/**
 * AWS Signature Version 4 — shared signing utility.
 *
 * Extracted from duplicate inline implementations in:
 *   - src/llm-adapters/bedrock.ts  (Bedrock InvokeModel / Converse)
 *   - packages/governance-server/src/attestation-kms-aws.ts  (KMS Encrypt/Decrypt)
 *
 * Filed as F-NEW-SIGV4-CONSOLIDATE. Both call sites import from this module.
 * A matching canonical copy lives at
 * packages/governance-server/src/util/sigv4.ts for use within the
 * governance-server package boundary (zero third-party runtime deps rule).
 *
 * Reference: https://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html
 *
 * @connexum/ai-governance
 */
export interface SigV4Options {
    /** HTTP method (e.g. 'POST') */
    method: string;
    /** URL object for the request */
    url: URL;
    /** AWS region (e.g. 'us-east-1') */
    region: string;
    /** AWS service identifier (e.g. 'bedrock', 'kms') */
    service: string;
    /** AWS access key ID */
    accessKeyId: string;
    /** AWS secret access key */
    secretAccessKey: string;
    /** Optional session token for temporary credentials */
    sessionToken?: string;
    /** Raw request body as a string */
    body: string;
    /**
     * Additional headers to include in the canonical request.
     * Keys are lowercased before signing. Do NOT include 'host' or
     * 'x-amz-date' here — those are added automatically.
     * Content-type MUST be supplied here for it to be signed.
     */
    extraHeaders?: Record<string, string>;
    /**
     * When true, include 'x-amz-content-sha256' in the signed headers.
     * Required for S3 and Bedrock. Optional for KMS. Defaults to false.
     */
    includeContentSha256Header?: boolean;
}
export interface SigV4SignedHeaders {
    Authorization: string;
    'x-amz-date': string;
    'x-amz-security-token'?: string;
    'x-amz-content-sha256'?: string;
    [key: string]: string | undefined;
}
/**
 * Sign an AWS request with SigV4 and return the signed headers to attach.
 *
 * The returned object always contains 'Authorization' and 'x-amz-date'.
 * If sessionToken is provided, 'x-amz-security-token' is included.
 * If includeContentSha256Header is true, 'x-amz-content-sha256' is included.
 *
 * Test vectors: AWS SigV4 Test Suite
 * https://docs.aws.amazon.com/general/latest/gr/sigv4-test-suite.html
 */
export declare function signSigV4(opts: SigV4Options): SigV4SignedHeaders;
export declare function sha256Hex(data: string | Buffer): string;
export declare function hmacSha256(key: Buffer | string, data: string): Buffer;
export declare function hmacSha256Hex(key: Buffer, data: string): string;
export declare function deriveSigningKey(secret: string, dateStamp: string, region: string, service: string): Buffer;
/** Format a Date as YYYYMMDDTHHMMSSZ (AWS amz-date format). */
export declare function formatAmzDate(d: Date): string;
/** Format a Date as YYYYMMDD (AWS date-stamp format). */
export declare function formatDate(d: Date): string;
//# sourceMappingURL=sigv4.d.ts.map