import { SignatureVerificationConfig, TriggerAuthHeaderInputSchema, TriggerAuthHeaderStoredSchema, TriggerAuthenticationStoredSchema } from "../validation/schemas.js";
import { z } from "zod";
import { Context } from "hono";

//#region src/utils/trigger-auth.d.ts
type TriggerAuthHeaderInput = z.infer<typeof TriggerAuthHeaderInputSchema>;
type TriggerAuthHeaderStored = z.infer<typeof TriggerAuthHeaderStoredSchema>;
type TriggerAuthenticationStored = z.infer<typeof TriggerAuthenticationStoredSchema>;
interface TriggerAuthResult {
  success: boolean;
  status?: number;
  message?: string;
}
interface HashedHeaderValue {
  valueHash: string;
  valuePrefix: string;
}
/**
 * Hash a header value using scrypt for secure storage.
 * Returns the hash and a prefix for display purposes.
 *
 * @param value - The plaintext header value to hash
 * @returns Object containing valueHash (for storage) and valuePrefix (for display)
 */
declare function hashTriggerHeaderValue(value: string): Promise<HashedHeaderValue>;
/**
 * Validate a header value against its stored hash using timing-safe comparison.
 *
 * @param value - The plaintext header value from the incoming request
 * @param storedHash - The hash stored in the database
 * @returns True if the value matches the hash
 */
declare function validateTriggerHeaderValue(value: string, storedHash: string): Promise<boolean>;
/**
 * Transform authentication input (plaintext values) to stored format (hashed values).
 * Used when creating or updating triggers.
 *
 * @param headers - Array of header inputs with plaintext values
 * @returns Array of headers with hashed values for storage
 */
declare function hashAuthenticationHeaders(headers: TriggerAuthHeaderInput[]): Promise<TriggerAuthHeaderStored[]>;
/**
 * Verifies incoming webhook requests using the configured authentication headers.
 * Each configured header must be present and match its expected value (via hash comparison).
 *
 * @param c - Hono context containing the request headers
 * @param authentication - Trigger authentication configuration with hashed header values
 * @returns TriggerAuthResult indicating success/failure with appropriate HTTP status
 */
declare function verifyTriggerAuth(c: Context, authentication?: TriggerAuthenticationStored | null): Promise<TriggerAuthResult>;
/**
 * Error codes for signature verification failures.
 */
type SignatureVerificationErrorCode = 'MISSING_SIGNATURE' | 'MISSING_COMPONENT' | 'INVALID_SIGNATURE_FORMAT' | 'SIGNATURE_MISMATCH';
interface SignatureVerificationResult {
  success: boolean;
  errorCode?: SignatureVerificationErrorCode;
  status?: number;
  message?: string;
}
/**
 * Verifies webhook signature using flexible, provider-agnostic configuration.
 * Supports GitHub, Slack, Zendesk, Stripe and other webhook signature schemes.
 *
 * SECURITY: Uses crypto.timingSafeEqual() for all signature comparisons to prevent timing attacks.
 *
 * @param c - Hono context containing request headers, query, and body
 * @param config - Signature verification configuration
 * @param signingSecret - HMAC signing secret
 * @param body - Raw request body as string
 * @returns SignatureVerificationResult with success status and error details
 *
 * @example
 * // GitHub webhook verification
 * const result = verifySignatureWithConfig(c, {
 *   algorithm: 'sha256',
 *   encoding: 'hex',
 *   signature: { source: 'header', key: 'x-hub-signature-256', prefix: 'sha256=' },
 *   signedComponents: [{ source: 'body', key: '@' }],
 *   componentJoin: { strategy: 'concatenate', separator: '' }
 * }, secret, body);
 */
declare function verifySignatureWithConfig(c: Context, config: SignatureVerificationConfig, signingSecret: string, body: string): SignatureVerificationResult;
//#endregion
export { HashedHeaderValue, SignatureVerificationErrorCode, SignatureVerificationResult, TriggerAuthResult, hashAuthenticationHeaders, hashTriggerHeaderValue, validateTriggerHeaderValue, verifySignatureWithConfig, verifyTriggerAuth };