/**
 * Webhook verification utilities for Riverbank SDK
 *
 * Provides framework-agnostic webhook signature verification and payload parsing.
 */
import { z } from 'zod';
/**
 * Supported webhook event types.
 * Keep in sync with apps/dashboard/src/lib/db/helpers/webhooks.ts
 */
export declare const WebhookEventSchema: z.ZodEnum<{
    "page.published": "page.published";
    "entry.published": "entry.published";
    "navigation.updated": "navigation.updated";
    "theme.updated": "theme.updated";
    "site.settings_updated": "site.settings_updated";
}>;
export type WebhookEvent = z.infer<typeof WebhookEventSchema>;
/** Data for page.published events */
export declare const PagePublishedDataSchema: z.ZodObject<{
    pageId: z.ZodString;
    path: z.ZodString;
    slug: z.ZodOptional<z.ZodString>;
}, z.core.$strip>;
/** Data for entry.published events */
export declare const EntryPublishedDataSchema: z.ZodObject<{
    entryId: z.ZodString;
    path: z.ZodString;
    contentType: z.ZodString;
}, z.core.$strip>;
/** Data for navigation.updated events */
export declare const NavigationUpdatedDataSchema: z.ZodObject<{
    menuId: z.ZodOptional<z.ZodString>;
}, z.core.$strip>;
/** Data for theme.updated and site.settings_updated events (empty) */
export declare const EmptyDataSchema: z.ZodObject<{}, z.core.$strip>;
/**
 * Combined data schema that accepts any valid event data.
 * The actual shape depends on the event type.
 */
export declare const WebhookDataSchema: z.ZodUnion<readonly [z.ZodObject<{
    pageId: z.ZodString;
    path: z.ZodString;
    slug: z.ZodOptional<z.ZodString>;
}, z.core.$strip>, z.ZodObject<{
    entryId: z.ZodString;
    path: z.ZodString;
    contentType: z.ZodString;
}, z.core.$strip>, z.ZodObject<{
    menuId: z.ZodOptional<z.ZodString>;
}, z.core.$strip>, z.ZodObject<{}, z.core.$strip>]>;
export type PagePublishedData = z.infer<typeof PagePublishedDataSchema>;
export type EntryPublishedData = z.infer<typeof EntryPublishedDataSchema>;
export type NavigationUpdatedData = z.infer<typeof NavigationUpdatedDataSchema>;
/**
 * Zod schema for webhook payload validation.
 */
export declare const WebhookPayloadSchema: z.ZodObject<{
    event: z.ZodEnum<{
        "page.published": "page.published";
        "entry.published": "entry.published";
        "navigation.updated": "navigation.updated";
        "theme.updated": "theme.updated";
        "site.settings_updated": "site.settings_updated";
    }>;
    timestamp: z.ZodString;
    siteId: z.ZodString;
    data: z.ZodRecord<z.ZodString, z.ZodUnknown>;
    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
}, z.core.$strip>;
/**
 * Webhook payload structure sent by the CMS.
 */
export type WebhookPayload = z.infer<typeof WebhookPayloadSchema>;
/**
 * Type-safe webhook payload with discriminated data based on event type.
 */
export type TypedWebhookPayload = {
    event: 'page.published';
    data: PagePublishedData;
    siteId: string;
    timestamp: string;
    tags?: string[];
} | {
    event: 'entry.published';
    data: EntryPublishedData;
    siteId: string;
    timestamp: string;
    tags?: string[];
} | {
    event: 'navigation.updated';
    data: NavigationUpdatedData;
    siteId: string;
    timestamp: string;
    tags?: string[];
} | {
    event: 'theme.updated';
    data: Record<string, never>;
    siteId: string;
    timestamp: string;
    tags?: string[];
} | {
    event: 'site.settings_updated';
    data: Record<string, never>;
    siteId: string;
    timestamp: string;
    tags?: string[];
};
/**
 * Verify a webhook signature using HMAC-SHA256.
 *
 * Uses timing-safe comparison to prevent timing attacks.
 *
 * @param payload - The raw request body as a string
 * @param signature - The X-Riverbank-Signature header value
 * @param secret - The webhook signing secret (RIVERBANK_WEBHOOK_SECRET)
 * @returns true if signature is valid, false otherwise
 *
 * @example
 * ```ts
 * const body = await request.text();
 * const signature = request.headers.get('x-riverbank-signature');
 * const secret = process.env.RIVERBANK_WEBHOOK_SECRET;
 *
 * if (!verifyWebhookSignature(body, signature, secret)) {
 *   return new Response('Invalid signature', { status: 401 });
 * }
 * ```
 */
export declare function verifyWebhookSignature(payload: string, signature: string, secret: string): boolean;
/**
 * Result type for webhook payload parsing.
 */
export type ParseWebhookResult = {
    success: true;
    payload: WebhookPayload;
} | {
    success: false;
    error: string;
};
/**
 * Parse and validate a webhook payload from the request body.
 *
 * Uses Zod schema validation to ensure the payload has the expected structure.
 *
 * @param body - The raw request body as a string
 * @returns A result object with either the validated payload or an error message
 *
 * @example
 * ```ts
 * const body = await request.text();
 * const result = parseWebhookPayload(body);
 * if (!result.success) {
 *   return new Response(result.error, { status: 400 });
 * }
 * console.log(`Received ${result.payload.event} for site ${result.payload.siteId}`);
 * ```
 */
export declare function parseWebhookPayload(body: string): ParseWebhookResult;
