/**
 * SessionsBackend — the token-source seam for `agents sessions export --to-r2` /
 * `import --from-r2`.
 *
 * Two legitimate principals, picked once at backup time through the ONE shared
 * managed-vs-BYO policy (`selectStorageBackendKind`):
 *
 *   - **managed**: the caller is signed in to Phoenix (`readSession()`), no
 *     explicit BYO override. Token is the Phoenix access_token; endpoint is the
 *     managed `sessions.agents-cli.sh` Worker; the namespace is the verified
 *     userId. ZERO Cloudflare setup — the user never provisions an r2.backups
 *     bucket. This is the whole point of the surface (the sessions analogue of
 *     managed `agents traces sync`).
 *   - **byo**: the existing `r2.backups` secrets bundle (`loadR2Config()`).
 *     Unchanged for power users / self-hosters / a zero-knowledge backup that
 *     Phoenix can never read.
 *
 * MANAGED-FIRST — the mere PRESENCE of an r2.backups bundle is NOT a BYO
 * override. A signed-in user with a stale r2.backups bundle still backs up to
 * managed unless they opt out explicitly: `--byo`, `AGENTS_SESSIONS_BACKEND=byo`,
 * or a DI write token. This mirrors `lib/share/backend.ts` (a persisted BYO
 * config is deliberately not an override) so the product's managed-first
 * contract is identical across surfaces.
 */
import { type PhoenixSession } from '../../identity/client.js';
import { type R2Config } from './config.js';
export type SessionsBackendKind = 'managed' | 'byo';
/** Env var that forces the BYO path. Value must be exactly `byo`. */
export declare const SESSIONS_BACKEND_ENV = "AGENTS_SESSIONS_BACKEND";
export interface ManagedSessionsBackend {
    kind: 'managed';
    /** Public base URL of the managed sessions Worker, no trailing slash. */
    baseUrl: string;
    /** Bearer sent as `Authorization`. The Phoenix access_token. */
    token: string;
    /** Phoenix userId — the object-store namespace prefix (path segment 0). */
    userId: string;
}
export interface ByoSessionsBackend {
    kind: 'byo';
    /** The resolved r2.backups credentials for the S3-compatible client. */
    r2: R2Config;
}
export type SessionsBackend = ManagedSessionsBackend | ByoSessionsBackend;
export interface ResolveSessionsBackendOpts {
    /** Force the BYO r2.backups path even when signed in. */
    byo?: boolean;
    /** DI seam — a static write token selects BYO (tests / self-host). */
    writeToken?: string;
    /** DI seam — override `readSession()`. `null` means explicitly signed out. */
    session?: PhoenixSession | null;
}
/** True when the shared policy resolves to the managed principal for sessions. */
export declare function shouldUseManagedSessions(opts?: ResolveSessionsBackendOpts): boolean;
/**
 * Resolve the backend for a session backup / restore. Managed when signed in and
 * no explicit BYO override; otherwise BYO. Fails loud when neither principal can
 * authenticate — the actionable message ("run auth login" or "add r2.backups")
 * lives here, not in the shared policy.
 */
export declare function resolveSessionsBackend(opts?: ResolveSessionsBackendOpts): SessionsBackend;
