/**
 * Validates an HMAC-SHA256 signature from a Lemon Squeezy webhook request.
 * Uses timing-safe comparison to prevent timing attacks.
 *
 * @param rawBody - The raw request body bytes (NOT parsed JSON)
 * @param signatureHeader - The value of the X-Signature header
 * @param secret - The webhook secret configured in Lemon Squeezy dashboard
 * @returns true if signature is valid, false otherwise
 */
export declare function validateSignature(rawBody: Buffer, signatureHeader: string, secret: string): boolean;
/**
 * Extracts the signature header value from a map of HTTP headers.
 * Header names are case-insensitive in HTTP/1.1.
 */
export declare function extractSignatureHeader(headers: Record<string, string | string[] | undefined>): string;
//# sourceMappingURL=signature.d.ts.map