/**
 * pipeline/callback-delivery.ts
 *
 * Delivers evaluation results to a callback URL with HMAC signature.
 * Used by the API-triggered pipeline flow: after the report is published
 * to the Content Lake (system of record), the result is also POSTed
 * to the caller's callback URL.
 *
 * Fire-and-forget with 3 retries and exponential backoff. If callback
 * fails, log a warning — the result is still in the Content Lake.
 *
 * @see docs/design-docs/api-service-gateway.md
 */
import type { WebhookEventEnvelope } from "../_vendor/ailf-core/index.d.ts";
import type { EventType } from "../_vendor/ailf-shared/index.d.ts";
import { type EgressGuardOptions } from "../notifications/egress-guard.js";
export interface CallbackConfig {
    /** Optional custom headers to include in the callback request */
    headers?: Record<string, string>;
    /** The callback URL to POST results to */
    url: string;
    /** Events that trigger the callback. Empty/absent = all events. */
    events?: EventType[];
}
/**
 * Generate an HMAC-SHA256 signature for the callback payload.
 *
 * The signature is computed over the raw JSON body using the callback URL
 * as the signing key. This allows the receiver to verify the request
 * originated from AILF without requiring a pre-shared secret.
 *
 * The receiver should:
 * 1. Read the raw request body
 * 2. Compute HMAC-SHA256(body, callbackUrl)
 * 3. Compare with the X-AILF-Signature header
 */
export declare function computeSignature(body: string, signingKey: string): string;
/**
 * Deliver a signed webhook envelope behind the egress guard. The body is signed
 * with `opts.signingSecret` (the global AILF secret), not the URL. Never throws:
 * an egress rejection or transport error returns `{ ok: false }`.
 *
 * Receivers verify by recomputing `HMAC-SHA256(raw body, sharedSecret)` and
 * comparing to the `X-AILF-Signature` header.
 */
export declare function deliverWebhook(target: {
    url: string;
    headers?: Record<string, string>;
}, envelope: WebhookEventEnvelope, opts: {
    signingSecret: string;
} & EgressGuardOptions): Promise<{
    ok: boolean;
    error?: string;
    attempts: number;
}>;
