import { type AwsRequestTarget } from "./client.js";
/**
 * AWS Signature Version 4 signing, with no AWS SDK and no Node module. It
 * hashes with lib/utils/hash.ts, so it runs anywhere JavaScript runs. The caller
 * supplies the canonical URI verbatim (already `awsUriEncode`d by the endpoint
 * builder) so the path that is signed is exactly the path that is fetched — no
 * re-derivation through URL normalization. Header signing (`signRequest`) signs
 * an empty canonical query because the request target carries no query;
 * presigning (`presignRequest`) builds its canonical query once and emits that
 * same string in the returned URL.
 *
 * Scope: plain SigV4 only (no SigV4a).
 */
export type SignInput = {
    method: string;
    /** Full wire URL, used for the host header. */
    wireUrl: string;
    /** The canonical URI to sign, verbatim (already encoded). */
    canonicalUri: string;
    region: string;
    service: string;
    accessKeyId: string;
    secretAccessKey: string;
    sessionToken?: string;
    body?: Uint8Array | string;
    extraHeaders?: Readonly<Record<string, string>>;
    /** Override "now"; used only to reproduce AWS's published test vectors. */
    date?: Date;
};
/** Sign a request and return the headers to send, including Authorization. */
export declare function signRequest(input: SignInput): Promise<Record<string, string>>;
export type PresignInput = {
    method: string;
    /** The atomic target; the wire URL is derived as origin + canonicalUri. */
    target: AwsRequestTarget;
    region: string;
    service: string;
    accessKeyId: string;
    secretAccessKey: string;
    sessionToken?: string;
    expiresIn: number;
    /** Override "now"; used only to reproduce AWS's published test vectors. */
    date?: Date;
};
/**
 * Presign a request: the query-string variant of SigV4. Only `host` is signed
 * and the payload hash is the literal UNSIGNED-PAYLOAD, so anyone holding the
 * returned URL can send the request until the expiry. The canonical query that
 * is signed is byte-for-byte the query emitted in the URL (plus the trailing
 * X-Amz-Signature).
 */
export declare function presignRequest(input: PresignInput): Promise<string>;