export interface S3PresignParams {
    /** Base endpoint, e.g. `http://minio.minio.svc.cluster.local:9000` (the host the SANDBOX will reach). */
    endpoint: string;
    bucket: string;
    /** Object key (path within the bucket); each "/" segment is encoded, "/" preserved. */
    key: string;
    method: "GET" | "PUT" | "HEAD" | "DELETE";
    accessKey: string;
    secretKey: string;
    region?: string;
    expiresSec?: number;
    /** Override the signing clock (tests). Defaults to now. */
    now?: Date;
}
/** Build a SigV4 presigned **single-object** URL. Pure string math — no network. */
export declare function presignS3Url(p: S3PresignParams): string;
export interface S3BucketPresignParams {
    endpoint: string;
    bucket: string;
    /** Bucket-level verbs only: PUT = CreateBucket, DELETE = DeleteBucket (MinIO path-style, live-verified). */
    method: "PUT" | "DELETE";
    accessKey: string;
    secretKey: string;
    region?: string;
    expiresSec?: number;
    /** Override the signing clock (tests). Defaults to now. */
    now?: Date;
}
/** Build a SigV4 presigned **bucket-level** URL (`/<bucket>/`, no key) — the explicit face for
 *  CreateBucket/DeleteBucket (codex 1.189 F8: previously test fixtures smuggled this through
 *  presignS3Url with key "", which the single-object contract now rejects). Same signing core. */
export declare function presignS3BucketUrl(p: S3BucketPresignParams): string;
/** ListObjectsV2 presign(D-1 孤儿对象 GC,clay 拍 2026-07-28):GET `/<bucket>/?list-type=2&prefix=…`。
 *  bucket 级 GET 是**列举能力**——只给 server 端 sweep 用,URL 绝不外发(与 copy 面同纪律)。 */
export declare function presignS3ListUrl(p: {
    endpoint: string;
    bucket: string;
    prefix: string;
    continuationToken?: string;
    maxKeys?: number;
    accessKey: string;
    secretKey: string;
    region?: string;
    expiresSec?: number;
    now?: Date;
}): string;
export interface S3CopyPresignParams {
    /** INTERNAL endpoint — CopyObject is a SERVER-side request with adapter creds; never hand this URL out. */
    endpoint: string;
    /** Destination coordinates (the PUT target). */
    bucket: string;
    key: string;
    /** Source coordinates (ride the signed `x-amz-copy-source` header). */
    sourceBucket: string;
    sourceKey: string;
    accessKey: string;
    secretKey: string;
    region?: string;
    expiresSec?: number;
    now?: Date;
}
/** Build a SigV4 presigned **CopyObject** request (修3 staging-key two-phase): S3 CopyObject = `PUT
 *  /<dstBucket>/<dstKey>` with `x-amz-copy-source: /<srcBucket>/<srcKey>`. Query auth requires every
 *  `x-amz-*` request header to be SIGNED, so the copy-source header goes through the signing core's
 *  signedHeaders seam; the caller MUST send `headers` verbatim on the fetch (the source key is
 *  RFC-3986-encoded — MinIO/S3 both accept the encoded copy-source form, and header values must be
 *  ASCII anyway). Same single-object guards as presignS3Url on BOTH sides. */
export declare function presignS3CopyUrl(p: S3CopyPresignParams): {
    url: string;
    headers: Record<string, string>;
};
//# sourceMappingURL=s3-presign.d.ts.map