import type { AxiosInstance } from 'axios';
/**
 * Returns an Axios instance that automatically attaches a valid Keycloak Bearer
 * token to same-origin requests via a request interceptor.
 *
 * If the current access token is expired, a silent renew via the refresh token
 * is attempted before the request is dispatched. If the user is not logged in
 * (getAccessToken returns null), the request continues without an Authorization
 * header. If token renewal fails (e.g., refresh token invalid), the error is
 * logged to the auth context and the request continues without auth.
 *
 * **Same-origin enforcement:** The token is attached only to requests where the
 * resolved URL has the same origin as `window.location`. Cross-origin requests
 * do not receive an Authorization header (CWE-319 mitigation).
 *
 * @param instance - An optional existing Axios instance to attach the interceptor
 * to. If omitted, a new `axios.create()` instance is returned. The same instance
 * reference is stable across re-renders unless the passed `instance` reference changes.
 *
 * @returns An Axios instance with request interception wired.
 *
 * @example
 * ```tsx
 * function MediaService() {
 *   const api = useAuthAxios();
 *   const fetchItems = () => api.get('/api/items');
 * }
 * ```
 *
 * @example With a shared instance:
 * ```tsx
 * const sharedAxios = axios.create({ baseURL: 'https://api.example.com' });
 *
 * function MediaService() {
 *   const api = useAuthAxios(sharedAxios);
 * }
 * ```
 *
 * @remarks
 * **Shared instances:** Interceptor registration is reference-counted per
 * `AxiosInstance` via an internal registry. The first `useAuthAxios` call for a
 * given instance registers a single request interceptor; subsequent calls that
 * share the same instance reference increment a reference count and reuse that
 * same interceptor instead of registering a new one. The interceptor is only
 * ejected once the last consumer unmounts (the reference count reaches 0).
 *
 * **Token renewal failures:** If token renewal fails (e.g., the refresh token is
 * expired or invalid), the auth context's error state is updated via `applyError`
 * and the request continues without an Authorization header. Monitor `useAuth().error`
 * or listen to error boundaries to detect and react to auth failures.
 */
export declare const useAuthAxios: (instance?: AxiosInstance) => AxiosInstance;
//# sourceMappingURL=useAuthAxios.d.ts.map