import type { ProcessingWebhookEvent } from '../types/partners.js';
/**
 * Verify a processing webhook signature.
 *
 * Deliveries are signed Stripe-style: the `tagadapay-signature` header is
 * `t=<unix seconds>,v1=<hex hmac-sha256(secret, "<t>.<rawBody>")>`, keyed by
 * the endpoint's `whsec_…` secret.
 *
 * @param rawBody          The EXACT raw request body string (do not re-serialize).
 * @param signatureHeader  The `tagadapay-signature` header value.
 * @param secret           The endpoint's `whsec_…` secret.
 * @param toleranceSeconds Reject signatures older than this (replay guard). Default 300.
 */
export declare function verifyProcessingWebhookSignature(rawBody: string, signatureHeader: string | null | undefined, secret: string, toleranceSeconds?: number): boolean;
/**
 * Verify + parse a processing webhook in one call (like Stripe's
 * `webhooks.constructEvent`). Throws on an invalid signature.
 *
 * @example
 * app.post('/webhooks/tagada', express.raw({ type: 'application/json' }), (req, res) => {
 *   const event = constructProcessingEvent(
 *     req.body.toString('utf8'),
 *     req.headers['tagadapay-signature'],
 *     process.env.TAGADA_WEBHOOK_SECRET!,
 *   );
 *   switch (event.type) {
 *     case 'payout.paid':
 *       console.log(`Payout for ${event.account}:`, event.data.object);
 *       break;
 *   }
 *   res.sendStatus(200);
 * });
 */
export declare function constructProcessingEvent<T = Record<string, unknown>>(rawBody: string, signatureHeader: string | null | undefined, secret: string, toleranceSeconds?: number): ProcessingWebhookEvent<T>;
//# sourceMappingURL=processingWebhookVerification.d.ts.map