/**
 * HMAC-signed URL tokens for the filesystem cache backend.
 *
 * Pre-signed S3 URLs are not available for filesystem storage, so the
 * filesystem backend mints HMAC-SHA256 tokens that the orchestrator's HTTP
 * blob route verifies before serving / writing a file. Token shape:
 *
 *   `${expiresUnixMs}.${hexSig}`
 *
 * Signature input: `${method}:${key}:${expiresUnixMs}` with HMAC-SHA256 keyed
 * by a per-orchestrator-process secret (random 32-byte hex at boot, persists
 * for the lifetime of the process). Tokens become invalid on orchestrator
 * restart — fine for the filesystem backend's E2E / single-host use case.
 */
/** Default URL lifetime: 1 hour (matches S3 backend's PUT-URL lifetime). */
export declare const DEFAULT_SIGN_URL_TTL_MS: number;
export type SignedMethod = 'GET' | 'PUT';
/**
 * Generate a fresh per-process signing secret. Caller stores it on the
 * orchestrator config object so the same value is used for sign + verify.
 */
export declare function generateSigningSecret(): string;
export interface SignedToken {
    /** Encoded token string (`${expiresMs}.${sig}`) ready to drop into a URL. */
    token: string;
    /** Expiry timestamp in unix ms — exposed for tests and logging. */
    expiresMs: number;
}
/**
 * Mint a signed token for the given (method, key, expiry) triple.
 */
export declare function signToken(secret: string, method: SignedMethod, key: string, ttlMs?: number): SignedToken;
export type VerifyResult = {
    ok: true;
    expiresMs: number;
} | {
    ok: false;
    reason: 'malformed' | 'expired' | 'bad-signature';
};
/**
 * Verify a token. Constant-time signature compare on hex digest length;
 * rejects malformed shapes and expired tokens up-front.
 */
export declare function verifyToken(secret: string, method: SignedMethod, key: string, token: string): VerifyResult;
//# sourceMappingURL=sign-url.d.ts.map