/**
 * Aegis Webhook Alerts — fire-and-forget HTTP notifications for security events.
 *
 * Webhook endpoints are stored in SQLite and can subscribe to specific event types.
 * When an event fires, all matching webhooks receive a JSON POST with event details.
 *
 * Delivery is best-effort: retries up to 3 times with exponential backoff.
 * Failed deliveries are logged but never block the request pipeline.
 */
import type Database from 'better-sqlite3-multiple-ciphers';
import type { Vault } from '../vault/index.js';
/**
 * Event types that can trigger webhook notifications.
 */
export type WebhookEventType = 'blocked_request' | 'credential_expiry' | 'rate_limit_exceeded' | 'agent_auth_failure' | 'body_inspection';
export declare const WEBHOOK_EVENT_TYPES: readonly WebhookEventType[];
/**
 * Stored webhook configuration.
 */
export interface Webhook {
    id: string;
    url: string;
    events: WebhookEventType[];
    /** Optional human-readable label */
    label?: string;
    /** HMAC secret for signing payloads (auto-generated) */
    secret: string;
    createdAt: string;
}
/**
 * Payload sent to webhook endpoints.
 */
export interface WebhookPayload {
    /** Unique event ID */
    id: string;
    /** Event type */
    event: WebhookEventType;
    /** ISO 8601 timestamp */
    timestamp: string;
    /** Event-specific details */
    details: Record<string, unknown>;
}
export interface WebhookManagerOptions {
    db: Database.Database;
    logLevel?: 'debug' | 'info' | 'warn' | 'error';
    /** Maximum retries per delivery attempt (default: 3) */
    maxRetries?: number;
    /** Base delay in ms for exponential backoff (default: 1000) */
    baseDelayMs?: number;
    /** Request timeout in ms (default: 10000) */
    timeoutMs?: number;
    /** Testing: override transport */
    _testTransport?: (url: string, payload: string, headers: Record<string, string>) => Promise<number>;
}
export declare class WebhookManager {
    private db;
    private logger;
    private maxRetries;
    private baseDelayMs;
    private timeoutMs;
    private testTransport?;
    constructor(options: WebhookManagerOptions);
    /**
     * Register a new webhook endpoint.
     */
    add(params: {
        url: string;
        events: WebhookEventType[];
        label?: string;
    }): Webhook;
    /**
     * List all registered webhooks.
     */
    list(): Webhook[];
    /**
     * Get a webhook by ID.
     */
    getById(id: string): Webhook | null;
    /**
     * Remove a webhook by ID.
     */
    remove(id: string): boolean;
    /**
     * Emit an event to all matching webhooks.
     * This is fire-and-forget — it never blocks the caller.
     */
    emit(event: WebhookEventType, details: Record<string, unknown>): void;
    /**
     * Deliver a payload to a webhook endpoint with retries.
     */
    private deliver;
    /**
     * Send an HTTP/HTTPS POST request.
     */
    private send;
    /**
     * HMAC-SHA256 signature for payload verification.
     * Recipients can verify the webhook came from Aegis using:
     *   sha256=HMAC(body, secret)
     */
    private sign;
    /**
     * Sleep for a given number of milliseconds.
     */
    private sleep;
    private rowToWebhook;
    /**
     * Check all credentials in the vault for approaching expiry.
     * Emits `credential_expiry` webhook events for credentials expiring within `thresholdDays`.
     * Returns the number of credentials that triggered alerts.
     */
    checkExpiringCredentials(vault: Vault, thresholdDays?: number): number;
}
//# sourceMappingURL=webhook.d.ts.map