export type SignedRequestHeaders = {
    'x-zt-key-id': string;
    'x-zt-timestamp': string;
    'x-zt-nonce': string;
    'x-zt-body-sha256': string;
    'x-zt-signature': string;
};
export type SignedRequestCreateHeadersParams = {
    method: string;
    url: string | URL;
    body?: string | Uint8Array | null;
    keyId: string;
    secret: string;
    timestampMs?: number;
    nonce?: string;
};
export type SignedRequestVerifyParams = {
    method: string;
    url: string | URL;
    body?: string | Uint8Array | null;
    headers: Headers | Record<string, string | undefined>;
    getSecretForKeyId: (keyId: string) => string | undefined | Promise<string | undefined>;
    nowMs?: number;
    windowMs?: number;
    /**
     * Optional replay protection hook.
     * Return true if the nonce is accepted and stored; false if replayed/invalid.
     */
    verifyNonce?: (keyId: string, nonce: string, ttlMs: number) => Promise<boolean>;
};
export type SignedRequestVerifyResult = {
    ok: true;
    keyId: string;
    timestampMs: number;
    nonce: string;
} | {
    ok: false;
    code: 'MISSING_HEADER' | 'INVALID_TIMESTAMP' | 'EXPIRED' | 'INVALID_BODY_SHA' | 'INVALID_SIGNATURE' | 'UNKNOWN_KEY' | 'REPLAYED';
    message: string;
};
export declare const SignedRequest: Readonly<{
    sha256Hex: (data: string | Uint8Array) => Promise<string>;
    canonicalString: (params: {
        method: string;
        url: string | URL;
        timestampMs: number;
        nonce: string;
        bodySha256Hex: string;
    }) => string;
    createHeaders(params: SignedRequestCreateHeadersParams): Promise<SignedRequestHeaders>;
    verify(params: SignedRequestVerifyParams): Promise<SignedRequestVerifyResult>;
}>;
//# sourceMappingURL=SignedRequest.d.ts.map