/**
 * @fileoverview RFC 9421 signature-base serialization and RFC 9530
 * content-digest construction.
 *
 * Every string here follows the byte conventions specified in RFC 9421 §2.3 and
 * §2.5 and RFC 9530 §2. The functions are pure and deterministic so they can be
 * byte-matched against the published RFC vectors (RFC 9421 Appendix B.2.6, RFC
 * 9530 Appendix B.1).
 *
 * Line format (RFC 9421 §2.5): each covered-component line is
 *   "<lowercased-component-name>": <component-value>\n
 * i.e. the identifier wrapped in DQUOTE, then COLON SPACE, then the value, then
 * a single LF (0x0A, NOT CRLF). The final line is always the @signature-params
 * line and has NO trailing newline.
 */
import type { CoveredComponent, ContentDigestAlgorithm, RequestContext, SignatureParams } from './types.js';
/**
 * Derive @authority per RFC 9421 §2.2.3: lowercased host, with port appended
 * only when it is not the default for the scheme (80 for http, 443 for https).
 */
export declare function deriveAuthority(url: URL): string;
/**
 * Derive @path per RFC 9421 §2.2.6: the absolute path portion of the target URI
 * in percent-encoded form, with an empty path normalized to "/". Query is NOT
 * included (it is a separate @query component).
 */
export declare function derivePath(url: URL): string;
/**
 * Compute the RFC 9530 Content-Digest field value for the given algorithm over
 * the exact body bytes. Returns the Structured-Fields Dictionary member value,
 * e.g. 'sha-256=:RK/0qy18MlBSVnWgjwz6lZEWjP/lF5HF9bvEF8FabDg=:'.
 *
 * The digest is standard base64 (with padding) wrapped in colons (SF Byte
 * Sequence). This binds the body only if 'content-digest' is in the covered set
 * AND the verifier recomputes over received bytes.
 */
export declare function computeContentDigest(body: Uint8Array, algorithm?: ContentDigestAlgorithm): string;
/**
 * Build the value that appears both in the @signature-params base line and in
 * the Signature-Input field value for this label. These MUST be byte-identical.
 */
export declare function buildSignatureParamsValue(covered: CoveredComponent[], params: SignatureParams): string;
/** Resolve the value for a single covered component from the request context. */
export declare function resolveComponentValue(component: CoveredComponent, ctx: RequestContext, contentDigest: string | undefined): string;
/**
 * Construct the full signature base string per RFC 9421 §2.5: one line per
 * covered component in declared order, each terminated by LF, then the
 * @signature-params line with NO trailing newline.
 *
 * The covered-components list does NOT itself include "@signature-params"; that
 * identifier only appears as the final trailer line.
 *
 * @returns the ASCII base string and the content-digest value used (if any).
 */
export declare function buildSignatureBase(covered: CoveredComponent[], ctx: RequestContext, params: SignatureParams): {
    base: string;
    contentDigest?: string;
};
//# sourceMappingURL=signature-base.d.ts.map