export interface EmbedProxyAuth {
    secret: string;
    email: string;
    /** Optional identity passthrough — empty/omitted = not sent. Server
     *  parses these as `X-Chat-{First,Last}-Name` / `X-Chat-Avatar-Url` and
     *  threads them through `resolveChatProxyIdentity`'s returned user. */
    firstName?: string;
    lastName?: string;
    avatarUrl?: string;
}
/**
 * Returns full credentials (secret + email + optional identity passthrough)
 * when secret + email are available. Returns `null` when nothing is saved —
 * callers treat that as "fall back to cookie auth".
 */
export declare function getEmbedProxyAuth(): EmbedProxyAuth | null;
/**
 * Returns the LAST email the admin saved. The proxy creds bar reads
 * this to pre-fill the email field on mount.
 */
export declare function getPersistedProxyEmail(): string | null;
/** Save the proxy creds. Secret + email are required; identity-passthrough
 *  fields are persisted only when non-empty. */
export declare function setEmbedProxyAuth(value: EmbedProxyAuth): void;
/** Drop the persisted creds. */
export declare function clearEmbedProxyAuth(): void;
/**
 * Apply the embed-proxy auth (Bearer + X-Chat-Act-As) to a fetch call's
 * URL + headers. Used by every embedded-surface route that needs to
 * identify itself as the proxied customer (chat stream, agent-* routes,
 * ticket-center actions). When proxy auth is absent (regular
 * cookie-session users), returns the inputs unchanged so the cookie-auth
 * path still works.
 *
 * `X-Chat-Act-As` header (vs a URL query param) keeps PII out of access
 * logs, Sentry breadcrumbs, browser history, and CDN analytics.
 */
export declare function applyProxyAuth(url: string, baseHeaders?: Record<string, string>): {
    url: string;
    headers: Record<string, string>;
};
//# sourceMappingURL=embed-proxy-auth-storage.d.ts.map