import { a as WebhookVerifier } from "../packem_shared/types.d-BXfGenMH.js";
export { type W as WebhookHeaders, g as getHeader } from "../packem_shared/types.d-BXfGenMH.js";
import "../packem_shared/types.d-C7l7qdMG.js";
/**
 * Computes an HMAC over `message` and returns the lowercase hex digest.
 * @param key The shared secret (UTF-8 string) or raw key bytes.
 * @param message The message to sign.
 * @param hash The hash algorithm (`"SHA-1"` or `"SHA-256"`).
 * @returns The hex-encoded HMAC.
 */
declare const hmacHex: (key: string | Uint8Array, message: string, hash: "SHA-1" | "SHA-256") => Promise<string>;
/**
 * Computes an HMAC over `message` and returns the base64 digest.
 * @param key The shared secret (UTF-8 string) or raw key bytes.
 * @param message The message to sign.
 * @param hash The hash algorithm (`"SHA-1"` or `"SHA-256"`).
 * @returns The base64-encoded HMAC.
 */
declare const hmacBase64: (key: string | Uint8Array, message: string, hash: "SHA-1" | "SHA-256") => Promise<string>;
/**
 * Constant-time string comparison to avoid leaking match position via timing.
 *
 * Both inputs are compared in full; the function returns early only on length
 * mismatch (which is not secret).
 * @param a The first string.
 * @param b The second string.
 * @returns `true` when the strings are equal.
 */
declare const timingSafeEqual: (a: string, b: string) => boolean;
/**
 * Verifier + parser for Slack event/interaction webhooks.
 *
 * Verification follows Slack's v0 signing scheme: the signature is
 * `v0=` + hex HMAC-SHA256 (keyed by the signing secret) of `v0:{timestamp}:{body}`.
 * The request timestamp is checked against a 5-minute replay window. Edge-safe — uses
 * Web Crypto only.
 */
declare const slackWebhook: WebhookVerifier;
/**
 * SNS message envelope (the relevant subset). SNS delivers every field as a string.
 */
interface SnsMessage {
  [key: string]: unknown;
  Message?: string;
  MessageId?: string;
  Signature?: string;
  SignatureVersion?: string;
  SigningCertURL?: string;
  SubscribeURL?: string;
  Timestamp?: string;
  TopicArn?: string;
  Type?: string;
}
/**
 * Verifies an AWS SNS message signature (SignatureVersion 1 = RSA-SHA1, 2 = RSA-SHA256) against
 * the certificate at its `SigningCertURL`. Validates the certificate host, rebuilds the
 * canonical string-to-sign, fetches (and caches) the signing certificate, and checks the RSA
 * signature with Web Crypto. Returns `false` on any malformed input, disallowed host, stale
 * `Timestamp`, fetch failure or signature mismatch. Edge-safe — `fetch` + Web Crypto only.
 * @param message The parsed SNS envelope.
 * @returns `true` when the signature is valid.
 */
declare const verifySnsMessage: (message: SnsMessage) => Promise<boolean>;
/**
 * Verifier + parser for AWS SNS HTTP/S subscription deliveries.
 *
 * `verify` implements SNS SignatureVersion 1 (RSA-SHA1) and 2 (RSA-SHA256): it validates the
 * `SigningCertURL` host, rebuilds the canonical string-to-sign, fetches and caches the signing
 * certificate, extracts its RSA public key and checks the signature — all with `fetch` + Web
 * Crypto, so it runs on edge runtimes. `headers` and `secret` are unused (SNS is asymmetric).
 * Callers handling `SubscriptionConfirmation` should confirm by requesting the `SubscribeURL`
 * from the parsed metadata.
 */
declare const snsWebhook: WebhookVerifier;
/**
 * Verifier + parser implementing the generic
 * [Standard Webhooks](https://www.standardwebhooks.com/) HMAC scheme.
 *
 * The signed content is `{id}.{timestamp}.{body}`; the signature is the base64
 * HMAC-SHA256 prefixed with `v1,`. The `webhook-signature` header may carry several
 * space-separated signatures (key rotation) — verification passes when any matches.
 * If the secret begins with `whsec_`, the base64 remainder is decoded to raw key bytes
 * and the HMAC is keyed with those bytes (per the spec); otherwise the raw secret string
 * is used directly. A hex digest is also accepted as a fallback for non-conformant
 * senders. Edge-safe — uses Web Crypto only.
 */
declare const standardWebhook: WebhookVerifier;
/**
 * Verifier + parser for Twilio status-callback webhooks.
 *
 * Verification follows Twilio's scheme: `X-Twilio-Signature` is the base64 HMAC-SHA1
 * (keyed by the auth token) of the request URL concatenated with the form parameters
 * sorted by key. The full request URL must be provided via the
 * `x-twilio-signature-url` header (the verifier cannot reconstruct it from the body).
 * Edge-safe — uses Web Crypto only.
 */
declare const twilioWebhook: WebhookVerifier;
export { type WebhookVerifier, hmacBase64, hmacHex, slackWebhook, snsWebhook, standardWebhook, timingSafeEqual, twilioWebhook, verifySnsMessage };