/**
 * Hosts that have their own auth model (cookie sessions, app-specific
 * JWT in localStorage, OAuth access tokens, …) can register an adapter
 * to override the lib's default `embedProxyAuth` flow. When set, the
 * adapter's `getHeaders()` result is merged onto every `embedAuthedFetch`
 * call AFTER the default proxy-auth header step (so adapter headers
 * win over both caller and proxy values), and `credentials` overrides
 * the default `'same-origin'` behaviour.
 *
 * Default (no adapter): MPH-style proxy-impersonation — bearer + act-as
 * read from localStorage, `credentials: 'same-origin'`. No consumer
 * needs to touch this unless they want a different auth model.
 *
 * Use cases:
 *   - openframe-frontend has its own JWT in `localStorage.of_access_token`
 *     and cookie-based session; register an adapter to attach the JWT
 *     and request `credentials: 'include'` so cookies travel cross-origin
 *     to the openframe gateway.
 *   - Future embed hosts with OAuth access tokens, signed URLs, etc.
 *
 * Lifetime: setter is module-level (intentionally — `embedAuthedFetch`
 * is a plain utility, not a hook, so it can't read React context). Host
 * runtime providers should call `setEmbedAuthAdapter(...)` on mount and
 * `setEmbedAuthAdapter(null)` on unmount. Multiple hosts registering at
 * once is a programming error (one chat panel per app).
 */
export interface EmbedAuthAdapter {
    /** Headers merged onto every embedded-fetch call. Return `{}` to add
     *  nothing. Called per-request so reactive token refresh sees the latest
     *  value from your auth store / storage. Values typed as
     *  `string | undefined` so the common narrowed shape
     *  `{ Authorization: token ? 'Bearer …' : undefined }` (or a conditional
     *  `token ? { Authorization: … } : {}`) assigns cleanly — `undefined`
     *  values are filtered before being merged into the request headers. */
    getHeaders?: () => Record<string, string | undefined>;
    /** `RequestInit.credentials` mode. Default when no adapter: callers'
     *  `init.credentials` or `'same-origin'`. Use `'include'` for cookie
     *  auth against a different origin (CORS + `SameSite=None` required). */
    credentials?: RequestCredentials;
    /**
     * Optional 401 self-heal. When a request comes back `401`,
     * `embedAuthedFetch` calls this once, and — if it resolves `true` —
     * retries the SAME request exactly once with freshly-recomputed
     * headers (so a rotated bearer from `getHeaders()` is picked up).
     * Resolve `false` to surface the 401 to the caller unchanged.
     *
     * This is the capability the openframe `apiClient` has had all along
     * (refresh-the-access-token-then-retry); registering it here gives the
     * embedded chat/ticket surfaces the same self-healing auth instead of
     * dying on an expired token. Concurrent 401s are de-duplicated by the
     * wrapper, so this fires at most once per refresh cycle even when a
     * stampede of chat requests all expire together — your implementation
     * does NOT need its own in-flight guard (though a token-refresh manager
     * that already dedups is harmless).
     *
     * Keep it idempotent and side-effect-light: on failure the wrapper just
     * returns the original 401 — logout/redirect decisions belong to the
     * host's own auth layer, not to this fetch wrapper.
     */
    refresh?: () => Promise<boolean>;
}
/**
 * Register a host-owned auth adapter for `embedAuthedFetch`. Pass `null`
 * to clear (typically on provider unmount).
 *
 * Module-level state — there is one chat panel per app, so a single
 * registration is sufficient. Calling this twice with different non-null
 * adapters replaces the previous one (the most recent registration wins);
 * a `console.warn` flags the overwrite so duplicate-provider mounts get
 * caught in dev.
 */
export declare function setEmbedAuthAdapter(adapter: EmbedAuthAdapter | null): void;
/**
 * `fetch` wrapper that attaches embed-proxy bearer headers (when
 * present in sessionStorage) and forces `credentials: 'same-origin'`
 * so Supabase auth cookies travel too.
 *
 * **Header merge direction (proxy WINS over caller):** the implementation
 * spreads `baseHeaders` first inside `applyProxyAuth`, then sets the
 * `Authorization` / `X-Chat-*` keys — so the proxy values take precedence
 * over anything the caller passed. The motivation is that the bearer +
 * act-as identity is the source of truth for embedded auth; a caller
 * accidentally passing a stale `Authorization` header should NOT override
 * the live proxy creds.
 *
 * **Cross-origin defense:** the wrapper assumes a same-origin `/api/…`
 * relative URL. Absolute URLs are accepted only when their origin matches
 * the current window's origin; cross-origin URLs throw before the bearer
 * leaves the page. This is a defense-in-depth guard for future call sites
 * — there is no legitimate cross-origin use of this fetch wrapper.
 *
 * **401 self-heal:** when a registered adapter supplies `refresh`, a `401`
 * response triggers a single token refresh + retry of the same request
 * (see `EmbedAuthAdapter.refresh`). This is the openframe `apiClient`'s
 * refresh-then-retry behaviour, lifted into the lib so embedded surfaces
 * no longer need a host-side `window.fetch` monkey-patch to survive an
 * expired access token mid-chat. With no adapter (or no `refresh`), the
 * 401 passes straight through unchanged.
 */
export declare function embedAuthedFetch(url: string, init?: RequestInit): Promise<Response>;
//# sourceMappingURL=embed-authed-fetch.d.ts.map