/**
 * Shared sign-and-forward orchestration for S3 and Adobe da.live mounts.
 *
 * The browser-side mount backends never compute SigV4 signatures or hold
 * credentials. They post envelopes through a transport (CLI: HTTP POST to
 * node-server's `/api/s3-sign-and-forward`; extension: `chrome.runtime`
 * message to the service worker). All transports ultimately call into this
 * module, which validates the envelope, resolves credentials via a pluggable
 * async secret getter, signs (S3) or attaches a Bearer token (DA), forwards
 * to upstream, and returns a JSON-cloneable reply.
 *
 * `executeS3SignAndForward` / `executeDaSignAndForward` are consumed by:
 *   - `packages/chrome-extension/src/service-worker.ts` (extension path,
 *     reads from `chrome.storage.local`)
 *   - `packages/node-server/src/secrets/sign-and-forward.ts` (CLI path,
 *     wraps these in Express handlers via a SecretStore adapter)
 *   - tests in `packages/shared-ts/tests/sign-and-forward.test.ts`
 */
declare const ALLOWED_METHODS: readonly ['GET', 'PUT', 'POST', 'DELETE', 'HEAD'];
type SignedMethod = (typeof ALLOWED_METHODS)[number];
export interface S3SignAndForwardEnvelope {
    profile: string;
    method: SignedMethod;
    bucket: string;
    key: string;
    query?: Record<string, string>;
    headers?: Record<string, string>;
    bodyBase64?: string | null;
}
export interface DaSignAndForwardEnvelope {
    imsToken: string;
    method: SignedMethod;
    /** Path including leading slash, e.g. `/source/<org>/<repo>/<key>`. */
    path: string;
    /**
     * Upstream origin. Omit for `https://admin.da.live` (Helix 5 DA);
     * `https://api.aem.live` selects the Helix 6 Source Bus. Anything
     * else is rejected as `invalid_request`.
     */
    origin?: string;
    query?: Record<string, string>;
    headers?: Record<string, string>;
    bodyBase64?: string | null;
}
export type SignAndForwardErrorCode = 'invalid_profile' | 'invalid_request' | 'profile_not_configured' | 'fetch_failed' | 'internal';
export interface SignAndForwardSuccess {
    ok: true;
    status: number;
    headers: Record<string, string>;
    bodyBase64: string;
}
export interface SignAndForwardFailure {
    ok: false;
    error: string;
    errorCode: SignAndForwardErrorCode;
}
export type SignAndForwardReply = SignAndForwardSuccess | SignAndForwardFailure;
/**
 * Async secret getter — async to support `chrome.storage.local` directly.
 * Returns `undefined` for missing keys.
 */
export interface SecretGetter {
    get(key: string): Promise<string | undefined>;
}
/**
 * S3 sign-and-forward. See module header for the architecture context.
 *
 * @param env       Validated envelope from a transport layer.
 * @param store     Async secret getter (chrome.storage in SW; mock in tests).
 * @param fetchImpl Injectable fetch — defaults to `globalThis.fetch`.
 */
export declare function executeS3SignAndForward(env: Partial<S3SignAndForwardEnvelope> | undefined, store: SecretGetter, fetchImpl?: typeof fetch): Promise<SignAndForwardReply>;
/**
 * DA sign-and-forward. The IMS bearer token is passed transiently in the
 * envelope (the browser already holds it via the existing Adobe LLM
 * provider OAuth flow). Routing through this module gives architectural
 * parity with S3 and a clean migration point for v2 server-side OAuth.
 */
export declare function executeDaSignAndForward(env: Partial<DaSignAndForwardEnvelope> | undefined, fetchImpl?: typeof fetch): Promise<SignAndForwardReply>;
export {};
//# sourceMappingURL=sign-and-forward.d.ts.map