import { VerifyFn } from "./types.js";
//#region src/verify.d.ts
/**
 * Compares two byte arrays in constant time to prevent timing attacks.
 */
export declare const constantTimeEquals: (a: Uint8Array, b: Uint8Array) => boolean;
declare const HMAC_HASH: {
  readonly sha1: "SHA-1";
  readonly sha256: "SHA-256";
  readonly sha384: "SHA-384";
  readonly sha512: "SHA-512";
};
type HmacAlgorithm = keyof typeof HMAC_HASH;
/**
 * Creates a webhook verifier that validates an HMAC signature from a request header.
 *
 * The verifier imports the provided string secret once, computes an HMAC from
 * `ctx.rawBody`, normalizes the incoming header value, and compares both
 * signatures in constant time.
 *
 * Header values like `sha256=<hex>` are supported so common provider formats
 * such as GitHub work without extra parsing.
 *
 * @example
 * ```ts
 * import { createWebhookRouter } from "@zap-studio/webhooks";
 * import { createHmacVerifier } from "@zap-studio/webhooks/verify";
 *
 * const router = createWebhookRouter({
 *   verify: createHmacVerifier({
 *     headerName: "x-hub-signature-256",
 *     secret: process.env.GITHUB_WEBHOOK_SECRET!,
 *   }),
 * });
 * ```
 *
 * @param options - Verifier configuration.
 * @param options.headerName - Header containing the provider signature.
 * @param options.secret - Shared HMAC secret as a string.
 * @param options.algo - HMAC hash algorithm. Defaults to `"sha256"`.
 * @returns A router-compatible request verifier.
 *
 * @throws {VerificationError}
 * Thrown when verifier setup fails or request verification does not pass.
 */
export declare const createHmacVerifier: ({ headerName, secret, algo }: {
  headerName: string;
  secret: string;
  algo?: HmacAlgorithm;
}) => VerifyFn;
//#endregion
//# sourceMappingURL=verify.d.ts.map