import type { DelegationView } from '../types.js';
import type { V2Delegation } from '../../types.js';
import type { SpendingControls } from './types.js';
export declare const DEFAULT_API_BASE = "https://api.stripe.com";
export declare const DEFAULT_REQUIRED_SCOPE = "commerce.purchase";
export declare const DEFAULT_TOLERANCE_SEC = 300;
export declare const RAIL_NAME = "stripe-issuing";
/**
 * Reads:
 *   - spend cap via resolveSpendLimitCents() — walks
 *     resource_limits.spend_limit_cents → resource_limits['commerce.spend_limit']
 *     AP2 alias → constraints.spend_limit_cents string fallback
 *   - constraints.allowed_merchant_categories (CSV) → allowed_categories
 *   - constraints.allowed_merchant_countries (CSV)  → allowed_merchant_countries
 *
 * Throws if no positive spend limit can be derived. APS scope categories
 * (e.g. 'commerce.purchase') are intentionally NOT mapped to MCCs;
 * MCC mapping is a domain decision the gateway owns.
 */
export declare function defaultMapDelegationToSpendingControls(delegation: V2Delegation): SpendingControls;
/**
 * Project a V2Delegation into the slim DelegationView shape that
 * `preAuthorize` consumes. Pure function; throws on missing or
 * non-positive spend cap. Exported as a primitive so the gateway-side
 * orchestration class can consume it via `agent-passport-system`.
 */
export declare function delegationToView(delegation: V2Delegation, apsCurrency: string, walletId: string): DelegationView;
/** Stripe's API accepts deeply nested params via PHP-style bracket
 *  notation. We support: scalars, arrays of scalars, and one level of
 *  nesting (object → key[subkey]=value). Exported as a primitive so
 *  the gateway-side orchestration class can pin its on-the-wire body
 *  shape against the same encoder the SDK ships. */
export declare function encodeForm(obj: Record<string, unknown>): string;
/**
 * Verify a Stripe webhook signature. Header format:
 *   t=<unix_ts>,v1=<hex_hmac_sha256>[,v0=...]
 * Signed payload: `${t}.${rawBody}`
 * Algorithm: HMAC-SHA256 with the webhook signing secret.
 *
 * Returns false on missing parts, malformed header, expired timestamp,
 * or signature mismatch. Constant-time comparison via timingSafeEqual.
 *
 * Bytewise output of this function is part of the protocol contract.
 * Conformance tests pin it; do not alter without an RFC + spec bump.
 */
export declare function verifyStripeSignature(rawBody: string, signatureHeader: string, webhookSecret: string, toleranceSec?: number, nowSec?: number): boolean;
export type { Authorization, AuthorizationDecision, AuthorizationEvent, CardholderRef, DelegationLookup, FetchLike, MerchantData, SpendingControls, SpendingControlsMapper, SpendingLimit, SpendingLimitInterval, StripeIssuingConfig, VirtualCard, } from './types.js';
//# sourceMappingURL=primitives.d.ts.map