/**
 * Inbound webhook verification dispatcher.
 *
 * Single entry point used by the orchestrator's chunked webhook.relay handler
 * to decide whether an inbound webhook is trusted before it enters the normal
 * processing pipeline. Dispatches by routing-key prefix to the appropriate
 * provider verification path:
 *
 * - `github:*`  -> reads the webhook secret from PgSecretStore at scope
 *                  `__source__/<sourceId>` and runs engine `verifySignature`
 *                  against the inbound `x-hub-signature-256` header (or the
 *                  signature header forwarded from Platform).
 * - `generic:*` -> looks up the source via GenericSourceManager, parses
 *                  `verification_method` + `verification_config`, and runs
 *                  the corresponding HMAC / bearer / IP-allowlist check via
 *                  `verifyGenericWebhook`.
 *
 * All four `WebhookRelayResult` outcomes are produced here:
 * - `accepted` when the source exists and the inbound signature/method passes.
 * - `rejected_signature` when the source exists but the signature does not match
 *   any rotation secret (or method-specific check fails).
 * - `rejected_unknown_source` when no row exists for the routing key (deleted,
 *   never created, or the prefix is for a provider that is not yet implemented).
 * - `rejected_misconfigured` when the source exists but its server-side state
 *   prevents verification (no secret stored, malformed verification_config JSON,
 *   etc). Operators should see this in metrics and fix the source config.
 *
 * The `reason` string returned alongside each rejection is non-secret-bearing
 * (no HMAC keys, bearer tokens, computed signatures); it is safe to surface in
 * `webhook.ack` reason field and in dashboards.
 */
import type { Kysely } from 'kysely';
import type { WebhookRelayResult } from '@kici-dev/engine';
import type { Database } from '../db/types.js';
import type { PgSecretStore } from '../secrets/pg-secret-store.js';
import type { GenericSourceManager } from './generic-sources.js';
/** Verification result + non-secret-bearing diagnostic for the orchestrator ACK. */
export interface VerifyOutcome {
    result: WebhookRelayResult;
    reason?: string;
}
/** Inputs the orchestrator-side handler hands to the dispatcher. */
export interface VerifyInboundInput {
    /** Routing key including provider prefix (`github:<appId>`, `generic:<orgId>:<sourceId>`, ...). */
    routingKey: string;
    /** Reassembled raw body bytes from the chunked relay stream. */
    body: Buffer;
    /** Lowercased headers Platform forwarded for this inbound webhook. */
    headers: Record<string, string>;
    /**
     * Inbound HTTP signature header NAME (lowercased), e.g. `x-hub-signature-256`.
     * Null when the inbound HTTP request had no signature header at all (some
     * generic verification methods do not need it; HMAC paths reject in that case).
     */
    signatureHeaderName: string | null;
    /** Inbound HTTP signature header VALUE (the claimed signature). */
    signatureHeader: string | null;
    /** Inbound HTTP request client IP, for IP-allowlist verification. */
    clientIp: string | null;
}
/** Dependencies the dispatcher reads from. */
export interface VerifyInboundDeps {
    /** Kysely DB handle for `sources` table lookups (github sources). */
    db: Kysely<Database>;
    /** Encrypted secret store for reading webhook secrets at `__source__/<sourceId>`. */
    secretStore: PgSecretStore;
    /** Manager for `generic_webhook_sources` rows. */
    genericSourceManager: GenericSourceManager;
}
/**
 * Run inbound verification for one webhook.
 *
 * Pure-ish: reads from the DB + secret store, but never throws — every error
 * path collapses into a `WebhookRelayResult`. The orchestrator handler is
 * waiting on a 5 s ACK budget and must not block on an exception.
 */
export declare function verifyInboundWebhook(deps: VerifyInboundDeps, input: VerifyInboundInput): Promise<VerifyOutcome>;
//# sourceMappingURL=verify-inbound.d.ts.map