/**
 * verify-event — HMAC-SHA256 event verification with replay protection.
 *
 * Performs 3 checks in order per ADR-ECO-017:
 *   1. Signature equality (timing-safe via timingSafeEqual)
 *   2. Clock skew within window (default 5 min)
 *   3. Nonce dedup via NonceStore (if provided)
 *
 * Throws typed errors: InvalidSignatureError | ClockSkewError |
 *   ReplayDetectedError | UnknownSourceError
 *
 * @module auth/verify-event
 * @public
 */
import type { DomainEvent } from "../ports/event-bus.js";
import type { NonceStore } from "./nonce-store.js";
export interface VerifyEventOptions {
    /** Maximum allowed clock skew in milliseconds. Default: 300_000 (5 min). */
    maxClockSkewMs?: number;
    /** NonceStore for replay protection. If absent, replay check is skipped. */
    nonceStore?: NonceStore;
}
/**
 * Verifies a signed DomainEvent.
 *
 * @param event     - The full DomainEvent including signature field.
 * @param secret    - HMAC key used to verify the signature.
 * @param opts      - Optional clock skew tolerance and nonce store.
 * @returns true if the event is valid.
 * @throws {UnknownSourceError}     if event.source is not in the allowed enum.
 * @throws {InvalidSignatureError}  if the HMAC does not match.
 * @throws {ClockSkewError}         if the timestamp is outside the allowed window.
 * @throws {ReplayDetectedError}    if the nonce was already seen (replay attack).
 */
export declare function verifyEvent(event: DomainEvent, secret: string, opts?: VerifyEventOptions): Promise<true>;
//# sourceMappingURL=verify-event.d.ts.map