import type { JsonObject, JsonValue } from "../internal/json.js";
export interface SnsVerifyOptions {
    /**
     * The topic ARN (or ARNs) deliveries must come from. Required: SNS signs a
     * message for any topic, including one an attacker owns, so without it a
     * forged S3 event on their topic would verify (and, with `confirm`, your
     * endpoint would subscribe to it). Checked on notifications and on
     * subscription messages alike.
     */
    topicArn: string | readonly string[];
    /**
     * Visit the `SubscribeURL` of a verified `SubscriptionConfirmation`, so a
     * new subscription starts delivering. Default `false`: the URL is logged
     * for you to confirm by hand (SNS sends nothing until you do).
     */
    confirm?: boolean;
    /**
     * How old a message's signed `Timestamp` may be, ms, so a captured message
     * can't be replayed later. Default one hour, the longest an SNS delivery
     * policy retries for. A `Timestamp` more than five minutes ahead of the
     * clock is refused too.
     */
    maxAge?: number;
    /** Clock for the `Timestamp` check. Defaults to `Date.now`. */
    now?: () => number;
    /** Fetches the signing certificate and the `SubscribeURL`. Defaults to the global `fetch`. */
    fetch?: typeof fetch;
}
/**
 * An `https://sns.<region>.amazonaws.com[.cn]/…` URL on the default port with
 * no credentials, or `undefined`. With `pem`, a signing certificate's URL:
 * `/SimpleNotificationService-<hex>.pem` and nothing after it (no query or
 * fragment).
 */
export declare const snsUrl: (value: JsonValue | undefined, pem?: boolean) => URL | undefined;
export declare const stringToSign: (message: JsonObject) => string;
/** Throws `Invalid` unless `opts` pins at least one topic and a usable `maxAge`. */
export declare const checkSnsOptions: (opts: SnsVerifyOptions) => void;
/**
 * A verifier for SNS HTTP deliveries. Resolves with the verified envelope cut
 * down to the fields the signature covers (`Type`, `TopicArn`, `Message`,
 * `MessageId`, `Timestamp`, `Subject`, and for subscription messages
 * `SubscribeURL` and `Token`): anything else in the body is unauthenticated,
 * so nothing downstream may read it. Caches signing keys per certificate URL
 * (the most recently used few).
 */
export declare const snsVerifier: (opts: SnsVerifyOptions) => ((req: Request, body: string) => Promise<JsonObject>);
/** Answer a verified SNS subscription lifecycle message, or `undefined` for a `Notification`. */
export declare const snsHandshake: (message: JsonObject, opts: SnsVerifyOptions) => Promise<Response | undefined>;
//# sourceMappingURL=sns.d.ts.map