/**
* RFC 9421 HTTP Message Signatures — sign outgoing requests with the
* standard `Signature-Input` + `Signature` headers.
*
* Cloudflare's Verified Bots program and the OpenAI Operator use 9421
* for cryptographic request authentication. The algorithm:
*
*   1. Build the signature base from the chosen components (derived
*      pseudo-headers like `@method`, `@target-uri`, plus regular
*      headers).
*   2. Append a `@signature-params` line carrying the components
*      list, optional `keyid`, `alg`, `created`, `expires`, `nonce`,
*      `tag` parameters.
*   3. Sign the base with `crypto.subtle.sign` and emit the headers:
*      `Signature-Input: <label>=<params>` and
*      `Signature: <label>=:<base64>:`.
*
* Web Crypto only — no peer dep. Supported algorithms map directly to
* `subtle.sign`:
*   - `ed25519`            — `Ed25519`
*   - `ecdsa-p256-sha256`  — `ECDSA` over P-256 with SHA-256
*   - `rsa-pss-sha512`     — `RSA-PSS` with SHA-512 + 64-byte salt
*   - `hmac-sha256`        — `HMAC` with SHA-256 (shared secret)
*
* @example
* ```ts
* import { createMisina } from "misina"
* import { messageSignature } from "misina/auth/signed"
*
* const keyPair = await crypto.subtle.generateKey({ name: "Ed25519" }, true, ["sign", "verify"])
* const api = createMisina({
*   baseURL,
*   use: [
*     messageSignature({
*       keyId: "my-key",
*       privateKey: keyPair.privateKey,
*       algorithm: "ed25519",
*       components: ["@method", "@target-uri", "content-type", "content-digest"],
*     }),
*   ],
* })
* ```
*/
import type { MisinaPlugin } from "../types.mjs";
export type MessageSignatureAlgorithm = "ed25519" | "ecdsa-p256-sha256" | "rsa-pss-sha512" | "hmac-sha256";
export interface MessageSignatureOptions {
	/** Key identifier; emitted as `keyid` in Signature-Input. */
	keyId?: string;
	/** Algorithm identifier; emitted as `alg` in Signature-Input. */
	algorithm: MessageSignatureAlgorithm;
	/**
	* Signing key. `CryptoKey` for asymmetric algos (`ed25519`,
	* `ecdsa-p256-sha256`, `rsa-pss-sha512`); raw `Uint8Array` or
	* `CryptoKey` for `hmac-sha256`.
	*/
	privateKey: CryptoKey | Uint8Array;
	/**
	* Components to cover. Pseudo-headers start with `@` (RFC 9421 §2.2).
	* Regular header names match canonical lowercase. Default:
	* `["@method", "@target-uri", "content-type", "content-digest"]`.
	*/
	components?: readonly string[];
	/** Label used in `Signature-Input` and `Signature`. Default: `"sig1"`. */
	label?: string;
	/**
	* Optional `created` parameter. Default: `Math.floor(Date.now()/1000)`.
	* Pass `false` to omit (rare).
	*/
	created?: number | false;
	/** Optional `expires` parameter (Unix seconds). */
	expires?: number;
	/** Optional `nonce` parameter — opaque per-message nonce. */
	nonce?: string;
	/** Optional `tag` parameter — application-defined string. */
	tag?: string;
}
/**
* Sign every outgoing request per RFC 9421. The hook builds the signature
* base, signs it with the caller's key, and writes `Signature-Input` +
* `Signature` to the request headers.
*/
export declare function messageSignature(options: MessageSignatureOptions): MisinaPlugin;
/**
* Sign a single Request and return a new Request with `Signature-Input`
* and `Signature` attached. Pure — no instance / hook required.
*/
export declare function signRequest(request: Request, options: MessageSignatureOptions): Promise<Request>;