/**
 * The ONE place agents-cli talks to its account backend (Phoenix ID).
 *
 * Why a seam at all: the removed Prix-coupled layer (RUSH-2581) had no single
 * entry point — the backend URL was hardcoded in five files and the session
 * token was re-read from `~/.rush/user.yaml` by seven separate functions, so
 * re-pointing identity meant editing a dozen call sites and rewriting error
 * strings scattered through the tree. This module is the correction: one base
 * URL, one token reader, one HTTP funnel, one error type. Commands import from
 * here and nothing else.
 *
 * The shape mirrors the seams this repo already proved elsewhere —
 * `SyncBackend` (`lib/secrets/sync-backend.ts`) and `CloudProvider`
 * (`lib/cloud/types.ts`) — so a second identity backend, if one is ever
 * needed, is a swap here rather than a sweep across commands.
 */
/**
 * Where the account backend lives. Config, never a literal at a call site.
 *
 * The default is Phoenix ID's branded custom domain. The legacy workers.dev
 * hostname remains live for already-released clients, but new clients and
 * managed Workers must share this canonical base so token verification cannot
 * drift across the release boundary.
 */
export declare const DEFAULT_PHOENIX_ID_BASE = "https://id.byphoenix.com";
export declare const PHOENIX_ID_BASE: string;
/** Our own session file. agents-cli never reads another product's credentials. */
export declare function sessionFilePath(): string;
export interface PhoenixSession {
    access_token: string;
    email?: string;
    userId?: string;
    /**
     * Hosted OAuth profile image (https URL), when Phoenix ID exposes one. Wins
     * over the email-Gravatar fallback in share attribution. Optional forever —
     * a missing value just means the Gravatar/initials fallback.
     */
    avatarUrl?: string;
    /** Unix ms; absent means the server did not scope the token's lifetime. */
    expires_at?: number;
}
export declare function readSession(): PhoenixSession | null;
export declare function writeSession(session: PhoenixSession): void;
export declare function clearSession(): void;
/** An error carrying the server's status and message, so callers can branch on it. */
export declare class PhoenixApiError extends Error {
    readonly status: number;
    constructor(message: string, status: number);
}
interface RequestOptions {
    body?: unknown;
    /** Send the stored session token. Default true; the device-flow start does not. */
    auth?: boolean;
    /** Use this token instead of the stored one (mid-login, before the write). */
    token?: string;
    timeoutMs?: number;
}
/** The single HTTP funnel. Every request to the account backend goes through here. */
export declare function phoenixRequest<T>(method: 'GET' | 'POST' | 'PATCH' | 'DELETE', route: string, opts?: RequestOptions): Promise<T>;
export {};
