/**
 * Absolute path to a usable `stripe` binary, downloading it if needed.
 *
 * Order: an existing install on PATH (respect what the developer already has) →
 * this package's cache → download from Stripe's GitHub releases into the cache.
 * Nothing is installed globally and nothing outside the cache is touched.
 */
export declare function resolveStripeCli(opts?: {
    log?: (msg: string) => void;
    allowDownload?: boolean;
}): Promise<string>;
export type Listener = {
    /** The signing secret for THIS session — not the registered endpoint's. */
    secret: string;
    /** Stop forwarding. */
    stop: () => void;
};
/**
 * Start `stripe listen` and resolve once it reports its signing secret.
 *
 * No endpoint is registered and no tunnel is opened: the CLI holds an outbound
 * connection to Stripe and forwards events to `forwardTo`.
 */
export declare function listenForWebhooks(opts: {
    /** e.g. http://localhost:3000/api/stripe/webhook */
    forwardTo: string;
    /** Defaults to STRIPE_SECRET_KEY. Passing it avoids the interactive login. */
    apiKey?: string;
    /** Restrict forwarding to these event types. */
    events?: readonly string[];
    log?: (msg: string) => void;
    /** Fail if no secret appears within this long. Default 30s. */
    timeoutMs?: number;
}): Promise<Listener>;
/**
 * The whole local-webhook story in ONE call: fetch the CLI if needed, start
 * forwarding, and hand the session's signing secret to the dev server.
 *
 * The pieces above have existed for a while and every app still wired them
 * itself — which is the gap this closes, because "you can do local payments with
 * only a Stripe key" and "you can do local payments once you've written the
 * script that does it" are different promises.
 *
 * Writing the secret into a dotenv file rather than the environment is deliberate:
 * `stripe listen` mints a NEW secret per session, and the dev server that has to
 * verify against it is a different process (often started by the same `dev`
 * script). A file is the only channel both can see.
 */
export declare function startLocalWebhooks(opts?: {
    /** Default http://localhost:3000/api/stripe/webhook */
    forwardTo?: string;
    /** Dotenv file the secret is written to. Default `.env.local`. Pass `null` to
     *  skip the write and read `secret` off the return value yourself. */
    envFile?: string | null;
    /** Restrict forwarding to these event types. Default: the ones that move
     *  money (`BILLING_WEBHOOK_EVENTS`) — a local run has no use for the rest,
     *  and a narrower stream is a readable log. */
    events?: readonly string[];
    apiKey?: string;
    log?: (msg: string) => void;
}): Promise<Listener & {
    forwardTo: string;
    envFile: string | null;
}>;
/** One key out of a dotenv file, or undefined. Deliberately minimal — this
 *  entry point is reachable with nothing installed but Node, so it grows no
 *  dotenv dependency to read one variable. */
export declare function readEnvVar(file: string, key: string): Promise<string | undefined>;
/**
 * Set one key in a dotenv file, leaving everything else byte-identical.
 *
 * Used to hand the session's signing secret to a dev server running in another
 * process. Rewrites the existing line when present rather than appending a
 * duplicate, because two definitions of the same key is a debugging afternoon.
 */
export declare function setEnvVar(file: string, key: string, value: string): Promise<boolean>;
//# sourceMappingURL=stripe-cli.d.ts.map