/**
 * Verification for inbound HydraDB webhook deliveries.
 *
 * Every signed delivery carries:
 *
 *     X-HydraDB-Signature: sha256=<hex>
 *
 * where `<hex>` is the HMAC-SHA256 of the **raw request body**, keyed by the
 * signing secret. Signing the raw bytes is the part that is easy to get wrong:
 * parsing the JSON and re-serialising it produces different bytes and the
 * signature will never match. Capture the body as a Buffer before parsing it -
 * in Express that means `express.raw({ type: "application/json" })`.
 */
export declare const SIGNATURE_HEADER = "X-HydraDB-Signature";
export declare const DELIVERY_ID_HEADER = "X-HydraDB-Delivery-ID";
export declare const EVENT_HEADER = "X-HydraDB-Event";
/**
 * Returns true when `signature` is a valid HydraDB signature for `rawBody`.
 *
 * @param secret - the signing secret configured for your webhook.
 * @param rawBody - the request body exactly as received, unparsed.
 * @param signature - the `X-HydraDB-Signature` header value.
 *
 * Comparison is constant-time. A missing secret, body, or header is treated as a
 * failed verification rather than an error, so the call fails closed:
 *
 *     if (!verifyWebhookSignature(secret, rawBody, sig)) {
 *       return res.status(401).send("Invalid signature");
 *     }
 */
export declare function verifyWebhookSignature(secret: string, rawBody: Buffer | string, signature: string | undefined | null): boolean;