export interface UploadResult {
    id: string;
    filename: string;
    downloadUrl: string;
}
/**
 * True when `downloadUrl` points at the same origin (scheme+host+port) as the
 * configured server. Restores attach the agent's `serverApiKey` as a Bearer
 * token and overwrite the workspace, so a frame-supplied URL to an attacker
 * host must never be honored (credential exfiltration + workspace poisoning).
 * Scheme is normalized (ws→http / wss→https) so a wss:// serverBaseUrl matches
 * an https:// download URL.
 */
export declare function isTrustedDownloadUrl(downloadUrl: string, serverBaseUrl: string): boolean;
/** Upload a backup zip to `POST /api/agents/{agentId}/exports`. */
export declare function uploadAgentBackup(zipPath: string, agentId: string, serverBaseUrl: string, serverApiKey: string): Promise<UploadResult>;
/** Download a zip from a URL (authenticated) and save to destPath. */
export declare function downloadAgentBackup(downloadUrl: string, destPath: string, serverApiKey: string): Promise<void>;