/**
 * AWS KMS provider using SigV4-signed HTTPS requests.
 *
 * Works in Workers and modern Node without AWS SDK dependencies.
 */
import type { KeyRef, KmsDataKey, KmsKeyType, KmsProvider, KmsUnwrappedDataKey } from "./kms.js";
export interface AwsKmsConfig {
    region: string;
    accessKeyId: string;
    secretAccessKey: string;
    sessionToken?: string;
    endpoint?: string;
    keyIdByType: Record<KmsKeyType, string>;
}
export declare class AwsKmsProvider implements KmsProvider {
    private readonly config;
    readonly name: "aws";
    constructor(config: AwsKmsConfig);
    private resolveKeyId;
    private resolveEndpoint;
    private signedHeaders;
    private callAws;
    encrypt(plaintext: string, key: KeyRef): Promise<string>;
    decrypt(ciphertext: string, key: KeyRef): Promise<string>;
    generateDataKey(key: KeyRef): Promise<KmsDataKey>;
    unwrap(key: KeyRef, wrappedDek: string): Promise<KmsUnwrappedDataKey>;
}
//# sourceMappingURL=kms-aws.d.ts.map