/** Header name carrying the bearer token on both the WS upgrade and webhook requests. */
export declare const AUTH_HEADER = "x-cortex-token";
/** Env var holding the cortex-client ↔ server WebSocket token. */
export declare const CLIENT_TOKEN_ENV = "CORTEX_CLIENT_TOKEN";
/** Env var holding the webhook HTTP bearer token. */
export declare const WEBHOOK_TOKEN_ENV = "CORTEX_WEBHOOK_TOKEN";
/**
 * Constant-time string comparison. Returns false (fail-closed) when either side is
 * empty/undefined or the lengths differ — an unset configured token never matches.
 */
export declare function timingSafeEqualStr(a: string | undefined, b: string | undefined): boolean;
/** Read the configured client (WebSocket) token at call time (after dotenv loads). */
export declare function getClientToken(): string;
/** Read the configured webhook token at call time (after dotenv loads). */
export declare function getWebhookToken(): string;
export interface EnsureAuthTokensOptions {
    /** Path to the .env file to persist generated tokens into. Defaults to CONFIG_DIR/.env. */
    envPath?: string;
    /** Env object to read/mutate. Defaults to process.env (injectable for tests). */
    env?: Record<string, string | undefined>;
}
export interface EnsureAuthTokensResult {
    clientToken: string;
    webhookToken: string;
    /** Names of tokens that were freshly generated this call (empty when all pre-existed). */
    generated: string[];
}
/**
 * Ensure both auth tokens exist. For each missing/blank token: generate a 32-byte hex
 * secret, set it on `env`, and (if anything was generated) append the new keys to the
 * .env file so they survive restarts. Idempotent — pre-existing tokens are left untouched.
 *
 * Called once at server startup BEFORE the WebSocket and webhook servers start, so both
 * surfaces enforce a real token (fail-closed).
 */
export declare function ensureAuthTokens(opts?: EnsureAuthTokensOptions): EnsureAuthTokensResult;