/**
 * Auth header resolution.
 *
 * Maps the typed AuthConfig (apiKey / jwt / none) into the wire headers and
 * (for apiKey on GET only) a query-param fallback. Mirrors what TORUK-CORE's
 * api-key-auth.guard.ts accepts (header OR ?apikey=) so browser clients
 * survive proxies that strip custom headers during CORS preflight.
 *
 * NEVER emits x-organization-id or x-internal-org-id — TORUK-CORE derives
 * organization from the API key or JWT user membership, not from these
 * headers (verified 2026-05-12 against packages/server/src/features/
 * predictions/guards/optional-auth.guard.ts).
 */
import type { AuthConfig } from '../types/auth';
export type ResolvedAuth = {
    headers: Record<string, string>;
    /** URL query string param to append (e.g. 'apikey=xxx') on GET fallback, or undefined. */
    queryParam?: {
        name: 'apikey';
        value: string;
    };
};
export declare function resolveAuthHeaders(auth: AuthConfig, opts: {
    method: string;
}): ResolvedAuth;
/**
 * Append a query parameter to a URL without overwriting an existing one
 * of the same name. Used only for the explicit `apiKey` AuthConfig on GET —
 * never for a credential read from ambient page state.
 */
export declare function withQueryParam(url: string, name: string, value: string): string;
/**
 * Run a request through a JWT refresh-on-401 retry, if a refresh callback
 * is supplied. The runner receives the latest auth (with refreshed token)
 * and re-runs once. After the second 401, throws TorukSdkError.
 */
export declare function runWithJwtRefresh<T>(auth: AuthConfig, runner: (auth: AuthConfig) => Promise<{
    result: T;
    status: number;
}>): Promise<T>;