/**
 * Signed image URLs - a portable, **synchronous** HMAC-SHA256 so the (sync) `selfHostedLoader` can sign
 * URLs inline, on any runtime including the edge (WebCrypto's HMAC is async-only; `node:crypto` isn't on
 * Workers). A signed URL lets `createImageHandler` reject any `(src, w, q)` it didn't authorize -
 * shutting down resize-bombing (width/quality enumeration) and locking the endpoint to your own images.
 *
 * Pure JS, dependency-free, KAT-tested against the SHA-256 / RFC 4231 HMAC vectors. The secret never
 * leaves the bytes you pass in.
 */
/** HMAC-SHA256 of `message` under `key` (both UTF-8 strings) → lowercase hex. The primitive behind URL
 * signing; exported for tests (RFC 4231 vectors) and advanced use. */
export declare function hmacSha256Hex(key: string, message: string): string;
/** The fields a signature covers. Newline-delimited into a canonical string (newlines can't appear in
 * a URL query value, so the join is unambiguous). `q`/`exp` are normalized to `""` when absent so the
 * signer and verifier agree. */
export interface ImageSignatureParts {
    readonly src: string;
    readonly w: string;
    readonly q?: string | undefined;
    readonly exp?: string | undefined;
}
/** Compute the URL signature (base64url HMAC-SHA256) for a set of image params. Guards (and so does
 * the verify path, which calls through here) against a sub-256-bit secret. */
export declare function signImageParams(secret: string, parts: ImageSignatureParts): string;
/**
 * Verify a request's signature against `secret` (constant-time) and, when an `exp` is present, that it
 * hasn't passed `nowSeconds`. Returns `false` for a missing/forged/expired signature.
 */
export declare function verifyImageParams(secret: string, parts: ImageSignatureParts, signature: string, nowSeconds: number): boolean;
//# sourceMappingURL=sign.d.ts.map