/**
 * Slack request-signature verification.
 *
 * Slack signs each request with HMAC-SHA256 over the string
 * `v0:{X-Slack-Request-Timestamp}:{rawBody}`, hex-encoded and prefixed `v0=`,
 * delivered in the `X-Slack-Signature` header. This is structurally identical
 * to the Stripe HMAC scheme in `@moxxy/plugin-webhooks/src/verify.ts` — a
 * timestamped HMAC over the raw bytes with a replay window — so the logic here
 * mirrors it: verify over the EXACT raw body bytes (never the reserialized
 * JSON), constant-time compare, and reject deliveries outside a ±5-minute
 * window to bound replay.
 *
 * Always returns a structured verdict; the caller decides whether to log the
 * reason (useful in dev) or hide it (preferable on a public endpoint).
 *
 * See: https://api.slack.com/authentication/verifying-requests-from-slack
 */
/** Slack's documented replay window: reject requests older than 5 minutes. */
export declare const SLACK_REPLAY_WINDOW_SEC: number;
export type SlackVerifyResult = {
    readonly ok: true;
} | {
    readonly ok: false;
    readonly reason: string;
};
export interface VerifySlackSignatureInput {
    readonly rawBody: Buffer;
    readonly headers: Record<string, string | string[] | undefined>;
    readonly signingSecret: string;
    /** Epoch-ms used to enforce the replay window. Defaults to `Date.now()`. */
    readonly nowMs?: number;
}
/**
 * Verify a Slack request signature against the raw body. Pass the EXACT bytes
 * read off the socket, BEFORE `JSON.parse` — reserializing the body changes
 * whitespace/key-order and breaks the HMAC.
 */
export declare function verifySlackSignature(input: VerifySlackSignatureInput): SlackVerifyResult;
//# sourceMappingURL=verify.d.ts.map