/**
* AWS Signature Version 4 signer — zero-dep, Web Crypto only.
*
* `sigv4(opts)` is a Misina plugin that signs every outgoing request with
* the standard AWS SigV4 algorithm:
*
*   1. Build the canonical request (method + canonical URI + canonical
*      query + canonical headers + signed-headers list + payload hash).
*   2. Build the string-to-sign (`AWS4-HMAC-SHA256` + ISO8601 date +
*      credential scope + sha256(canonical-request)).
*   3. Derive the signing key via the HMAC-SHA256 chain
*      (`AWS4`+secret → date → region → service → "aws4_request").
*   4. Sign the string-to-sign with the signing key and emit
*      `Authorization: AWS4-HMAC-SHA256 Credential=... SignedHeaders=...
*      Signature=...` plus `x-amz-date` and `x-amz-content-sha256`.
*
* No SDK peer dep — `crypto.subtle` does HMAC-SHA256 and SHA-256 across
* Node 19+, Bun, Deno, Cloudflare Workers, and Baseline 2024 browsers.
*
* @example
* ```ts
* import { createMisina } from "misina"
* import { sigv4 } from "misina/auth/sigv4"
*
* const api = createMisina({
*   baseURL: "https://bedrock-runtime.us-east-1.amazonaws.com",
*   use: [
*     sigv4({
*       service: "bedrock-runtime",
*       region: "us-east-1",
*       credentials: async () => ({ accessKeyId, secretAccessKey, sessionToken }),
*     }),
*   ],
* })
* ```
*/
import type { MisinaPlugin } from "../types.mjs";
export interface SigV4Credentials {
	accessKeyId: string;
	secretAccessKey: string;
	sessionToken?: string;
}
export interface SigV4Options {
	service: string;
	region: string;
	credentials: SigV4Credentials | (() => SigV4Credentials | Promise<SigV4Credentials>);
	/**
	* Skip body hashing and emit `UNSIGNED-PAYLOAD`. Required for true
	* streaming uploads where the body length / hash isn't known up
	* front. Default: false.
	*/
	unsignedPayload?: boolean;
}
/**
* Sign every request with AWS SigV4. Runs as a `beforeRequest` hook so the
* Request that hits the driver already carries `Authorization`,
* `x-amz-date`, and `x-amz-content-sha256`.
*/
export declare function sigv4(options: SigV4Options): MisinaPlugin;
export interface SignRequestOptions {
	service: string;
	region: string;
	credentials: SigV4Credentials;
	/** Override the timestamp (defaults to now). Used by tests + replay. */
	date?: Date;
	unsignedPayload?: boolean;
}
/**
* Sign a single Request and return a new Request with the SigV4
* headers attached. Pure — no instance / hook required.
*/
export declare function signRequest(request: Request, options: SignRequestOptions): Promise<Request>;