@atengk/mcp-server-s3 0.0.0-stage → 1.0.1

package/dist/index.d.ts

@@ -0,0 +1,1404 @@
+import { S3Client } from '@aws-sdk/client-s3';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+import http from 'node:http';
+
+/**
+ * 应用配置与环境契约模型定义
+ *
+ * @author Ateng
+ * @since 2026-10-04
+ */
+
+/**
+ * MCP 通信传输模式枚举
+ */
+declare const TransportModeSchema: z.ZodEnum<["stdio", "sse"]>;
+type TransportMode = z.infer<typeof TransportModeSchema>;
+/**
+ * S3 访问密钥凭证契约
+ */
+declare const S3CredentialsConfigSchema: z.ZodObject<{
+    accessKeyId: z.ZodString;
+    secretAccessKey: z.ZodString;
+    sessionToken: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string | undefined;
+}, {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string | undefined;
+}>;
+type S3CredentialsConfig = z.infer<typeof S3CredentialsConfigSchema>;
+/**
+ * S3 客户端底层连接配置契约
+ */
+declare const S3ClientConfigSchema: z.ZodObject<{
+    endpoint: z.ZodOptional<z.ZodString>;
+    region: z.ZodString;
+    credentials: z.ZodOptional<z.ZodObject<{
+        accessKeyId: z.ZodString;
+        secretAccessKey: z.ZodString;
+        sessionToken: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        accessKeyId: string;
+        secretAccessKey: string;
+        sessionToken?: string | undefined;
+    }, {
+        accessKeyId: string;
+        secretAccessKey: string;
+        sessionToken?: string | undefined;
+    }>>;
+    forcePathStyle: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    region: string;
+    forcePathStyle: boolean;
+    endpoint?: string | undefined;
+    credentials?: {
+        accessKeyId: string;
+        secretAccessKey: string;
+        sessionToken?: string | undefined;
+    } | undefined;
+}, {
+    region: string;
+    forcePathStyle: boolean;
+    endpoint?: string | undefined;
+    credentials?: {
+        accessKeyId: string;
+        secretAccessKey: string;
+        sessionToken?: string | undefined;
+    } | undefined;
+}>;
+type S3ClientConfig = z.infer<typeof S3ClientConfigSchema>;
+/**
+ * 12-Factor App 全局集中配置运行时校验 Schema
+ */
+declare const AppConfigSchema: z.ZodObject<{
+    transport: z.ZodEnum<["stdio", "sse"]>;
+    serverHost: z.ZodString;
+    serverPort: z.ZodNumber;
+    endpoint: z.ZodOptional<z.ZodString>;
+    region: z.ZodString;
+    accessKeyId: z.ZodOptional<z.ZodString>;
+    secretAccessKey: z.ZodOptional<z.ZodString>;
+    sessionToken: z.ZodOptional<z.ZodString>;
+    forcePathStyle: z.ZodBoolean;
+    defaultBucket: z.ZodOptional<z.ZodString>;
+    readOnly: z.ZodBoolean;
+    allowedLocalDir: z.ZodString;
+    maxReadBytes: z.ZodNumber;
+    presignedExpires: z.ZodNumber;
+    apiKey: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    transport: "stdio" | "sse";
+    serverHost: string;
+    serverPort: number;
+    region: string;
+    forcePathStyle: boolean;
+    readOnly: boolean;
+    allowedLocalDir: string;
+    maxReadBytes: number;
+    presignedExpires: number;
+    endpoint?: string | undefined;
+    accessKeyId?: string | undefined;
+    secretAccessKey?: string | undefined;
+    sessionToken?: string | undefined;
+    defaultBucket?: string | undefined;
+    apiKey?: string | undefined;
+}, {
+    transport: "stdio" | "sse";
+    serverHost: string;
+    serverPort: number;
+    region: string;
+    forcePathStyle: boolean;
+    readOnly: boolean;
+    allowedLocalDir: string;
+    maxReadBytes: number;
+    presignedExpires: number;
+    endpoint?: string | undefined;
+    accessKeyId?: string | undefined;
+    secretAccessKey?: string | undefined;
+    sessionToken?: string | undefined;
+    defaultBucket?: string | undefined;
+    apiKey?: string | undefined;
+}>;
+type AppConfig = z.infer<typeof AppConfigSchema>;
+
+/**
+ * S3 核心领域数据模型契约 (严格遵循 CONTEXT.md 统一领域语言)
+ *
+ * @author Ateng
+ * @since 2026-10-04
+ */
+
+/**
+ * 统一错误返回契约 Schema
+ */
+declare const ErrorResultSchema: z.ZodObject<{
+    status: z.ZodLiteral<"error">;
+    code: z.ZodString;
+    message: z.ZodString;
+    details: z.ZodOptional<z.ZodUnknown>;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+    message: string;
+    status: "error";
+    details?: unknown;
+}, {
+    code: string;
+    message: string;
+    status: "error";
+    details?: unknown;
+}>;
+type ErrorResult = z.infer<typeof ErrorResultSchema>;
+/**
+ * 存储桶 (Bucket) 基础信息契约
+ */
+interface BucketItem {
+    name: string;
+    creationDate?: Date;
+}
+/**
+ * 对象 (Object) 摘要契约
+ */
+interface S3ObjectItem {
+    key: string;
+    size?: number;
+    lastModified?: Date;
+    etag?: string;
+    storageClass?: string;
+}
+/**
+ * 虚拟目录公共前缀契约
+ */
+interface CommonPrefixItem {
+    prefix: string;
+}
+/**
+ * 对象列表分页查询结果契约
+ */
+interface ListObjectsResult {
+    bucket: string;
+    prefix?: string;
+    delimiter?: string;
+    objects: S3ObjectItem[];
+    commonPrefixes: string[];
+    nextContinuationToken?: string;
+    isTruncated: boolean;
+}
+/**
+ * 对象元数据与属性契约
+ */
+interface ObjectMetadata {
+    bucket: string;
+    key: string;
+    size?: number;
+    contentType?: string;
+    lastModified?: Date;
+    etag?: string;
+    metadata?: Record<string, string>;
+}
+/**
+ * 文本直读响应契约 (含截断警示)
+ */
+interface ReadObjectTextResult {
+    bucket: string;
+    key: string;
+    content: string;
+    truncated: boolean;
+    totalBytes?: number;
+    readBytes: number;
+    warning?: string;
+}
+/**
+ * HTTP Range 字节范围读取响应契约
+ */
+interface RangeReadResult {
+    bucket: string;
+    key: string;
+    startByte: number;
+    endByte: number;
+    contentLength: number;
+    dataBase64?: string;
+    text?: string;
+}
+/**
+ * 预签名 URL 直链结果契约
+ */
+interface PresignedUrlResult {
+    bucket: string;
+    key: string;
+    url: string;
+    expiresIn: number;
+    method: "GET" | "PUT";
+}
+/**
+ * 连通性自省探针 (s3_ping) 诊断结果契约
+ */
+declare const ConnectivityProbeResultSchema: z.ZodObject<{
+    status: z.ZodEnum<["ok", "error"]>;
+    endpoint: z.ZodOptional<z.ZodString>;
+    region: z.ZodString;
+    accessKeyIdMasked: z.ZodOptional<z.ZodString>;
+    rttMs: z.ZodNumber;
+    message: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    region: string;
+    message: string;
+    status: "error" | "ok";
+    rttMs: number;
+    endpoint?: string | undefined;
+    accessKeyIdMasked?: string | undefined;
+}, {
+    region: string;
+    message: string;
+    status: "error" | "ok";
+    rttMs: number;
+    endpoint?: string | undefined;
+    accessKeyIdMasked?: string | undefined;
+}>;
+type ConnectivityProbeResult = z.infer<typeof ConnectivityProbeResultSchema>;
+/**
+ * 对象键值标签项
+ */
+interface TagItem {
+    key: string;
+    value: string;
+}
+/**
+ * 对象标签字典映射
+ */
+type ObjectTags = Record<string, string>;
+
+/**
+ * MCP 工具输入输出契约与 Zod 运行时校验 Schema
+ *
+ * @author Ateng
+ * @since 2026-10-04
+ */
+
+/**
+ * 0. 连通性自省探针工具入参 Schema
+ */
+declare const S3PingSchema: z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>;
+type S3PingInput = z.infer<typeof S3PingSchema>;
+/**
+ * 1. 存储桶生命周期工具入参 Schemas
+ */
+declare const ListBucketsSchema: z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>;
+type ListBucketsInput = z.infer<typeof ListBucketsSchema>;
+declare const CreateBucketSchema: z.ZodObject<{
+    bucket: z.ZodString;
+    region: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    bucket: string;
+    region?: string | undefined;
+}, {
+    bucket: string;
+    region?: string | undefined;
+}>;
+type CreateBucketInput = z.infer<typeof CreateBucketSchema>;
+declare const DeleteBucketSchema: z.ZodObject<{
+    bucket: z.ZodString;
+    force: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    bucket: string;
+    force?: boolean | undefined;
+}, {
+    bucket: string;
+    force?: boolean | undefined;
+}>;
+type DeleteBucketInput = z.infer<typeof DeleteBucketSchema>;
+declare const GetBucketLocationSchema: z.ZodObject<{
+    bucket: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    bucket: string;
+}, {
+    bucket: string;
+}>;
+type GetBucketLocationInput = z.infer<typeof GetBucketLocationSchema>;
+/**
+ * 2. 检索探索定位工具入参 Schemas
+ */
+declare const ListObjectsSchema: z.ZodObject<{
+    bucket: z.ZodOptional<z.ZodString>;
+    prefix: z.ZodOptional<z.ZodString>;
+    delimiter: z.ZodOptional<z.ZodString>;
+    max_keys: z.ZodOptional<z.ZodNumber>;
+    continuation_token: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    bucket?: string | undefined;
+    prefix?: string | undefined;
+    delimiter?: string | undefined;
+    max_keys?: number | undefined;
+    continuation_token?: string | undefined;
+}, {
+    bucket?: string | undefined;
+    prefix?: string | undefined;
+    delimiter?: string | undefined;
+    max_keys?: number | undefined;
+    continuation_token?: string | undefined;
+}>;
+type ListObjectsInput = z.infer<typeof ListObjectsSchema>;
+declare const SearchObjectsSchema: z.ZodObject<{
+    bucket: z.ZodOptional<z.ZodString>;
+    query: z.ZodString;
+    prefix: z.ZodOptional<z.ZodString>;
+    max_results: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    query: string;
+    bucket?: string | undefined;
+    prefix?: string | undefined;
+    max_results?: number | undefined;
+}, {
+    query: string;
+    bucket?: string | undefined;
+    prefix?: string | undefined;
+    max_results?: number | undefined;
+}>;
+type SearchObjectsInput = z.infer<typeof SearchObjectsSchema>;
+declare const StatObjectSchema: z.ZodObject<{
+    bucket: z.ZodOptional<z.ZodString>;
+    key: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    key: string;
+    bucket?: string | undefined;
+}, {
+    key: string;
+    bucket?: string | undefined;
+}>;
+type StatObjectInput = z.infer<typeof StatObjectSchema>;
+/**
+ * 3. 内容检视分块工具入参 Schemas
+ */
+declare const ReadObjectTextSchema: z.ZodObject<{
+    bucket: z.ZodOptional<z.ZodString>;
+    key: z.ZodString;
+    max_bytes: z.ZodOptional<z.ZodNumber>;
+    encoding: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    key: string;
+    bucket?: string | undefined;
+    max_bytes?: number | undefined;
+    encoding?: string | undefined;
+}, {
+    key: string;
+    bucket?: string | undefined;
+    max_bytes?: number | undefined;
+    encoding?: string | undefined;
+}>;
+type ReadObjectTextInput = z.infer<typeof ReadObjectTextSchema>;
+declare const ReadObjectRangeSchema: z.ZodObject<{
+    bucket: z.ZodOptional<z.ZodString>;
+    key: z.ZodString;
+    start_byte: z.ZodNumber;
+    end_byte: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    key: string;
+    start_byte: number;
+    end_byte: number;
+    bucket?: string | undefined;
+}, {
+    key: string;
+    start_byte: number;
+    end_byte: number;
+    bucket?: string | undefined;
+}>;
+type ReadObjectRangeInput = z.infer<typeof ReadObjectRangeSchema>;
+/**
+ * 4. 双向流式传输工具入参 Schemas
+ */
+declare const PutObjectTextSchema: z.ZodObject<{
+    bucket: z.ZodOptional<z.ZodString>;
+    key: z.ZodString;
+    content: z.ZodString;
+    content_type: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    content: string;
+    key: string;
+    bucket?: string | undefined;
+    content_type?: string | undefined;
+}, {
+    content: string;
+    key: string;
+    bucket?: string | undefined;
+    content_type?: string | undefined;
+}>;
+type PutObjectTextInput = z.infer<typeof PutObjectTextSchema>;
+declare const UploadFileSchema: z.ZodObject<{
+    bucket: z.ZodOptional<z.ZodString>;
+    key: z.ZodString;
+    local_path: z.ZodString;
+    content_type: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    key: string;
+    local_path: string;
+    bucket?: string | undefined;
+    content_type?: string | undefined;
+}, {
+    key: string;
+    local_path: string;
+    bucket?: string | undefined;
+    content_type?: string | undefined;
+}>;
+type UploadFileInput = z.infer<typeof UploadFileSchema>;
+declare const DownloadFileSchema: z.ZodObject<{
+    bucket: z.ZodOptional<z.ZodString>;
+    key: z.ZodString;
+    local_path: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    key: string;
+    local_path: string;
+    bucket?: string | undefined;
+}, {
+    key: string;
+    local_path: string;
+    bucket?: string | undefined;
+}>;
+type DownloadFileInput = z.infer<typeof DownloadFileSchema>;
+declare const GetPresignedUrlSchema: z.ZodObject<{
+    bucket: z.ZodOptional<z.ZodString>;
+    key: z.ZodString;
+    expires_in: z.ZodOptional<z.ZodNumber>;
+    method: z.ZodOptional<z.ZodEnum<["GET", "PUT"]>>;
+}, "strip", z.ZodTypeAny, {
+    key: string;
+    method?: "GET" | "PUT" | undefined;
+    bucket?: string | undefined;
+    expires_in?: number | undefined;
+}, {
+    key: string;
+    method?: "GET" | "PUT" | undefined;
+    bucket?: string | undefined;
+    expires_in?: number | undefined;
+}>;
+type GetPresignedUrlInput = z.infer<typeof GetPresignedUrlSchema>;
+/**
+ * 5. 批处理与标签治理工具入参 Schemas
+ */
+declare const CopyObjectSchema: z.ZodObject<{
+    source_bucket: z.ZodOptional<z.ZodString>;
+    source_key: z.ZodString;
+    target_bucket: z.ZodOptional<z.ZodString>;
+    target_key: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    source_key: string;
+    target_key: string;
+    source_bucket?: string | undefined;
+    target_bucket?: string | undefined;
+}, {
+    source_key: string;
+    target_key: string;
+    source_bucket?: string | undefined;
+    target_bucket?: string | undefined;
+}>;
+type CopyObjectInput = z.infer<typeof CopyObjectSchema>;
+declare const MoveObjectSchema: z.ZodObject<{
+    source_bucket: z.ZodOptional<z.ZodString>;
+    source_key: z.ZodString;
+    target_bucket: z.ZodOptional<z.ZodString>;
+    target_key: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    source_key: string;
+    target_key: string;
+    source_bucket?: string | undefined;
+    target_bucket?: string | undefined;
+}, {
+    source_key: string;
+    target_key: string;
+    source_bucket?: string | undefined;
+    target_bucket?: string | undefined;
+}>;
+type MoveObjectInput = z.infer<typeof MoveObjectSchema>;
+declare const DeleteObjectSchema: z.ZodObject<{
+    bucket: z.ZodOptional<z.ZodString>;
+    key: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    key: string;
+    bucket?: string | undefined;
+}, {
+    key: string;
+    bucket?: string | undefined;
+}>;
+type DeleteObjectInput = z.infer<typeof DeleteObjectSchema>;
+declare const DeleteObjectsBatchSchema: z.ZodObject<{
+    bucket: z.ZodOptional<z.ZodString>;
+    keys: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    keys: string[];
+    bucket?: string | undefined;
+}, {
+    keys: string[];
+    bucket?: string | undefined;
+}>;
+type DeleteObjectsBatchInput = z.infer<typeof DeleteObjectsBatchSchema>;
+declare const DeleteObjectsByPrefixSchema: z.ZodObject<{
+    bucket: z.ZodOptional<z.ZodString>;
+    prefix: z.ZodString;
+    confirm_recursive_delete: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    prefix: string;
+    confirm_recursive_delete: boolean;
+    bucket?: string | undefined;
+}, {
+    prefix: string;
+    confirm_recursive_delete: boolean;
+    bucket?: string | undefined;
+}>;
+type DeleteObjectsByPrefixInput = z.infer<typeof DeleteObjectsByPrefixSchema>;
+declare const GetObjectTagsSchema: z.ZodObject<{
+    bucket: z.ZodOptional<z.ZodString>;
+    key: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    key: string;
+    bucket?: string | undefined;
+}, {
+    key: string;
+    bucket?: string | undefined;
+}>;
+type GetObjectTagsInput = z.infer<typeof GetObjectTagsSchema>;
+declare const SetObjectTagsSchema: z.ZodObject<{
+    bucket: z.ZodOptional<z.ZodString>;
+    key: z.ZodString;
+    tags: z.ZodRecord<z.ZodString, z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    key: string;
+    tags: Record<string, string>;
+    bucket?: string | undefined;
+}, {
+    key: string;
+    tags: Record<string, string>;
+    bucket?: string | undefined;
+}>;
+type SetObjectTagsInput = z.infer<typeof SetObjectTagsSchema>;
+
+/**
+ * 安全防御与防灾体系契约模型
+ *
+ * @author Ateng
+ * @since 2026-10-04
+ */
+
+/**
+ * 安全拦截检查结果契约
+ */
+interface SecurityCheckResult {
+    /**
+     * 是否允许继续执行目标操作
+     */
+    isAllowed: boolean;
+    /**
+     * 拦截或放行的业务/安全原因说明
+     */
+    reason?: string;
+}
+/**
+ * 文本内容截断与二进制检视结果契约
+ */
+interface ContentTruncationResult {
+    /**
+     * 最终呈现的文本内容 (超量时包含截断警示 notice)
+     */
+    content: string;
+    /**
+     * 是否触发了防爆截断或拦截
+     */
+    isTruncated: boolean;
+    /**
+     * 原始字节流的总字节数
+     */
+    totalBytes: number;
+    /**
+     * 本次实际读取并保留的字节数
+     */
+    readBytes: number;
+    /**
+     * 是否判定为二进制文件
+     */
+    isBinary: boolean;
+    /**
+     * 截断或二进制拦截诊断警告说明
+     */
+    warning?: string;
+}
+/**
+ * 安全违规错误类型枚举
+ */
+declare const SecurityErrorCodeSchema: z.ZodEnum<["READONLY_VIOLATION", "SANDBOX_VIOLATION", "PREFIX_DELETION_VIOLATION", "BINARY_CONTENT_DETECTED"]>;
+type SecurityErrorCode = z.infer<typeof SecurityErrorCodeSchema>;
+/**
+ * 安全防御违规专用业务异常
+ */
+declare class SecurityError extends Error {
+    readonly code: SecurityErrorCode;
+    constructor(code: SecurityErrorCode, message: string);
+}
+/**
+ * 业务操作受控异常 (Business Error)
+ */
+declare class BusinessError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+
+/**
+ * 环境变量解析器与集中配置管理中枢 (12-Factor App)
+ *
+ * @author Ateng
+ * @since 2026-10-04
+ */
+
+/**
+ * 从环境变量映射中按优先级提取值
+ *
+ * 优先读取 MCP_S3_* 规范前缀，缺失时依次降级尝试备选键名
+ *
+ * @param env 环境变量键值对
+ * @param canonicalKey 官方标准主键名 (如 MCP_S3_REGION)
+ * @param fallbackKeys 备选向下兼容键名列表 (如 AWS_REGION)
+ * @return 命中的非空字符串，未命中时返回 undefined
+ */
+declare function getEnvValue(env: NodeJS.ProcessEnv, canonicalKey: string, fallbackKeys?: string[]): string | undefined;
+/**
+ * 宽容布尔值转换器
+ *
+ * 支持 1, true, yes, on, t (大小写不敏感) 为 true；
+ * 0, false, no, off, f, 空字符串 为 false；其余情况返回 defaultValue。
+ *
+ * @param value 环境变量原始值
+ * @param defaultValue 缺省默认值
+ * @return 解析后的布尔值
+ */
+declare function parseBoolean(value: string | undefined, defaultValue: boolean): boolean;
+/**
+ * 通用安全整数数值解析器 (支持边界校验)
+ *
+ * @param value 原始环境变量字符串
+ * @param defaultValue 默认数值
+ * @param fieldName 字段名称 (用于友好错误提示)
+ * @param min 允许的最小值 (包含，缺省为 0)
+ * @param max 允许的最大值 (包含，缺省为 Number.MAX_SAFE_INTEGER)
+ * @return 解析后的有效整数数值
+ * @throws 当输入非整数或超出 [min, max] 区间时抛出语义化异常
+ */
+declare function parseNumber(value: string | undefined, defaultValue: number, fieldName: string, min?: number, max?: number): number;
+/**
+ * 校验并解析有效网络端口号 (1-65535)
+ *
+ * @param value 原始环境变量字符串
+ * @param defaultPort 默认端口
+ * @param fieldName 字段名称
+ * @return 解析后的有效端口号
+ */
+declare function parsePort(value: string | undefined, defaultPort: number, fieldName: string): number;
+/**
+ * 校验并解析正整数数值 (>= 1)
+ *
+ * @param value 原始环境变量字符串
+ * @param defaultValue 默认数值
+ * @param fieldName 字段名称
+ * @return 解析后的正整数
+ */
+declare function parsePositiveInt(value: string | undefined, defaultValue: number, fieldName: string): number;
+/**
+ * 解析并生成全局类型化应用配置
+ *
+ * @param env 输入的环境变量字典，缺省默认使用当前 process.env
+ * @return 结构完整且经过强校验的 AppConfig 对象
+ */
+declare function parseEnv(env?: NodeJS.ProcessEnv): AppConfig;
+/**
+ * 敏感凭证数据安全脱敏 (强类型浅拷贝，保护明文密钥)
+ *
+ * @param config 原始应用配置对象
+ * @return 字段已脱敏的安全配置对象
+ */
+declare function maskSensitiveConfig(config: AppConfig): AppConfig;
+/**
+ * 对 AccessKeyId 进行掩码脱敏 (保留前后四位)
+ *
+ * @param accessKeyId 原始 AccessKey 字符串
+ * @return 脱敏后的字符串
+ */
+declare function maskAccessKey(accessKeyId?: string): string | undefined;
+
+/**
+ * S3 客户端单例工厂与连接管理器
+ *
+ * @author Ateng
+ * @since 2026-10-04
+ */
+
+/**
+ * 根据应用配置装配 S3ClientConfig 选项 (包含重试与寻址策略)
+ *
+ * @param config 应用全局配置
+ * @return 组装后的底层客户端选项
+ */
+declare function getS3ClientConfig(config: AppConfig): S3ClientConfig;
+/**
+ * 根据应用配置创建全新的 S3Client 实例 (支持默认 3 次重试策略)
+ *
+ * @param config 应用全局配置
+ * @return 全新实例化的 S3Client 对象
+ */
+declare function createS3Client(config: AppConfig): S3Client;
+/**
+ * 获取或创建全局单例 S3Client 实例 (具备配置变动感知重建能力)
+ *
+ * @param config 可选应用配置，缺失时直接复用既有单例或加载当前环境变量解析
+ * @return 缓存或新创建的单例 S3Client 实例
+ */
+declare function getS3Client(config?: AppConfig): S3Client;
+/**
+ * 销毁并重置当前的单例客户端
+ */
+declare function resetS3Client(): void;
+
+/**
+ * 全局只读门禁守卫 (Read-Only Guard)
+ *
+ * 当启用只读门禁模式时，在 MCP 协议层完全隐藏并阻断写/删类高危工具
+ *
+ * @author Ateng
+ * @since 2026-10-04
+ */
+/**
+ * 只读门禁守卫
+ */
+declare class ReadOnlyGuard {
+    /**
+     * 允许在只读模式下调用的只读/探索类工具列表
+     */
+    static readonly READ_ONLY_TOOLS: Set<string>;
+    /**
+     * 写/改/删高危工具清单
+     */
+    static readonly MUTATING_TOOLS: Set<string>;
+    private isReadOnly;
+    constructor(isReadOnly?: boolean);
+    /**
+     * 判定目标工具是否属于写/改/删高危工具
+     *
+     * @param toolName 工具名称
+     * @return 是否为变更操作类工具
+     */
+    static isMutatingTool(toolName: string): boolean;
+    /**
+     * 判断目标工具在当前门禁状态下是否被允许调用
+     *
+     * @param toolName 工具名称
+     * @return 是否允许调用
+     */
+    isToolAllowed(toolName: string): boolean;
+    /**
+     * 断言目标工具在当前门禁状态下可调用；若属于写/删高危工具且处于只读模式则抛出异常
+     *
+     * @param toolName 工具名称
+     * @throws 当处于只读模式且尝试调用高危工具时抛出 SecurityError
+     */
+    assertToolAllowed(toolName: string): void;
+    /**
+     * 校验预签名 URL 方法；只读模式下严禁生成 PUT 上传直链
+     *
+     * @param method HTTP 请求方法
+     * @throws 当只读模式下请求 PUT 链接时抛出 SecurityError
+     */
+    assertPresignedUrlMethodAllowed(method?: "GET" | "PUT"): void;
+    /**
+     * 在 MCP 协议握手层物理过滤工具集合，在只读模式下隐藏所有写/删类工具
+     *
+     * @param tools 原始工具定义列表
+     * @return 过滤后的安全工具定义列表
+     */
+    filterTools<T extends {
+        name: string;
+    }>(tools: T[]): T[];
+}
+
+/**
+ * 工作区路径沙箱守卫 (Sandbox Guard)
+ *
+ * 严格限制本地文件读写在受管工作区目录内，强力阻断路径遍历逃逸 (../)、符号链接穿透与宿主机敏感文件泄露
+ *
+ * @author Ateng
+ * @since 2026-10-04
+ */
+/**
+ * 本地沙箱隔离守卫
+ */
+declare class SandboxGuard {
+    private allowedBaseDir;
+    constructor(allowedBaseDir?: string);
+    /**
+     * 获取当前生效的规范化沙箱根目录绝对路径
+     *
+     * @return 沙箱绝对路径
+     */
+    getBaseDir(): string;
+    /**
+     * 解析路径或其最接近的已存在父目录的真实物理路径 (Symlink 展开)
+     *
+     * @param targetPath 目标绝对路径
+     * @return 经过符号链接解析后的真实物理路径
+     */
+    private resolveRealPath;
+    /**
+     * 校验并规范化目标本地路径
+     *
+     * @param localPath 待校验的原始本地文件路径 (相对路径或绝对路径)
+     * @return 经过沙箱约束校验的安全绝对路径
+     * @throws 当路径为空、超出沙箱边界或通过 Symlink 逃逸时抛出 SecurityError
+     */
+    validatePath(localPath: string): string;
+}
+
+/**
+ * 前缀删除防灾熔断守卫 (Prefix Deletion Guard)
+ *
+ * 实施三重防灾熔断：非空非根前缀防护、显式二次确认校验与千级单批次安全上限
+ *
+ * @author Ateng
+ * @since 2026-10-04
+ */
+/**
+ * 递归前缀清理防灾守卫
+ */
+declare class PrefixDeletionGuard {
+    /**
+     * S3 标准单批次批量删除上限 (1000 个对象)
+     */
+    static readonly MAX_BATCH_DELETE_LIMIT = 1000;
+    /**
+     * 检验递归删除前缀并校验显式确认标记
+     *
+     * @param prefix 目标前缀字符串
+     * @param confirmRecursiveDelete 二次确认布尔标识
+     * @return 经过校验与规范化的安全前缀
+     * @throws 当缺少确认标记、前缀为空或为根斜杠时抛出 SecurityError
+     */
+    static validate(prefix: string, confirmRecursiveDelete: boolean): string;
+    /**
+     * 校验批量删除的对象键列表上限 (第三重防灾熔断)
+     *
+     * @param keys 待批量删除的对象键列表
+     * @return 校验通过的对象键列表
+     * @throws 当列表为空或元素数量超过 1000 时抛出 SecurityError
+     */
+    static validateBatchKeys(keys: string[]): string[];
+}
+
+/**
+ * 文本直读智能截断器与二进制拦截器 (Content Truncator)
+ *
+ * 限制 read_object_text 单次读取安全阈值 (默认 256KB)，防止大日志撑爆上下文，智能拦截二进制文件并提供安全操作引导
+ *
+ * @author Ateng
+ * @since 2026-10-04
+ */
+
+/**
+ * 默认文本直读最大安全阈值：256KB (262144 字节)
+ */
+declare const DEFAULT_MAX_READ_BYTES = 262144;
+/**
+ * 计算安全的 UTF-8 切割点，防止截断多字节字符引发乱码
+ *
+ * @param buf 待切片 Buffer
+ * @param limit 期望的截断字节数上限
+ * @return 确保 UTF-8 字符序列完整性的安全切割索引
+ */
+declare function findSafeUtf8CutPoint(buf: Buffer, limit: number): number;
+/**
+ * 截断器构造配置项
+ */
+interface ContentTruncatorOptions {
+    maxBytes?: number;
+}
+/**
+ * 内容截断与二进制防护处理器
+ */
+declare class ContentTruncator {
+    private defaultMaxBytes;
+    constructor(options?: ContentTruncatorOptions);
+    /**
+     * 智能检测 Buffer 是否为二进制数据
+     *
+     * @param buffer 输入字节流
+     * @return 是否为二进制数据
+     */
+    isBinary(buffer: Buffer): boolean;
+    /**
+     * 对字节流执行安全文本转换、二进制检测与防爆截断
+     *
+     * @param buffer 原始对象数据流
+     * @param overrideMaxBytes 可选覆盖的单次读取阈值大小
+     * @return 经过安全处理后的截断结果
+     */
+    process(buffer: Buffer, overrideMaxBytes?: number): ContentTruncationResult;
+}
+
+/**
+ * S3 连通性自省探针核心服务 (s3_ping)
+ *
+ * @author Ateng
+ * @since 2026-10-04
+ */
+
+/**
+ * 执行轻量连通性自省探针诊断
+ *
+ * 向目标对象存储发起极轻量的探测请求，测试端点连通性、网络往返时延 (RTT) 并自省鉴权状态
+ *
+ * @param client S3 客户端实例
+ * @param config 应用全局配置
+ * @return 连通性诊断结果
+ */
+declare function executeS3Ping(client: S3Client, config: AppConfig): Promise<ConnectivityProbeResult>;
+
+/**
+ * 存储桶生命周期服务 (Bucket Service)
+ *
+ * 管理存储桶的列出、创建、删除及物理地域查询
+ *
+ * @author Ateng
+ * @since 2026-10-04
+ */
+
+/**
+ * 查询全量存储桶列表
+ *
+ * @param client S3 客户端实例
+ * @return 存储桶信息数组 (无数据时返回空数组，绝不返回 null)
+ */
+declare function listBuckets(client: S3Client): Promise<BucketItem[]>;
+/**
+ * 创建新存储桶
+ *
+ * @param client S3 客户端实例
+ * @param bucket 待创建的存储桶名称
+ * @param region 可选部署地域 (us-east-1 以外区域需传入 LocationConstraint)
+ * @return 创建结果
+ */
+declare function createBucket(client: S3Client, bucket: string, region?: string): Promise<{
+    success: boolean;
+    bucket: string;
+    message: string;
+}>;
+/**
+ * 删除指定存储桶 (支持 force=true 强制级联清空对象后删除)
+ *
+ * @param client S3 客户端实例
+ * @param bucket 待删除的存储桶名称
+ * @param force 是否强制清理桶内所有对象后删除
+ * @return 删除结果
+ */
+declare function deleteBucket(client: S3Client, bucket: string, force?: boolean): Promise<{
+    success: boolean;
+    bucket: string;
+    message: string;
+}>;
+/**
+ * 查询存储桶实际物理部署地域
+ *
+ * @param client S3 客户端实例
+ * @param bucket 存储桶名称
+ * @return 地域结果
+ */
+declare function getBucketLocation(client: S3Client, bucket: string): Promise<{
+    bucket: string;
+    region: string;
+}>;
+
+/**
+ * S3 对象检索探索与内容直读服务 (Object Service)
+ *
+ * 提供虚拟目录树分页、关键字与正则匹配搜索、对象元数据检视、安全内存流式截断直读与 Range 范围读取
+ *
+ * @author Ateng
+ * @since 2026-10-04
+ */
+
+/**
+ * 解析并决议生效的存储桶名称
+ *
+ * @param bucket 接口显式传入的存储桶
+ * @param defaultBucket 全局默认绑定的存储桶
+ * @return 决议后的非空存储桶名称
+ * @throws 当两者皆未指定时抛出语义化异常
+ */
+declare function resolveBucket(bucket?: string, defaultBucket?: string): string;
+/**
+ * 查询虚拟分层目录树与分页对象列表 (Delimiter 默认为 '/')
+ *
+ * @param client S3 客户端实例
+ * @param params 分页查询入参
+ * @param defaultBucket 默认存储桶
+ * @return 虚拟目录列表与对象聚合响应
+ */
+declare function listObjects(client: S3Client, params: ListObjectsInput, defaultBucket?: string): Promise<ListObjectsResult>;
+/**
+ * 在前缀路径树中执行对象关键字或正则匹配搜索 (受扫描页数上限保护)
+ *
+ * @param client S3 客户端实例
+ * @param params 搜索入参
+ * @param defaultBucket 默认存储桶
+ * @return 匹配的对象列表
+ */
+declare function searchObjects(client: S3Client, params: SearchObjectsInput, defaultBucket?: string): Promise<S3ObjectItem[]>;
+/**
+ * 获取指定对象的元数据与属性 (HeadObject)
+ *
+ * @param client S3 客户端实例
+ * @param params 对象属性检视入参
+ * @param defaultBucket 默认存储桶
+ * @return 对象元数据
+ */
+declare function statObject(client: S3Client, params: StatObjectInput, defaultBucket?: string): Promise<ObjectMetadata>;
+/**
+ * 文本直读服务 (具备流式 OOM 防护、MIME 二进制前置拦截与编码适配)
+ *
+ * @param client S3 客户端实例
+ * @param params 文本读取入参
+ * @param truncator 截断器实例
+ * @param defaultBucket 默认存储桶
+ * @return 文本读取与截断结果
+ */
+declare function readObjectText(client: S3Client, params: ReadObjectTextInput, truncator: ContentTruncator, defaultBucket?: string): Promise<ReadObjectTextResult>;
+/**
+ * 局部字节区间读取 (Range Read)
+ *
+ * @param client S3 客户端实例
+ * @param params 字节区间读取入参
+ * @param defaultBucket 默认存储桶
+ * @param truncator 可选截断器 (复用二进制判定能力)
+ * @return 范围读取结果
+ */
+declare function readObjectRange(client: S3Client, params: ReadObjectRangeInput, defaultBucket?: string, truncator?: ContentTruncator): Promise<RangeReadResult>;
+
+/**
+ * S3 双向流式文件互传服务 (Transfer Service)
+ *
+ * 提供文本写入覆盖、本地磁盘与 S3 双向流式互传 (受 SandboxGuard 沙箱严格约束)
+ *
+ * @author Ateng
+ * @since 2026-10-04
+ */
+
+/**
+ * 自动触发分段上传的单文件大小阈值 (32MB)
+ */
+declare const MULTIPART_UPLOAD_THRESHOLD_BYTES: number;
+/**
+ * 分段上传单分片大小 (8MB)
+ */
+declare const MULTIPART_PART_SIZE_BYTES: number;
+/**
+ * 分段上传并发队列大小
+ */
+declare const MULTIPART_QUEUE_SIZE = 4;
+/**
+ * 文本直接写入或覆盖对象
+ *
+ * @param client S3 客户端实例
+ * @param params 文本写入入参
+ * @param defaultBucket 默认存储桶
+ * @return 写入操作响应结果
+ */
+declare function putObjectText(client: S3Client, params: PutObjectTextInput, defaultBucket?: string): Promise<{
+    success: boolean;
+    bucket: string;
+    key: string;
+    etag?: string;
+    message: string;
+}>;
+/**
+ * 本地文件流式上传至 S3 (受工作区路径沙箱守卫严格约束，支持大文件透明分段上传)
+ *
+ * @param client S3 客户端实例
+ * @param params 上传参数
+ * @param sandboxGuard 沙箱守卫实例
+ * @param defaultBucket 默认存储桶
+ * @return 上传结果
+ * @throws 当文件不存在、不是有效文件、读取流出错或沙箱越权时抛出 BusinessError 或 SecurityError
+ */
+declare function uploadFile(client: S3Client, params: UploadFileInput, sandboxGuard: SandboxGuard, defaultBucket?: string): Promise<{
+    success: boolean;
+    bucket: string;
+    key: string;
+    localPath: string;
+    size: number;
+    message: string;
+}>;
+/**
+ * S3 对象流式保存为本地文件 (受工作区路径沙箱守卫保护)
+ *
+ * @param client S3 客户端实例
+ * @param params 下载参数
+ * @param sandboxGuard 沙箱守卫实例
+ * @param defaultBucket 默认存储桶
+ * @return 下载结果
+ * @throws 当对象内容流为空、写入磁盘失败或沙箱越权时抛出 BusinessError 或 SecurityError
+ */
+declare function downloadFile(client: S3Client, params: DownloadFileInput, sandboxGuard: SandboxGuard, defaultBucket?: string): Promise<{
+    success: boolean;
+    bucket: string;
+    key: string;
+    localPath: string;
+    size: number;
+    message: string;
+}>;
+
+/**
+ * S3 预签名直链服务 (Presigned URL Service)
+ *
+ * 生成有时效性的 HTTP(S) 下载与上传预签名外链，支持只读门禁安全校验
+ *
+ * @author Ateng
+ * @since 2026-10-04
+ */
+
+/**
+ * 生成具备时效性的预签名直链 (支持下载 GET 与上传 PUT)
+ *
+ * @param client S3 客户端实例
+ * @param params 预签名参数
+ * @param readOnlyGuard 只读门禁守卫 (可选)
+ * @param defaultBucket 默认存储桶
+ * @param defaultExpiresIn 全局默认有效秒数
+ * @return 预签名直链与配置元信息
+ * @throws 当只读模式下尝试生成 PUT 上传直链时抛出 SecurityError
+ */
+declare function getPresignedUrl(client: S3Client, params: GetPresignedUrlInput, readOnlyGuard?: ReadOnlyGuard, defaultBucket?: string, defaultExpiresIn?: number): Promise<{
+    url: string;
+    bucket: string;
+    key: string;
+    method: "GET" | "PUT";
+    expiresIn: number;
+}>;
+
+/**
+ * S3 对象批处理与移动删除服务 (Batch Service)
+ *
+ * 提供跨桶与同桶对象复制、原子化移动重命名、单对象与千级批量删除以及前缀递归清理三重防灾熔断
+ *
+ * @author Ateng
+ * @since 2026-10-04
+ */
+
+/**
+ * 同桶或跨桶对象复制
+ *
+ * @param client S3 客户端实例
+ * @param params 复制参数
+ * @param defaultBucket 默认存储桶
+ * @return 复制结果
+ * @throws 当存储桶未指定时抛出异常
+ */
+declare function copyObject(client: S3Client, params: CopyObjectInput, defaultBucket?: string): Promise<{
+    success: boolean;
+    sourceBucket: string;
+    sourceKey: string;
+    targetBucket: string;
+    targetKey: string;
+    message: string;
+}>;
+/**
+ * 原子化移动与重命名对象 (复制成功后自动删除源对象，内置同源防自毁检测)
+ *
+ * @param client S3 客户端实例
+ * @param params 移动参数
+ * @param defaultBucket 默认存储桶
+ * @return 移动结果
+ * @throws 当源对象与目标对象路径完全相同时抛出 BusinessError
+ */
+declare function moveObject(client: S3Client, params: MoveObjectInput, defaultBucket?: string): Promise<{
+    success: boolean;
+    sourceBucket: string;
+    sourceKey: string;
+    targetBucket: string;
+    targetKey: string;
+    message: string;
+}>;
+/**
+ * 删除指定的单个对象
+ *
+ * @param client S3 客户端实例
+ * @param params 删除参数
+ * @param defaultBucket 默认存储桶
+ * @return 删除结果
+ * @throws 当存储桶未指定时抛出异常
+ */
+declare function deleteObject(client: S3Client, params: DeleteObjectInput, defaultBucket?: string): Promise<{
+    success: boolean;
+    bucket: string;
+    key: string;
+    message: string;
+}>;
+/**
+ * 批量删除多个指定对象 (单批上限 1000)
+ *
+ * @param client S3 客户端实例
+ * @param params 批量删除参数
+ * @param defaultBucket 默认存储桶
+ * @return 批量删除结果
+ * @throws 当对象键列表为空、超过上限或部分删除失败时抛出 SecurityError 或 BusinessError
+ */
+declare function deleteObjectsBatch(client: S3Client, params: DeleteObjectsBatchInput, defaultBucket?: string): Promise<{
+    success: boolean;
+    bucket: string;
+    deletedCount: number;
+    message: string;
+}>;
+/**
+ * 依据前缀递归清理虚拟目录树 (内置三重防灾熔断守卫与单批 1000 截断保护)
+ *
+ * @param client S3 客户端实例
+ * @param params 前缀递归删除参数
+ * @param defaultBucket 默认存储桶
+ * @return 递归删除统计结果及截断标识
+ * @throws 当缺少确认参数、前缀为根目录或部分删除失败时抛出 SecurityError 或 BusinessError
+ */
+declare function deleteObjectsByPrefix(client: S3Client, params: DeleteObjectsByPrefixInput, defaultBucket?: string): Promise<{
+    success: boolean;
+    bucket: string;
+    prefix: string;
+    deletedCount: number;
+    isTruncated: boolean;
+    message: string;
+}>;
+
+/**
+ * S3 对象业务标签治理服务 (Tag Service)
+ *
+ * 提供 S3 对象的业务 Key-Value 标签查询与全量覆盖设置
+ *
+ * @author Ateng
+ * @since 2026-10-04
+ */
+
+/**
+ * 查询对象关联的 Key-Value 业务标签字典
+ *
+ * @param client S3 客户端实例
+ * @param params 标签查询入参
+ * @param defaultBucket 默认存储桶
+ * @return 对象标签映射字典 (无标签时返回空对象)
+ */
+declare function getObjectTags(client: S3Client, params: GetObjectTagsInput, defaultBucket?: string): Promise<ObjectTags>;
+/**
+ * 写入或全量覆盖对象业务标签
+ *
+ * @param client S3 客户端实例
+ * @param params 标签设置入参
+ * @param defaultBucket 默认存储桶
+ * @return 标签设置结果
+ */
+declare function setObjectTags(client: S3Client, params: SetObjectTagsInput, defaultBucket?: string): Promise<{
+    success: boolean;
+    bucket: string;
+    key: string;
+    tags: ObjectTags;
+    message: string;
+}>;
+
+/**
+ * 原生 HTTP SSE 服务与健康检查探针中枢 (SSE Server)
+ *
+ * 暴露 /sse 长轮询流式通道、/message 客户端双向交互端点以及 /health 容器存活就绪探针
+ * 内置全量 CORS 跨域响应头与可选 Bearer Token 接入安全鉴权
+ *
+ * @author Ateng
+ * @since 2026-10-04
+ */
+
+/**
+ * MCP 服务端实例工厂类型
+ */
+type McpServerFactory = () => McpServer | Promise<McpServer>;
+/**
+ * SSE 服务运行实例契约
+ */
+interface SSEServerInstance {
+    /**
+     * 底层 Node 原生 HTTP 服务实例
+     */
+    server: http.Server;
+    /**
+     * 优雅安全关闭服务器函数
+     */
+    close: () => Promise<void>;
+    /**
+     * 实际监听的端口号
+     */
+    port: number;
+}
+/**
+ * 启动原生 HTTP SSE 传输服务并暴露探活端点
+ *
+ * @param serverOrFactory MCP 服务端单例实例或会话级工厂函数 (支持并发多会话隔离)
+ * @param host 监听主机地址 (默认 0.0.0.0)
+ * @param port 监听网络端口 (默认 8000)
+ * @param apiKey 可选接入鉴权令牌 (配置后强制校验 Bearer Token 或 URL Token)
+ * @return 运行中的服务实例与控制接口
+ */
+declare function startSSEServer(serverOrFactory: McpServer | McpServerFactory, host?: string, port?: number, apiKey?: string): Promise<SSEServerInstance>;
+
+/**
+ * CLI 命令行参数解析与双模配置中枢
+ *
+ * 基于 Node 原生 parseArgs 提供命令行参数支持，CLI Flags 优先级高于环境变量
+ *
+ * @author Ateng
+ * @since 2026-10-04
+ */
+
+/**
+ * 打印命令行使用帮助信息
+ */
+declare function printHelp(): void;
+/**
+ * 解析并合并命令行参数与环境变量，输出最终生效的 AppConfig
+ *
+ * @param args 命令行参数数组 (缺省使用 process.argv.slice(2))
+ * @param env 环境变量字典 (缺省使用 process.env)
+ * @return 合并覆盖后的强类型应用配置
+ */
+declare function resolveConfigWithCli(args?: string[], env?: NodeJS.ProcessEnv): {
+    config: AppConfig;
+    isHelp: boolean;
+    isVersion: boolean;
+};
+
+/**
+ * MCP Server 核心装配入口 (Coordinator)
+ *
+ * @author Ateng
+ * @since 2026-10-04
+ */
+
+declare const SERVER_VERSION = "1.0.1";
+/**
+ * 组装并配置 MCP Server 实例
+ *
+ * @param config 应用全局配置
+ * @param customClient 可选自定义 S3Client 实例 (主要用于单测与依赖注入)
+ * @return 配置完成的 McpServer 实例
+ */
+declare function createMCPServer(config?: AppConfig, customClient?: S3Client): McpServer;
+
+/**
+ * 启动 MCP 传输服务引擎 (根据配置自动分流 Stdio 或 SSE 双模，CLI Flags 优先于环境变量)
+ *
+ * @param customConfig 可选覆盖应用全局配置
+ * @param argv 可选命令行参数 (默认 process.argv.slice(2))
+ * @return 运行模式元数据与关闭句柄
+ */
+declare function runServer(customConfig?: AppConfig, argv?: string[]): Promise<{
+    mode: "stdio" | "sse";
+    close?: () => Promise<void>;
+}>;
+
+export { type AppConfig, AppConfigSchema, type BucketItem, BusinessError, type CommonPrefixItem, type ConnectivityProbeResult, ConnectivityProbeResultSchema, type ContentTruncationResult, ContentTruncator, type ContentTruncatorOptions, type CopyObjectInput, CopyObjectSchema, type CreateBucketInput, CreateBucketSchema, DEFAULT_MAX_READ_BYTES, type DeleteBucketInput, DeleteBucketSchema, type DeleteObjectInput, DeleteObjectSchema, type DeleteObjectsBatchInput, DeleteObjectsBatchSchema, type DeleteObjectsByPrefixInput, DeleteObjectsByPrefixSchema, type DownloadFileInput, DownloadFileSchema, type ErrorResult, ErrorResultSchema, type GetBucketLocationInput, GetBucketLocationSchema, type GetObjectTagsInput, GetObjectTagsSchema, type GetPresignedUrlInput, GetPresignedUrlSchema, type ListBucketsInput, ListBucketsSchema, type ListObjectsInput, type ListObjectsResult, ListObjectsSchema, MULTIPART_PART_SIZE_BYTES, MULTIPART_QUEUE_SIZE, MULTIPART_UPLOAD_THRESHOLD_BYTES, type McpServerFactory, type MoveObjectInput, MoveObjectSchema, type ObjectMetadata, type ObjectTags, PrefixDeletionGuard, type PresignedUrlResult, type PutObjectTextInput, PutObjectTextSchema, type RangeReadResult, type ReadObjectRangeInput, ReadObjectRangeSchema, type ReadObjectTextInput, type ReadObjectTextResult, ReadObjectTextSchema, ReadOnlyGuard, type S3ClientConfig, S3ClientConfigSchema, type S3CredentialsConfig, S3CredentialsConfigSchema, type S3ObjectItem, type S3PingInput, S3PingSchema, SERVER_VERSION, type SSEServerInstance, SandboxGuard, type SearchObjectsInput, SearchObjectsSchema, type SecurityCheckResult, SecurityError, type SecurityErrorCode, SecurityErrorCodeSchema, type SetObjectTagsInput, SetObjectTagsSchema, type StatObjectInput, StatObjectSchema, type TagItem, type TransportMode, TransportModeSchema, type UploadFileInput, UploadFileSchema, copyObject, createBucket, createMCPServer, createS3Client, deleteBucket, deleteObject, deleteObjectsBatch, deleteObjectsByPrefix, downloadFile, executeS3Ping, findSafeUtf8CutPoint, getBucketLocation, getEnvValue, getObjectTags, getPresignedUrl, getS3Client, getS3ClientConfig, listBuckets, listObjects, maskAccessKey, maskSensitiveConfig, moveObject, parseBoolean, parseEnv, parseNumber, parsePort, parsePositiveInt, printHelp, putObjectText, readObjectRange, readObjectText, resetS3Client, resolveBucket, resolveConfigWithCli, runServer, searchObjects, setObjectTags, startSSEServer, statObject, uploadFile };