/** Minimal AWS Signature V4 (fetch edition).
*
*  Implements exactly what the SES v2 SendEmail / SendBulkEmail calls need:
*  SHA-256 + HMAC-SHA256 via Web Crypto, payload hashing, canonical request,
*  string-to-sign, signing key derivation. No service-specific behavior — you
*  pass the region, service, credentials, and payload.
*
*  Works on Node ≥20, Bun, Deno, Cloudflare Workers, and modern browsers.
*/
export interface AwsCredentials {
	accessKeyId: string;
	secretAccessKey: string;
	sessionToken?: string;
}
export interface SignInit {
	method: string;
	url: string;
	headers?: Record<string, string>;
	body?: string;
	region: string;
	service: string;
	credentials: AwsCredentials;
	/** Override the signing time — defaults to `new Date()`. Used for tests. */
	now?: () => Date;
}
export interface SignedRequest {
	url: string;
	method: string;
	headers: Record<string, string>;
	body?: string;
}
/** Produce a ready-to-fetch signed request. */
export declare function signRequest(init: SignInit): Promise<SignedRequest>;