import type { MisinaContext, MisinaPlugin } from "../types.mjs";
export type TokenSource = string | (() => string | Promise<string>);
/**
* Add an `Authorization: Bearer <token>` header to every request. Token can
* be a string, a function, or a function returning a Promise — fetched once
* per request.
*/
export declare function bearer(source: TokenSource): MisinaPlugin;
/**
* Add an `Authorization: Basic <base64>` header. Username and password are
* base64'd on each request — function form supported for rotation.
*/
export declare function basic(user: TokenSource, pass: TokenSource): MisinaPlugin;
export interface RefreshOn401Options {
	/** Async function that refreshes the token. Concurrent 401s collapse onto one call. */
	refresh: () => string | Promise<string>;
	/** Read the current token (used to set Authorization on the *next* request). */
	getToken?: () => string | Promise<string>;
	/** Predicate to decide when to refresh. Default: `response.status === 401`. */
	shouldRefresh?: (ctx: MisinaContext) => boolean;
}
/**
* Refresh the auth token on a 401 response and retry the request once. All
* concurrent 401s share a single in-flight refresh (mutex). A retried
* request that itself returns 401 is NOT refreshed again — it surfaces to
* the caller so they can prompt for re-login.
*
* Uses the `extend` slot because the afterResponse hook needs a reference
* to the surrounding misina to dispatch the retry call.
*/
export declare function refreshOn401(opts: RefreshOn401Options): MisinaPlugin;
/**
* Read a CSRF token from a cookie and echo it as a header. Common in
* Django/Rails/Laravel apps.
*/
export declare function csrf(opts?: {
	cookieName?: string;
	headerName?: string;
	/** Read cookies. Default: `document.cookie` in browser. */
	getCookies?: () => string;
}): MisinaPlugin;