//#region src/presign-s3compat.d.ts
interface PresignR2Creds {
  endpoint: string;
  accessKeyId: string;
  secretAccessKey: string;
  region?: string;
}
interface PresignedR2Put {
  url: string;
  method: 'PUT';
  headers: Record<string, string>;
}
declare class InvalidPresignKeyError extends Error {
  readonly name = "InvalidPresignKeyError";
  constructor(key: string);
}
/**
 * Mint a browser-direct PUT URL for one exact R2 object key.
 *
 * Authz floor: single exact key (never prefix/wildcard), PUT-only, required bounded
 * `expiresIn`, Content-Type bound in `X-Amz-SignedHeaders`.
 *
 * **Direct-PUT bypass contract (two control points):**
 * - **Pre-issue:** host MUST call `checkStorageQuota` before minting — bytes hit R2 on PUT.
 * - **Post-upload:** host MUST HEAD+range-GET first bytes → `detectMimeFromMagicBytes` + size,
 *   or use proxy/direct-POST where the worker sees bytes. Content-Type binding pins the declared
 *   type only — NOT spoof-protection.
 */
declare function presignR2Put(creds: PresignR2Creds, key: string, contentType: string, expiresIn: number): Promise<PresignedR2Put>;
//#endregion
export { InvalidPresignKeyError, PresignR2Creds, PresignedR2Put, presignR2Put };