export type WebhookProvider = "stripe" | "github" | "generic";
export type SignatureEncoding = "hex" | "base64";
export interface VerifyWebhookOptions {
    /** Known-provider preset. Default `"generic"` (which requires {@link header}). */
    readonly provider?: WebhookProvider;
    /** Header carrying the signature. Required for `generic`; overrides the preset otherwise. */
    readonly header?: string;
    /** How the signature is encoded in the header. Default `"hex"`. */
    readonly encoding?: SignatureEncoding;
    /** A prefix stripped from the header value before decoding, e.g. `"sha256="`. */
    readonly prefix?: string;
    /** Max raw body bytes to read before rejecting (`payload_too_large`). Default 1 MiB. */
    readonly maxBytes?: number;
    /** Replay window in seconds for timestamped schemes (Stripe). Default 300. */
    readonly toleranceSeconds?: number;
    /** Current unix time (seconds); defaults to `Date.now()/1000`. Injectable for tests. */
    readonly now?: number;
}
export type WebhookFailureReason = "missing_signature" | "invalid_signature" | "timestamp_out_of_tolerance" | "malformed_signature" | "payload_too_large" | "invalid_content_length";
/** Verified ⇒ the raw `payload` text (parse it with your schema). Rejected ⇒ a stable `reason`. */
export type WebhookResult = {
    readonly ok: true;
    readonly payload: string;
} | {
    readonly ok: false;
    readonly reason: WebhookFailureReason;
};
/**
 * Verify a webhook request's signature and return its raw payload. Reads `req.body` (bounded), so the
 * body is consumed - parse the returned `payload`, don't re-read the request.
 *
 * @param secret the signing secret (or an array, to accept either during a secret rotation).
 *
 * @example
 * ```ts
 * const r = await verifyWebhook(c.req, env.STRIPE_WEBHOOK_SECRET, { provider: "stripe" })
 * if (!r.ok) return c.json({ ok: false, error: r.reason }, 400)
 * const event = StripeEvent.parse(JSON.parse(r.payload)) // validate at the trust boundary
 * ```
 */
export declare function verifyWebhook(req: Request, secret: string | readonly string[], options?: VerifyWebhookOptions): Promise<WebhookResult>;
//# sourceMappingURL=webhook.d.ts.map