/**
 * Server-side request signing for S3 and Adobe da.live mounts.
 *
 * The browser-side mount backends never see real S3 credentials or the IMS
 * bearer token. They post envelopes to `/api/s3-sign-and-forward` and
 * `/api/da-sign-and-forward`, which:
 *  1. Validate the envelope.
 *  2. Resolve credentials server-side (S3) or accept a transient bearer (DA).
 *  3. Reconstruct the upstream URL from profile config (S3) or the path
 *     prefix (DA) — so the browser cannot SSRF arbitrary hosts.
 *  4. Sign with SigV4 v4 (S3) or attach `Authorization: Bearer` (DA).
 *  5. Forward to the upstream and return the response as a JSON envelope.
 *
 * The validate → resolve → sign → forward pipeline is shared with the
 * extension service worker via `@slicc/shared-ts`. These handlers are thin
 * Express adapters: they bridge the node-server `SecretStore` to the shared
 * async `SecretGetter`, then map the structured reply onto an HTTP response.
 *
 * Logging contract: never log envelope contents — request bodies or the
 * `imsToken` may contain credential material.
 */
import type { Request, Response } from 'express';
import type { SecretStore } from './types.js';
export type { DaSignAndForwardEnvelope, S3SignAndForwardEnvelope } from '../_shared/index.js';
/**
 * Handle a `POST /api/s3-sign-and-forward` request. Validates the envelope,
 * resolves credentials, signs, forwards, returns a JSON envelope.
 *
 * Errors in setup return 400 with a structured `{ ok: false, error, errorCode }`.
 * Network errors against the upstream return 502.
 */
export declare function handleS3SignAndForward(req: Request, res: Response, secretStore: SecretStore): Promise<void>;
/**
 * Handle a `POST /api/da-sign-and-forward` request. Attaches the IMS bearer
 * token (passed transiently in the envelope), forwards to da.live, returns
 * a JSON envelope.
 *
 * v1: the IMS token comes from the browser at request time. The browser
 * already holds the token via the existing Adobe LLM provider OAuth flow;
 * routing through the server gives architectural symmetry with S3 and a
 * place to tighten the threat model in v2 (server-side OAuth).
 */
export declare function handleDaSignAndForward(req: Request, res: Response): Promise<void>;