export interface ClientConnectEnv {
    CORTEX_SERVER_URL?: string;
    CORTEX_SERVER_HOST?: string;
    CORTEX_SERVER_PORT?: string;
    CF_ACCESS_CLIENT_ID?: string;
    CF_ACCESS_CLIENT_SECRET?: string;
    CORTEX_CLIENT_TOKEN?: string;
    [key: string]: string | undefined;
}
/**
 * Resolve the WebSocket URL the cortex-client dials.
 *
 * A full ``CORTEX_SERVER_URL`` (e.g. ``wss://cortex.fangxm.me``) takes
 * precedence so the client can reach the agent-server through a Cloudflare
 * Tunnel over 443/TLS. Otherwise it falls back to ``ws://<host>:<port>`` for
 * direct/LAN reach.
 */
export declare function resolveServerUrl(env: ClientConnectEnv): string;
/**
 * Cloudflare Access service-token headers, returned only when both the client
 * id and secret are configured. These let the cortex-client pass a Cloudflare
 * Access policy placed in front of the tunnel (the agent-server WebSocket has
 * no auth of its own, so Access is the gate when it is exposed publicly).
 */
export declare function buildAccessHeaders(env: ClientConnectEnv): Record<string, string> | undefined;
/**
 * Connection headers the cortex-client sends on the WebSocket upgrade. Combines the
 * optional Cloudflare Access service-token headers with the Cortex bearer token
 * (``x-cortex-token`` from ``CORTEX_CLIENT_TOKEN``) that the agent-server's WebSocket
 * gate requires. Returns undefined when neither is configured.
 */
export declare function buildAuthHeaders(env: ClientConnectEnv): Record<string, string> | undefined;