Brand config
+
+Whitelabel-friendly by design — the SDK ships no embedded brand. Pass `brand` at runtime and the consumer Cusfront reads it back via `client.brand`:
+
+```ts
+type BrandConfig = {
+  name: string;
+  logoUrl?: string;
+  primaryColor?: string;
+  supportUrl?: string;
+  walletLabel?: string; // how the user's balance is called, e.g. "Acme Wallet"
+};
+```
+
+Switching brands does **not** require forking or re-publishing the SDK.
+
+The deployment also publishes its live brand config at `GET /branding` (public,
+no login needed) — `client.branding.get()` returns `platform_name`,
+`merchant_portal_name`, `logo_url`, `favicon_url` and `wallet_label`, so a
+Cusfront can re-theme itself at runtime and call the balance whatever the
+operator configured. Server values win over the build-time `brand` when both
+are present.
+
+## Sub-exports
+
+Tree-shaking-friendly: import only the resource you need.
+
+```ts
+import { AuthResource } from "@takeal/cusfront-sdk/auth";
+```
+
+Available now:
+
+- `@takeal/cusfront-sdk` — `createClient` + types.
+- `@takeal/cusfront-sdk/auth` — auth-only entry.
+- `@takeal/cusfront-sdk/deposits` — `DepositsResource` (money IN via a funder connector).
+- `@takeal/cusfront-sdk/cards` — `CardsResource` (cards backed by the wallet balance).
+- `@takeal/cusfront-sdk/balance` — `BalanceResource` (per-currency wallet balance).
+- `@takeal/cusfront-sdk/blog` — `BlogResource` (public posts as structured blocks).
+- `@takeal/cusfront-sdk/subscriptions` — `SubscriptionsResource` (announcement channels).
+- `@takeal/cusfront-sdk/webhooks` — HMAC-SHA256 signature verifier (no network, isomorphic).
+- `@takeal/cusfront-sdk/react` — optional React hooks layer (`ClientProvider` + `useMe` / `useDeposits` / `useCards` / `useBalance`). React is a `peerDependency`, never bundled.
+- `@takeal/cusfront-sdk/telegram` — Telegram Mini App `initData` → authenticated client bridge.
+
+### Verifying webhooks
+
+`verifyWebhook` is pure (no network) and isomorphic (Web Crypto — Node 18+,
+browsers, Bun, Deno, Workers). Verify against the **raw** request body bytes —
+not re-serialised JSON — using the secret your endpoint was provisioned with:
+
+```ts
+import { verifyWebhook, SIGNATURE_HEADER } from "@takeal/cusfront-sdk/webhooks";
+
+const ok = await verifyWebhook({
+  payload: rawBody,                              // string or Uint8Array, verbatim
+  signatureHeader: req.headers[SIGNATURE_HEADER.toLowerCase()],
+  secret: process.env.TAKEAL_WEBHOOK_SECRET!,
+});
+if (!ok) return res.status(401).end();
+```
+
+Algorithm: HMAC-SHA256, header `X-Takeal-Signature: sha256=<hex>`, signed over
+the raw body bytes (no timestamp). Comparison is constant-time.
+
+> **Card lifecycle note:** card-data reveal (PAN / CVV) is a separate,
+> security-gated flow with its own re-auth + rate-limit + audit contract, so it
+> is intentionally not part of `client.cards`. The cards resource covers
+> create / get / list / balance plus the ownership-gated freeze / unfreeze /
+> terminate lifecycle actions.
+
+## React hooks (`@takeal/cusfront-sdk/react`)
+
+An optional React layer ships from a separate entry point. React is a
+`peerDependency` (`>=18`) and is never bundled, so non-React consumers pay
+nothing for it. Install React in your app, then:
+
+```sh
+pnpm add react   # if not already present
+```
+
+Wrap your tree once in a `ClientProvider`, then read data with the hooks:
+
+```tsx
+import { createClient } from "@takeal/cusfront-sdk";
+import { ClientProvider, useBalance } from "@takeal/cusfront-sdk/react";
+
+// Build the client once — module scope or a useMemo, not per-render.
+const client = createClient({
+  baseUrl: "https://api.your-deployment.example.com",
+});
+
+function Root() {
+  return (
+    <ClientProvider client={client}>
+      <Wallet />
+    </ClientProvider>
+  );
+}
+
+function Wallet() {
+  const { data, error, loading, refetch } = useBalance("USD");
+
+  if (loading) return <Spinner />;
+  if (error) return <ErrorBanner onRetry={refetch} />;
+  return (
+    <div>
+      {data!.amount} {data!.currency}
+      <button onClick={() => void refetch()}>Refresh</button>
+    </div>
+  );
+}
+```
+
+Every hook returns the same shape — `{ data, error, loading, refetch }`:
+
+- `useMe()` — current authenticated user (`client.auth.me()`).
+- `useDeposits()` — the user's deposits (`client.deposits.list()`).
+- `useCards()` — the user's cards (`client.cards.list()`).
+- `useBalance(currency)` — wallet balance for one currency
+  (`client.balance.get(currency)`); re-fetches when `currency` changes.
+
+`useClient()` exposes the raw client from context for one-off writes
+(e.g. `client.deposits.initiate(...)`) — it throws a clear error if called
+outside a `ClientProvider`.
+
+The hooks are SSR-safe (fetches run only inside `useEffect`, never during
+server render) and have no third-party data-fetching dependency. In-flight
+requests are guarded against unmounted-component writes.
+
+## Token storage
+
+`createClient` accepts a pluggable `TokenStore`. The default is:
+
+- Browser: `localStorage` (key `takeal_jwt`).
+- Node / SSR / Worker: in-memory.
+- Capacitor / React Native: pass your own (Keychain / EncryptedSharedPreferences wrapper).
+
+```ts
+import { createClient, inMemoryStore } from "@takeal/cusfront-sdk";
+
+const client = createClient({
+  baseUrl: "...",
+  tokenStore: inMemoryStore(), // never persist
+});
+```
+
+## Errors
+
+Two narrow error types — branch on the type guard, not `instanceof`:
+
+```ts
+import { isApiError, isNetworkError } from "@takeal/cusfront-sdk";
+
+try {
+  await client.auth.login({ email, password });
+} catch (e) {
+  if (isApiError(e)) {
+    // e.status, e.code, e.message, e.body
+    if (e.code === "invalid_credentials") showInlineError();
+  } else if (isNetworkError(e)) {
+    showOfflineBanner();
+  } else {
+    throw e;
+  }
+}
+```
+
+## Development
+
+```sh
+pnpm install
+pnpm refresh-types   # regenerate src/types.gen.ts from openapi-snapshot.json
+pnpm build           # tsup → dist/
+pnpm test            # vitest
+pnpm typecheck       # tsc --noEmit
+```
+
+The OpenAPI snapshot lives at `openapi-snapshot.json` and is committed; refresh it from a running Takeal deployment with:
+
+```sh
+curl https://api.your-deployment.example.com/api/docs/openapi.json > openapi-snapshot.json
+pnpm refresh-types
+```
+
+## License
+
+MIT — see [LICENSE](./LICENSE).

package/dist/customer-CoxPwe5o.d.cts

@@ -0,0 +1,32 @@
+/**
+ * Structured customer billing details — shared by the deposits and cards
+ * resources. Mirrors the Takeal API's `CustomerInfo` / `Address`.
+ *
+ * Every field is optional at this layer; each provider connector enforces its
+ * own required subset and fails the operation if a mandatory field is missing.
+ * Real PSPs / card issuers demand a billing address + name + email for
+ * compliance, 3DS, or APM redirect flows; crypto / gift rails usually ignore it.
+ */
+/** Postal address. ISO 3166 codes recommended where the provider supports them. */
+interface Address {
+    line1?: string;
+    line2?: string;
+    city?: string;
+    /** ISO 3166-2 subdivision code, e.g. `"US-CA"`. Free-form fallback accepted. */
+    state?: string;
+    postal_code?: string;
+    /** ISO 3166-1 alpha-2, e.g. `"US"`. */
+    country?: string;
+}
+interface CustomerInfo {
+    email?: string;
+    first_name?: string;
+    last_name?: string;
+    /** E.164 format, e.g. `"+48..."`. Free-form fallback accepted. */
+    phone?: string;
+    /** ISO 8601 `YYYY-MM-DD`. KYC-tier issuers may require it. */
+    birth_date?: string;
+    billing_address?: Address;
+}
+
+export type { Address as A, CustomerInfo as C };

package/dist/customer-CoxPwe5o.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Structured customer billing details — shared by the deposits and cards
+ * resources. Mirrors the Takeal API's `CustomerInfo` / `Address`.
+ *
+ * Every field is optional at this layer; each provider connector enforces its
+ * own required subset and fails the operation if a mandatory field is missing.
+ * Real PSPs / card issuers demand a billing address + name + email for
+ * compliance, 3DS, or APM redirect flows; crypto / gift rails usually ignore it.
+ */
+/** Postal address. ISO 3166 codes recommended where the provider supports them. */
+interface Address {
+    line1?: string;
+    line2?: string;
+    city?: string;
+    /** ISO 3166-2 subdivision code, e.g. `"US-CA"`. Free-form fallback accepted. */
+    state?: string;
+    postal_code?: string;
+    /** ISO 3166-1 alpha-2, e.g. `"US"`. */
+    country?: string;
+}
+interface CustomerInfo {
+    email?: string;
+    first_name?: string;
+    last_name?: string;
+    /** E.164 format, e.g. `"+48..."`. Free-form fallback accepted. */
+    phone?: string;
+    /** ISO 8601 `YYYY-MM-DD`. KYC-tier issuers may require it. */
+    birth_date?: string;
+    billing_address?: Address;
+}
+
+export type { Address as A, CustomerInfo as C };

package/dist/http-BkZZZI8K.d.cts

@@ -0,0 +1,72 @@
+/**
+ * Pluggable storage for the JWT.
+ *
+ * Default behaviour by environment:
+ *  - browser  → `localStorage` (synchronous, persists across reloads)
+ *  - Node / SSR / worker → in-memory (no global state to leak)
+ *  - mobile (Capacitor / RN) → consumer must inject Keychain /
+ *    EncryptedSharedPreferences via `createClient({ tokenStore })`
+ *
+ * The store is intentionally tiny — three methods, no eviction
+ * policy, no encryption. Encryption is the consumer's call (mobile
+ * adapters wrap platform-native secure storage). Persistence shape
+ * is opaque to the SDK; tokens are passed through verbatim.
+ */
+interface TokenStore {
+    get(): string | null | Promise<string | null>;
+    set(token: string): void | Promise<void>;
+    clear(): void | Promise<void>;
+}
+/** Sync `localStorage`-backed store. Falls through to in-memory when
+ *  `window.localStorage` is unavailable (private mode quota, SSR). */
+declare function defaultBrowserStore(key?: string): TokenStore;
+/** In-memory store. Use for SSR / tests / when persistence isn't
+ *  desired (e.g. ephemeral kiosk sessions). */
+declare function inMemoryStore(): TokenStore;
+
+/**
+ * Internal HTTP client. One per SDK instance; injected into each
+ * resource. Responsibilities:
+ *
+ *  - Construct absolute URLs from `baseUrl` + path.
+ *  - Set `Authorization: Bearer <jwt>` from the `TokenStore`.
+ *  - Set `Content-Type: application/json` on bodies.
+ *  - Parse JSON responses + map non-2xx to `ApiError`.
+ *  - Forward `Idempotency-Key` when the caller passes one.
+ *  - Surface network failures (DNS, abort, broken pipe) as
+ *    `NetworkError`.
+ *
+ * Auto-refresh + retry policies are deliberately NOT in here — they
+ * belong to the resource layer (auth.refresh) which has the right
+ * context for "is this refreshable" decisions.
+ */
+type FetchLike = typeof fetch;
+interface HttpOptions {
+    /** Request body. Will be JSON-serialised if not already a
+     *  string / FormData / Blob. */
+    body?: unknown;
+    /** Idempotency key forwarded as the `Idempotency-Key` header.
+     *  Required by the Takeal API on most write endpoints. */
+    idempotencyKey?: string;
+    /** Extra headers merged after the SDK's defaults — caller wins. */
+    headers?: Record<string, string>;
+    /** Bypass the token store for one call (login, refresh). */
+    skipAuth?: boolean;
+    /** AbortSignal forwarded to fetch. */
+    signal?: AbortSignal;
+}
+declare class HttpClient {
+    private readonly baseUrl;
+    private readonly tokens;
+    private readonly fetchImpl;
+    constructor(baseUrl: string, tokens: TokenStore, fetchImpl: FetchLike);
+    get<T>(path: string, opts?: HttpOptions): Promise<T>;
+    post<T>(path: string, opts?: HttpOptions): Promise<T>;
+    put<T>(path: string, opts?: HttpOptions): Promise<T>;
+    patch<T>(path: string, opts?: HttpOptions): Promise<T>;
+    delete<T>(path: string, opts?: HttpOptions): Promise<T>;
+    private request;
+    private absolute;
+}
+
+export { type FetchLike as F, HttpClient as H, type TokenStore as T, defaultBrowserStore as d, inMemoryStore as i };

package/dist/http-BkZZZI8K.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Pluggable storage for the JWT.
+ *
+ * Default behaviour by environment:
+ *  - browser  → `localStorage` (synchronous, persists across reloads)
+ *  - Node / SSR / worker → in-memory (no global state to leak)
+ *  - mobile (Capacitor / RN) → consumer must inject Keychain /
+ *    EncryptedSharedPreferences via `createClient({ tokenStore })`
+ *
+ * The store is intentionally tiny — three methods, no eviction
+ * policy, no encryption. Encryption is the consumer's call (mobile
+ * adapters wrap platform-native secure storage). Persistence shape
+ * is opaque to the SDK; tokens are passed through verbatim.
+ */
+interface TokenStore {
+    get(): string | null | Promise<string | null>;
+    set(token: string): void | Promise<void>;
+    clear(): void | Promise<void>;
+}
+/** Sync `localStorage`-backed store. Falls through to in-memory when
+ *  `window.localStorage` is unavailable (private mode quota, SSR). */
+declare function defaultBrowserStore(key?: string): TokenStore;
+/** In-memory store. Use for SSR / tests / when persistence isn't
+ *  desired (e.g. ephemeral kiosk sessions). */
+declare function inMemoryStore(): TokenStore;
+
+/**
+ * Internal HTTP client. One per SDK instance; injected into each
+ * resource. Responsibilities:
+ *
+ *  - Construct absolute URLs from `baseUrl` + path.
+ *  - Set `Authorization: Bearer <jwt>` from the `TokenStore`.
+ *  - Set `Content-Type: application/json` on bodies.
+ *  - Parse JSON responses + map non-2xx to `ApiError`.
+ *  - Forward `Idempotency-Key` when the caller passes one.
+ *  - Surface network failures (DNS, abort, broken pipe) as
+ *    `NetworkError`.
+ *
+ * Auto-refresh + retry policies are deliberately NOT in here — they
+ * belong to the resource layer (auth.refresh) which has the right
+ * context for "is this refreshable" decisions.
+ */
+type FetchLike = typeof fetch;
+interface HttpOptions {
+    /** Request body. Will be JSON-serialised if not already a
+     *  string / FormData / Blob. */
+    body?: unknown;
+    /** Idempotency key forwarded as the `Idempotency-Key` header.
+     *  Required by the Takeal API on most write endpoints. */
+    idempotencyKey?: string;
+    /** Extra headers merged after the SDK's defaults — caller wins. */
+    headers?: Record<string, string>;
+    /** Bypass the token store for one call (login, refresh). */
+    skipAuth?: boolean;
+    /** AbortSignal forwarded to fetch. */
+    signal?: AbortSignal;
+}
+declare class HttpClient {
+    private readonly baseUrl;
+    private readonly tokens;
+    private readonly fetchImpl;
+    constructor(baseUrl: string, tokens: TokenStore, fetchImpl: FetchLike);
+    get<T>(path: string, opts?: HttpOptions): Promise<T>;
+    post<T>(path: string, opts?: HttpOptions): Promise<T>;
+    put<T>(path: string, opts?: HttpOptions): Promise<T>;
+    patch<T>(path: string, opts?: HttpOptions): Promise<T>;
+    delete<T>(path: string, opts?: HttpOptions): Promise<T>;
+    private request;
+    private absolute;
+}
+
+export { type FetchLike as F, HttpClient as H, type TokenStore as T, defaultBrowserStore as d, inMemoryStore as i };