/** Documented test-only HMAC key — never use in production. */
export declare const APS_CF_TEST_SIGNING_KEY = "aps-cf-test-signing-key-not-for-production";
export declare const APS_CF_TEST_SIGNING_KEY_ID = "aps-cf-test-key-v1";
export interface SignOptions {
    key?: string;
    keyId?: string;
    timestamp?: number;
}
export interface SignedPushHeaders {
    'content-type': string;
    'x-delivery-id': string;
    'x-delivery-attempt': string;
    'x-signature': string;
    'x-signature-timestamp': string;
    'x-signature-key-id': string;
    'x-body-hash': string;
    [key: string]: string;
}
/**
 * Sign exact raw body bytes with HMAC-SHA256.
 * Signature format: `t=<unix>,v1=<hex>` over `${timestamp}.${bodyBytes}`.
 */
export declare const signBodyBytes: (body: Uint8Array, options?: SignOptions) => {
    signature: string;
    timestamp: number;
    bodyHash: string;
    keyId: string;
};
export declare const verifySignature: (body: Uint8Array, signatureHeader: string, options?: SignOptions) => boolean;
export declare const freezeBodyBytes: (body: Uint8Array | string | Record<string, unknown> | undefined) => Uint8Array;
export declare const buildSignedHeaders: (body: Uint8Array, options?: {
    deliveryId?: string;
    attempt?: number;
    contentType?: string;
    malformedSignature?: boolean;
    key?: string;
}) => SignedPushHeaders;
export interface DeliverPushOptions {
    url: string;
    body: Uint8Array;
    headers: Record<string, string>;
    /** Optional AbortSignal. */
    signal?: AbortSignal;
}
export interface DeliverPushResult {
    status: number;
    headers: Record<string, string>;
    body: unknown;
    rawBody: Uint8Array;
}
/**
 * Deliver a signed push to a caller-provided receiver URL.
 * Uses global fetch (Node 20+). Does not open arbitrary egress from scenario fixtures.
 */
export declare const deliverPush: (options: DeliverPushOptions) => Promise<DeliverPushResult>;
export interface PushSender {
    send(options: {
        receiverUrl: string;
        body?: Uint8Array | string | Record<string, unknown>;
        deliveryId?: string;
        attempt?: number;
        malformedSignature?: boolean;
        sequence?: number;
        /** Reuse exact prior body bytes (for retry-same-body-hash). */
        reuseBodyBytes?: Uint8Array;
    }): Promise<{
        deliveryId: string;
        attempt: number;
        bodyBytes: Uint8Array;
        bodyHash: string;
        status: number;
        responseBody: unknown;
    }>;
    getAckHistory(): readonly {
        deliveryId: string;
        attempt: number;
        status: number;
        body: unknown;
        recordedAt: string;
        bodyHash: string;
    }[];
    /** Webhook challenge handshake. */
    challenge(receiverUrl: string, mode: 'success' | 'failure'): Promise<{
        status: number;
        body: unknown;
    }>;
    lastBodyBytes(): Uint8Array | undefined;
}
export declare const createPushSender: (options?: {
    signingKey?: string;
}) => PushSender;
//# sourceMappingURL=index.d.ts.map