/**
 * sign-event — HMAC-SHA256 event signing helpers.
 *
 * ADR-ECO-017 canonical signature scheme:
 *   HMAC-SHA256(key, type|source|timestamp|idempotencyKey|sha256(payload))
 *
 * IMPORTANT: This is the ONLY place in the codebase where crypto.createHmac
 * is permitted for event signing. Direct usage outside this file is forbidden
 * (enforced by CI lint rule no-direct-hmac-outside-sdk).
 *
 * @module auth/sign-event
 * @public
 */
import type { DomainEvent } from "../ports/event-bus.js";
/**
 * Builds the canonical string used as HMAC input.
 * Format: type|source|timestamp|idempotencyKey|sha256(payload)
 */
export declare function canonicalEventString(event: Omit<DomainEvent, "signature">, payloadHash: string): string;
/**
 * Signs an event using HMAC-SHA256 with the provided secret.
 *
 * @param event  - Event without signature field.
 * @param secret - HMAC key (hex string or raw string).
 * @returns Lowercase hex MAC (64 chars).
 */
export declare function signEvent(event: Omit<DomainEvent, "signature">, secret: string): string;
//# sourceMappingURL=sign-event.d.ts.map