/** SHA-256 of the empty string — the payload hash of every bodyless request. */
export declare const EMPTY_PAYLOAD_SHA256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
/** A resolved credential set. `sessionToken` is present for STS/role credentials. */
export interface AwsCredentials {
    accessKeyId: string;
    secretAccessKey: string;
    sessionToken?: string;
}
/**
 * The credential injection seam: a function the caller supplies to decide, by
 * whatever means it likes, what to sign with. Returning `undefined` means "this
 * process has no credentials" and is respected as an answer, not overridden.
 */
export type AwsCredentialResolver = () => AwsCredentials | undefined;
/** Either literal credentials or a resolver for them. */
export type AwsCredentialSource = AwsCredentials | AwsCredentialResolver;
/**
 * Credentials for a request: explicit → environment → absent.
 *
 * A resolver function is authoritative — if one is injected and it declines,
 * the environment is not consulted behind its back, because the point of
 * injecting one is to control the answer. Literal credentials are likewise
 * final. Only the no-source case falls through to `AWS_ACCESS_KEY_ID` /
 * `AWS_SECRET_ACCESS_KEY` (plus `AWS_SESSION_TOKEN` when set), and a half-set
 * environment — a key id with no secret — is absent rather than a signature
 * that cannot verify.
 *
 * Deliberately not implemented: the profile file, IMDS, and the container
 * credential endpoints. Each is a separate transport with its own failure and
 * caching story; a caller that has those can resolve them itself and pass the
 * result in, which is what the resolver seam is for.
 */
export declare function resolveCredentials(source?: AwsCredentialSource, env?: Record<string, string | undefined>): AwsCredentials | undefined;
/** One request to sign. `headers` are the caller's; the signer adds its own. */
export interface SigV4Request {
    method: string;
    /** Absolute URL. Its host is signed and its path/query are canonicalized. */
    url: string;
    headers: Record<string, string>;
    body: string;
    /** Service name as it appears in the credential scope (`cloudformation`, `cloudcontrolapi`, …). */
    service: string;
    region: string;
    credentials: AwsCredentials;
    /** Signing clock. Injected by tests; otherwise now. */
    now?: Date;
}
/** `YYYYMMDDTHHMMSSZ` — the `X-Amz-Date` format, which is ISO-8601 basic. */
export declare function amzDate(date: Date): string;
/** Lowercase hex SHA-256. */
export declare function sha256Hex(payload: string): string;
/**
 * The signing key: four chained HMACs from the secret, so the key on the wire
 * is scoped to one day, one region and one service rather than being the
 * account secret itself.
 */
export declare function signingKey(secretAccessKey: string, day: string, region: string, service: string): Buffer;
/**
 * Header names lowercased, values trimmed with internal whitespace runs
 * collapsed, sorted by name. Returns the canonical block and the `;`-joined
 * signed-header list that has to agree with it exactly.
 */
export declare function canonicalHeaders(headers: Record<string, string>): {
    canonical: string;
    signed: string;
};
/** The canonical request, verbatim as it is hashed into the string to sign. */
export declare function canonicalRequest(method: string, url: URL, headers: Record<string, string>, payloadHash: string): {
    canonical: string;
    signed: string;
};
/** The string to sign: algorithm, timestamp, scope, hashed canonical request. */
export declare function stringToSign(timestamp: string, scope: string, canonical: string): string;
/**
 * The caller's headers plus everything SigV4 adds: `x-amz-date`,
 * `x-amz-content-sha256`, `x-amz-security-token` when the credentials are
 * temporary, and the `Authorization` header itself.
 *
 * `host` is signed (AWS requires it) but not returned — see the module header.
 */
export declare function signRequest(request: SigV4Request): Record<string, string>;
//# sourceMappingURL=sigv4.d.ts.map