/**
 * R2 credential resolution + this machine's stable identity. Two consumers read
 * these fields: `agents sessions export --encrypt` / `import` use only the shared
 * `R2_SYNC_ENC_KEY` transcript key (`resolveSyncEncKey`), falling back to an
 * ephemeral key when no bundle is configured; and the off-box backup target
 * (`agents sessions export --to-r2` / `import --from-r2`, RUSH-2437) uses the full
 * credential set (account/bucket/access keys/endpoint) to talk to R2 through the
 * network client in `./r2.ts`. The `--to-r2`/`--from-r2` paths gate on
 * `isSyncConfigured()` and fail loud when the bundle is absent (no silent
 * fallback). This is a pure on-demand backup target, NOT the retired R2/CRDT
 * background sync. Credentials come from the `r2.backups` secrets bundle (OS
 * keychain on macOS, libsecret on Linux) — never from env or disk.
 */
/** Secrets bundle holding the R2 credentials. */
export declare const SYNC_BUNDLE = "r2.backups";
export interface R2Config {
    accountId: string;
    bucket: string;
    accessKeyId: string;
    secretAccessKey: string;
    /** S3-compatible endpoint for the account (no bucket, no trailing slash). */
    endpoint: string;
    /**
     * Shared 32-byte key (hex or base64) for client-side transcript encryption,
     * held in the bundle as `R2_SYNC_ENC_KEY`. Optional and deliberately separate
     * from the R2 credentials so rotating the access token never orphans already
     * encrypted bundles. `agents sessions export --encrypt` prefers this key when
     * present, else mints and prints an ephemeral one — see transcript-crypto.ts.
     */
    syncEncKey?: string;
}
/** Drop the cached resolution so the next call reads the bundle fresh. Called on
 *  daemon SIGHUP (to pick up rotated credentials) and between tests. */
export declare function clearR2ConfigCache(): void;
/**
 * Resolve R2 credentials, reading the keychain at most once per process. The
 * read is `agentOnly` (resolveR2Config), so it never prompts: a `never`/no-ACL or
 * broker-held bundle resolves silently and is memoized; a locked `hold`/`always`
 * bundle throws the actionable "unlock r2.backups" error. Throws (not memoized)
 * when the bundle/keys are missing or locked — isSyncConfigured catches the throw
 * and degrades to no-transport.
 */
export declare function loadR2Config(): R2Config;
/**
 * True when the sync bundle exists and resolves, without throwing. A missing OR
 * locked bundle resolves to false (session-sync degrades to no-transport) and,
 * because the `agentOnly` read never prompts, it is re-checked each cycle — so a
 * later `agents secrets add` / `agents secrets unlock r2.backups` is picked up
 * promptly with no daemon restart. `now` is accepted for a stable test signature
 * but no longer gates a cooldown (there is no prompt-bearing failure to back off).
 */
export declare function isSyncConfigured(_now?: number): boolean;
export { machineId, normalizeHost } from '../../machine-id.js';
