/**
 * The CLI's bearer: `WICKED_CREW_TOKEN`, and the one line we say when it is missing.
 *
 * Exported from a side-effect-free module (not from cli/index.ts, which calls main() on import)
 * so tests can verify header injection without spawning the dist CLI or triggering the daemon.
 *
 * The two names are one character apart with OPPOSITE meanings (#637), which is why the advice
 * below spells both out:
 *   - `WICKED_CREW_TOKEN`  (singular) — the CLIENT's bearer. This file. Sent as `Authorization`.
 *   - `WICKED_CREW_TOKENS` (plural)   — the DAEMON's token FILE path (`api/auth.ts`), i.e. who may
 *     call it. Setting it in a client shell grants the client nothing.
 * An operator who follows the documented plural gets 401 on every verb, so the plural is refused
 * loudly rather than accepted as an alias: its value is a file path, and sending a path as a bearer
 * would 401 exactly the same way, one step further from the cause.
 */
/** The client's bearer variable. */
export declare const CLIENT_TOKEN_ENV = "WICKED_CREW_TOKEN";
/** The daemon's token-file variable — NOT a bearer. */
export declare const DAEMON_TOKENS_ENV = "WICKED_CREW_TOKENS";
export declare function withBearerHeader(init: RequestInit | undefined, env?: NodeJS.ProcessEnv): RequestInit;
/**
 * A 401/403 from the daemon when this CLI sent no bearer is the silent failure #637 is about: an
 * operator who set the documented plural variable gets 401 on every verb with nothing naming the
 * cause. Say the cause ONCE per process, then let the caller's own non-2xx line report the status.
 *
 * Returns the line it said, or `null` when it said nothing (a bearer WAS sent, the status is not a
 * refusal, or it has already spoken).
 */
export declare function warnIfUnauthorizedWithoutBearer(status: number, env?: NodeJS.ProcessEnv, say?: (line: string) => void): string | null;
/** The advice text without the once-per-process latch — for docs, tests and other callers. */
export declare function missingBearerAdvice(env?: NodeJS.ProcessEnv): string | null;
/** Test seam: the latch is process state, so a suite asserting "once" must be able to reset it. */
export declare function resetBearerAdviceLatch(): void;
//# sourceMappingURL=bearer.d.ts.map