export function adminReadHeaders(token: string): Record<string, string> {
  return { Authorization: `Bearer ${token}` };
}

/** Headers required for mutating admin routes (session + double-submit CSRF). */
export function adminMutatingHeaders(token: string, csrfToken: string): Record<string, string> {
  return {
    Authorization: `Bearer ${token}`,
    'X-CSRF-Token': csrfToken,
    Cookie: `zyphon_session=${token}; zyphon_csrf=${csrfToken}`,
  };
}