/**
 * Boot-time backstop for the MCP pre-signed asset upload flow.
 *
 * Pre-signed PUT URLs land bytes under `pending/{assetId}/{filename}`.
 * Finalize promotes them to canonical keys + deletes pending. Two cases
 * leave bytes orphaned in `pending/`:
 *   - agent presigns but never PUTs (URL expires, blob never existed)
 *   - agent PUTs but never finalizes (CopyObject + delete-pending skipped)
 *
 * The bucket's lifecycle rule (`pending/` TTL 24h) is the only mechanism
 * bounding storage cost for these. This check runs once per workspace per
 * boot, confirms the rule exists, and emits a structured WARN if missing.
 * It does NOT crash boot — operators get a loud reminder instead. See
 * docs/r2-lifecycle.md for the dashboard steps.
 *
 * Auto-fix is intentionally NOT attempted: the R2 IAM token used by the
 * server typically lacks `s3:PutBucketLifecycleConfiguration` (which would
 * let any compromised deploy disable orphan cleanup). One-shot operator
 * action per bucket is the right boundary.
 */
import type { WorkspaceManager } from '../core/workspace-manager.js';
export declare function checkAssetLifecycleRule(wm: WorkspaceManager): Promise<void>;
