import { type HeaderSource, type VerifyOptions } from '@m2c/core';
import type { ConversionEvent } from './types.js';
/**
 * Verify and parse a conversion webhook delivered by M2C.
 *
 * The HMAC check is delegated to `@m2c/core`'s `verify` (HMAC-SHA256 over
 * `timestamp + "\n" + rawBody`, constant-time, with the malformed/missing/skew
 * taxonomy). On success the trusted bytes are parsed and mapped from the API's
 * snake_case wire shape to the SDK's camelCase {@link ConversionEvent}.
 *
 * IMPORTANT: pass the RAW request body bytes/string exactly as received. A
 * re-serialized JSON object will not reproduce the signed bytes and will fail
 * verification.
 *
 * @throws {M2CSignatureError} when the delivery cannot be trusted (signature
 * missing, malformed, skewed, or mismatched). Do not act on the payload in
 * that case.
 * @throws {M2CError} when the signature verified but the payload does not
 * match the conversion contract. The delivery is authentic - this signals
 * contract drift (e.g. a newly added status), not tampering.
 */
export declare function verifyConversionWebhook(secret: string, rawBody: string | Buffer, headers: HeaderSource, options?: VerifyOptions): ConversionEvent;