import type { AuthHeader } from './protocol.js';
/** Must match the server's AUTH_HEADER (pinned by a server-side test). */
export declare const AUTH_HEADER: AuthHeader;
/**
 * Resolve the WS bearer token. Env (CORTEX_CLIENT_TOKEN) takes precedence so an operator can
 * override; otherwise the durable `clientToken` from cortex-client.json is used. The config
 * path is the robust distribution channel (no reliance on the client process's inherited env,
 * which is fragile under systemd / SSH spawn). Returns '' when neither is set.
 */
export declare function resolveClientToken(cfg: {
    clientToken?: string;
}, env: {
    CORTEX_CLIENT_TOKEN?: string;
}): string;
/** WS upgrade headers carrying the bearer token, or undefined when no token is configured. */
export declare function buildClientHeaders(token: string): Record<string, string> | undefined;