interface PresignR2Creds {
    endpoint: string;
    accessKeyId: string;
    secretAccessKey: string;
    region?: string;
}
interface PresignedR2Put {
    url: string;
    method: 'PUT';
    headers: Record<string, string>;
}
declare class InvalidPresignKeyError extends Error {
    readonly name = "InvalidPresignKeyError";
    constructor(key: string);
}
/**
 * Mint a browser-direct PUT URL for one exact R2 object key.
 *
 * Authz floor: single exact key (never prefix/wildcard), PUT-only, required bounded
 * `expiresIn`, Content-Type bound in `X-Amz-SignedHeaders`.
 *
 * **Direct-PUT bypass contract (two control points):**
 * - **Pre-issue:** host MUST call `checkStorageQuota` before minting — bytes hit R2 on PUT.
 * - **Post-upload:** host MUST HEAD+range-GET first bytes → `detectMimeFromMagicBytes` + size,
 *   or use proxy/direct-POST where the worker sees bytes. Content-Type binding pins the declared
 *   type only — NOT spoof-protection.
 */
declare function presignR2Put(creds: PresignR2Creds, key: string, contentType: string, expiresIn: number): Promise<PresignedR2Put>;

export { InvalidPresignKeyError, type PresignR2Creds, type PresignedR2Put, presignR2Put };