import type { FileEvent } from "../internal/events.js";
import type { Delivery, EventParser } from "./formats/index.js";
import type { SnsVerifyOptions } from "./sns.js";
import type { GoogleOidcOptions } from "./verify.js";
export type { SnsVerifyOptions } from "./sns.js";
export type { GoogleOidcOptions } from "./verify.js";
/** The provider's own delivery signature: B2, Cloudinary, Appwrite, Box. */
export interface SignatureVerifyOptions {
    /**
     * The signing secret: B2's `hmacSha256SigningSecret`, Cloudinary's API
     * secret, Appwrite's webhook signature key, Box's primary key.
     */
    secret: string;
    /** Box's secondary key (deliveries signed with either key pass). */
    secondarySecret?: string;
    /** Appwrite: the webhook URL exactly as configured in Appwrite (it's part of what's signed). */
    url?: string;
    /** Clock for timestamp freshness (Cloudinary, Box). Defaults to `Date.now`. */
    now?: () => number;
}
export interface EventsWebhookOptions {
    /**
     * How deliveries are authenticated. Required, so an endpoint is never
     * accidentally open:
     *
     * - `{ token }` — a shared secret, sent as `Authorization: Bearer <token>`
     *   (MinIO's webhook `auth_token`, Tigris, a Supabase webhook header) or as
     *   a `?token=` query parameter in the endpoint URL (Event Grid).
     * - `{ google }` — a Google-signed OIDC token (Pub/Sub push subscriptions
     *   with authentication, Eventarc).
     * - `{ secret }` — the provider's own signature (B2, Cloudinary, Appwrite,
     *   Box).
     * - `{ sns }` — Amazon SNS message signatures (S3 → SNS → HTTPS), pinned
     *   to your topic.
     * - `false` — something in front of this endpoint already authenticates.
     */
    verify: false | {
        token: string;
    } | {
        google: GoogleOidcOptions;
    } | ({
        secret: string;
    } & SignatureVerifyOptions) | {
        sns: SnsVerifyOptions;
    };
    /**
     * Called with a failure the response doesn't spell out: an unexpected error
     * while authenticating or parsing a delivery (answered with a generic
     * `500`). A handler's error goes to `events({ onError })` instead. Defaults
     * to `console.error`.
     */
    onError?: (cause: unknown, req: Request) => void;
}
/** A webhook endpoint: mount it with any gateway binding's `createRouteHandler`. */
export interface WebhookHandler {
    handle: (req: Request) => Promise<Response>;
}
export interface WebhookDeps {
    parser: EventParser;
    /** Decode a raw body (arrays split into one delivery per element). */
    decode: (body: string, headers: Headers) => Delivery[];
    normalize: (parser: EventParser, deliveries: readonly Delivery[]) => FileEvent[];
    emit: (events: readonly FileEvent[]) => Promise<void>;
    /** Whether `emit` rejected because handlers threw (they were already reported), not for another reason. */
    isHandlerFailure: (cause: unknown) => boolean;
}
export declare const createWebhook: (opts: EventsWebhookOptions | undefined, deps: WebhookDeps) => WebhookHandler;
//# sourceMappingURL=webhook.d.ts.map