import { type AwsCredentials } from "./credentials.js";
import { type AwsPartition } from "./endpoints.js";
import type { Run } from "../../runtime/asyncContext.js";
import { type ResultFailure } from "../../runtime/result.js";
/**
 * An atomic request target: a validated HTTPS origin and a canonical URI.
 * Transport derives the one wire URL from these, so no API ever carries an
 * independently supplied wire/signing path pair. Query-bearing operations are
 * out of scope for this S3 v1 target; add them later by extending the
 * constructor, not by exposing a raw URL.
 */
export type AwsRequestTarget = {
    readonly origin: string;
    readonly canonicalUri: string;
};
/**
 * Build a request target. Rejects an origin that is not bare `https://host`, and
 * a canonical URI that does not start with `/` or that contains query/fragment
 * delimiters.
 */
export declare function createAwsRequestTarget(origin: string, canonicalUri: string): AwsRequestTarget;
export type AwsRequest = {
    readonly target: AwsRequestTarget;
    readonly method: "GET" | "PUT";
    readonly service: "s3";
    readonly body?: Uint8Array | string;
    readonly headers: Readonly<Record<string, string>>;
};
export type AwsResponse = {
    readonly ok: boolean;
    readonly status: number;
    readonly statusText: string;
    readonly url: string;
    readonly bytes: Uint8Array;
    readonly headers: Headers;
};
/**
 * The final hostname defense: the target's derived wire URL must sit under the
 * resolved partition suffix. Presigning bypasses `sendAwsRequest`, so it must
 * call this itself — the check is NOT inherited from transport.
 */
export declare function hostOutsidePartitionFailure(target: AwsRequestTarget, partition: AwsPartition): ResultFailure | null;
/**
 * Sign and send one AWS request. Derives the single wire URL from the target,
 * validates its hostname against the partition suffix before signing or
 * fetching, and returns metadata + body bytes for every received HTTP response
 * (the product layer interprets non-2xx). Abort/network failures propagate as
 * thrown errors via `runHttp`.
 */
export declare function sendAwsRequest(run: Run, partition: AwsPartition, credentials: AwsCredentials, request: AwsRequest): Promise<AwsResponse | ResultFailure>;