/**
 * AWS Signature V4 signing for HTTP requests. WebCrypto-only — no node:crypto.
 *
 * Matches `@smithy/signature-v4` for our usage: header-based signing with a
 * full SHA-256 payload hash (Bedrock requires `applyChecksum: true`).
 *
 * Returns the set of headers to attach to the request:
 *  - `host`
 *  - `x-amz-date`
 *  - `x-amz-content-sha256`
 *  - `x-amz-security-token` (only when credentials carry a sessionToken)
 *  - `authorization`
 */
export interface AwsCredentials {
    accessKeyId: string;
    secretAccessKey: string;
    sessionToken?: string;
}
export interface SignParams {
    method: string;
    /** Hostname only — used to build the `host` header and the canonical request. */
    host: string;
    /** URI path component, e.g. `/model/anthropic.claude/converse-stream`. */
    path: string;
    /** Optional pre-built query string (without leading `?`). */
    query?: string;
    /** Extra headers to sign in addition to `host`/`x-amz-*`. Names are case-insensitive. */
    headers?: Record<string, string>;
    body: Uint8Array;
    region: string;
    service: string;
    credentials: AwsCredentials;
    /** Override clock for deterministic tests. */
    date?: Date;
}
/** Coerce a possibly-ArrayBufferLike-backed `Uint8Array` into one over a fresh
 * `ArrayBuffer`, which is what `crypto.subtle.{digest,sign,importKey}` requires
 * under the strict TS DOM typings. No-op when already strict.
 */
export declare function asStrict(bytes: Uint8Array): Uint8Array<ArrayBuffer>;
export declare function toHex(bytes: Uint8Array): string;
export declare function sha256(data: Uint8Array | string): Promise<Uint8Array>;
export declare function sha256Hex(data: Uint8Array | string): Promise<string>;
/**
 * Derive a signing key: HMAC chain `kSecret → kDate → kRegion → kService → kSigning`.
 */
export declare function getSigningKey(secretAccessKey: string, shortDate: string, region: string, service: string): Promise<Uint8Array>;
/** `YYYYMMDDTHHMMSSZ` + 8-char `YYYYMMDD`. */
export declare function formatAmzDate(d: Date): {
    longDate: string;
    shortDate: string;
};
/**
 * AWS's canonical-request spec encodes each name/value first, THEN sorts by
 * the encoded form ("Sort the encoded parameter names by character code" —
 * https://docs.aws.amazon.com/IAM/latest/UserGuide/create-canonical-request.html).
 * Sorting the decoded form instead gives the wrong order whenever encoding
 * changes a character's relative position — e.g. raw key `%7B` (decodes to
 * `{`, 0x7B) vs `x` (0x78): decoded, `x` < `{`; encoded, `%` (0x25) < `x`, so
 * `%7B` sorts first. A gateway that validates SigV4 (or AWS itself) computes
 * the signature over ITS OWN canonicalization and rejects ours if the two
 * disagree on order.
 */
export declare function canonicalQuery(query: string | undefined): string;
export interface SignedHeaders {
    host: string;
    "x-amz-date": string;
    "x-amz-content-sha256": string;
    authorization: string;
    "x-amz-security-token"?: string;
}
export declare function signRequest(params: SignParams): Promise<SignedHeaders>;