/**
 * Builder for Web3Signed Authorization headers.
 *
 * @remarks
 * Ported from `personal-server-ts`
 * (`packages/core/src/signing/request-signer.ts`). The original was wired
 * to a Node-only `ServerAccount` and `node:crypto`. This isomorphic version
 * accepts any `signMessage` callback (viem accounts, wallet clients, etc.)
 * and uses `@noble/hashes` for SHA-256 so it runs in browsers and Workers.
 *
 * Wire format is identical to PS — payload is JSON with sorted keys,
 * base64url-encoded, signed via EIP-191.
 *
 * @category Auth
 */
/**
 * Sign-message callback compatible with viem `LocalAccount`/`WalletClient`-style
 * signers. Must produce an EIP-191 (`personal_sign`) signature.
 */
export type Web3SignedSignFn = (message: string) => Promise<`0x${string}`>;
/** Compute the `sha256:<hex>` bodyHash claim for a request body. */
export declare function computeBodyHash(body: Uint8Array | undefined): string;
/**
 * Build a Web3Signed Authorization header value.
 *
 * @returns The full header value (`"Web3Signed <base64url>.<sig>"`).
 */
export declare function buildWeb3SignedHeader(params: {
    /** EIP-191 signer (e.g. viem `account.signMessage`). */
    signMessage: Web3SignedSignFn;
    /** Expected origin (e.g. `"https://ps.example.com"`). */
    aud: string;
    /** HTTP method (e.g. `"GET"`). */
    method: string;
    /** Request URI/path (e.g. `"/v1/data/instagram.profile"`). */
    uri: string;
    /** Optional request body — when present, used to compute `bodyHash`. */
    body?: Uint8Array;
    /** Issued-at (unix seconds). Defaults to now. */
    iat?: number;
    /** Expiry (unix seconds). Defaults to `iat + 300`. */
    exp?: number;
    /** Optional grant id, attached as the `grantId` claim. */
    grantId?: string;
    /**
     * Optional uniqueness claim, attached as the `nonce` claim (a uuid is the
     * intended shape; the Personal Server bounds it at 128 characters).
     *
     * @remarks
     * A payload is otherwise fully determined by
     * `{ aud, bodyHash, exp, grantId, iat, method, uri }`, so two identical
     * requests signed inside the same second produce the same bytes and the
     * Personal Server refuses the second as a replay. With a nonce the replay
     * key becomes `(signer, nonce)` instead, which is what lets a poll loop
     * send the same request twice. The nonce is then single use itself:
     * re-using one is a replay even when the rest of the payload changed.
     */
    nonce?: string;
    /** Pre-computed `bodyHash` claim — overrides `body`. */
    bodyHash?: string;
}): Promise<string>;