/**
 * `fetch` wrapper that attaches embed-proxy bearer headers (when
 * present in sessionStorage) and forces `credentials: 'same-origin'`
 * so Supabase auth cookies travel too.
 *
 * **Header merge direction (proxy WINS over caller):** the implementation
 * spreads `baseHeaders` first inside `applyProxyAuth`, then sets the
 * `Authorization` / `X-Chat-*` keys — so the proxy values take precedence
 * over anything the caller passed. The motivation is that the bearer +
 * act-as identity is the source of truth for embedded auth; a caller
 * accidentally passing a stale `Authorization` header should NOT override
 * the live proxy creds.
 *
 * **Cross-origin defense:** the wrapper assumes a same-origin `/api/…`
 * relative URL. Absolute URLs are accepted only when their origin matches
 * the current window's origin; cross-origin URLs throw before the bearer
 * leaves the page. This is a defense-in-depth guard for future call sites
 * — there is no legitimate cross-origin use of this fetch wrapper.
 */
export declare function embedAuthedFetch(url: string, init?: RequestInit): Promise<Response>;
//# sourceMappingURL=embed-authed-fetch.d.ts.map