/**
 * SignatureCache - Rotating HMAC signature cache for internal RPC optimization
 *
 * P-PERF-29: Reduce per-request HMAC computation cost by caching signatures with
 * periodic rotation. Maintains replay protection guarantees while reducing CPU overhead.
 *
 * Security Model:
 * - Signatures rotate every 5 seconds (configurable)
 * - Multiple signatures active during overlap window for clock drift tolerance
 * - Replay protection window: 30 seconds (INTERNAL_SIG_MAX_AGE_MS)
 * - Rotation interval (5s) << replay window (30s) = safe
 *
 * Performance:
 * - Reduces HMAC computations by ~5s/rotation_interval ratio
 * - At 1000 RPS: 5000 HMAC ops/rotation vs 1 per rotation = ~5000x reduction
 * - Memory overhead: ~200 bytes per cached signature entry
 */
/**
 * Configuration for signature cache behavior
 */
export interface SignatureCacheConfig {
    /** How often to rotate signatures (ms). Default: 5000 (5s) */
    rotationIntervalMs?: number;
    /** Whether caching is enabled. Default: false (opt-in for safety) */
    enabled?: boolean;
}
/**
 * SignatureCache maintains a rotating set of precomputed HMAC signatures
 * for internal RPC authentication. Reduces per-request CPU cost while
 * preserving replay protection guarantees.
 */
export declare class SignatureCache {
    private readonly secret;
    private readonly rotationIntervalMs;
    private readonly enabled;
    private currentSignatures;
    private previousSignatures;
    private currentTimestamp;
    private previousTimestamp;
    private rotationTimer;
    constructor(secret: string, config?: SignatureCacheConfig);
    /**
     * Get a signature for the given method and path.
     * If caching is disabled, computes a fresh signature each time.
     * If caching is enabled, returns the current cached signature.
     */
    getSignature(method: string, path: string): {
        signature: string;
        timestamp: string;
    };
    /**
     * Check if caching is enabled
     */
    isEnabled(): boolean;
    /**
     * Get cache statistics for monitoring
     */
    getStats(): {
        enabled: boolean;
        rotationIntervalMs: number;
        currentTimestamp: number | null;
        previousTimestamp: number | null;
    };
    /**
     * Stop the rotation timer (for cleanup)
     */
    stop(): void;
    /**
     * Force an immediate rotation (useful for testing)
     */
    rotate(): void;
    private _initializeCache;
    private _startRotation;
    private _rotateSignature;
    private _computeFreshSignature;
}
/**
 * Create a signature cache instance from environment configuration
 */
export declare function createSignatureCacheFromEnv(): SignatureCache | null;
//# sourceMappingURL=SignatureCache.d.ts.map