/**
 * Verify an incoming webhook payload's HMAC-SHA256 signature.
 *
 * @param payload   - The raw request body (string or Buffer)
 * @param signature - The hex signature from the X-Webhook-Signature header (after "sha256=")
 * @param secret    - The webhook secret (from registration)
 * @returns true if signature is valid
 */
export declare function verifyWebhookSignature(payload: string | Buffer, signature: string, secret: string): boolean;
/**
 * Verify a webhook signature bound to a timestamp, with a replay window
 * (Stripe-style). The sender computes
 * `HMAC-SHA256(secret, "<timestamp>.<payload>")` and transmits `timestamp`
 * alongside the signature; signatures whose timestamp falls outside
 * `toleranceSeconds` are rejected, so a captured webhook stops verifying once
 * the window passes.
 *
 * Requires the sender (the J41 platform) to sign `timestamp.payload` and send
 * the timestamp header — see the backend report.
 *
 * @param payload   - Raw request body
 * @param signature - Hex signature (with or without "sha256=" prefix)
 * @param secret    - Webhook secret
 * @param timestamp - Unix seconds the sender signed (from the timestamp header)
 * @param opts.toleranceSeconds - Max age/skew. Default 300.
 * @param opts.now  - Current unix seconds (override for testing)
 */
export declare function verifyWebhookSignatureWithTimestamp(payload: string | Buffer, signature: string, secret: string, timestamp: number, opts?: {
    toleranceSeconds?: number;
    now?: number;
}): boolean;
/**
 * Generate a cryptographically random webhook secret (64 hex chars = 32 bytes).
 */
export declare function generateWebhookSecret(): string;
//# sourceMappingURL=verify.d.ts.map