/**
 * Stripe webhook types and signature verification utilities.
 *
 * Provides pure-function signature verification for Stripe webhook payloads,
 * including HMAC-SHA256 verification with timestamp-based replay protection.
 *
 * Stripe signs webhooks differently from GitHub:
 * - The signature header (`Stripe-Signature`) contains a timestamp `t` and
 *   one or more `v1` signatures in the format: `t=<unix>,v1=<hex>,v1=<hex>`
 * - The HMAC is computed over `${timestamp}.${rawBody}` (not the raw body alone)
 * - Replay protection rejects events older than a configurable tolerance (default 5 min)
 *
 * @see https://docs.stripe.com/webhooks/signatures
 */
/** Header containing the Stripe webhook signature. */
export declare const STRIPE_SIGNATURE_HEADER = "stripe-signature";
/** Default timestamp tolerance for replay protection (300 seconds = 5 minutes). */
export declare const DEFAULT_TIMESTAMP_TOLERANCE = 300;
/** Parsed components from a Stripe-Signature header. */
export interface StripeSignatureComponents {
    /** Unix timestamp (seconds) when Stripe generated the signature. */
    timestamp: number;
    /** One or more HMAC-SHA256 hex signatures (v1 scheme). */
    signatures: string[];
}
/**
 * Parse a Stripe-Signature header into its components.
 *
 * Format: `t=<unix_timestamp>,v1=<sig1>,v1=<sig2>,...`
 *
 * @param header - The raw Stripe-Signature header value.
 * @returns The parsed timestamp and signature(s), or `null` if the header is malformed.
 */
export declare function parseStripeSignatureHeader(header: string): StripeSignatureComponents | null;
/**
 * Verify a Stripe webhook signature.
 *
 * Computes HMAC-SHA256 of `${timestamp}.${rawBody}` using the webhook signing
 * secret and compares against each `v1` signature from the header using
 * timing-safe comparison.
 *
 * Also performs replay protection by checking that the timestamp is within
 * the allowed tolerance window.
 *
 * @param rawBody - The raw request body as a Buffer.
 * @param signatureHeader - The value of the Stripe-Signature header.
 * @param secret - The webhook signing secret (e.g., `whsec_...`).
 * @param tolerance - Maximum age of the event in seconds (default: 300 = 5 minutes).
 *                    Pass 0 to disable timestamp checking.
 * @returns An object with `valid: true` if the signature and timestamp are valid,
 *          or `valid: false` with a `reason` string if verification failed.
 */
export declare function verifyStripeSignature(rawBody: Buffer, signatureHeader: string, secret: string, tolerance?: number): {
    valid: boolean;
    reason?: string;
};
//# sourceMappingURL=stripe-types.d.ts.map