/**
 * GitHub webhook normalizer.
 *
 * Implements the WebhookNormalizer interface from @kici-dev/engine for GitHub webhooks.
 * Handles header extraction, HMAC-SHA256 signature verification, and event normalization.
 */
import type { WebhookNormalizer, SimulatedEvent, AccessCacheInvalidation } from '@kici-dev/engine';
/**
 * GitHub-specific implementation of WebhookNormalizer.
 *
 * Maps GitHub webhook headers and payloads to KiCI's universal format.
 * Headers are expected lowercase (Hono normalizes them).
 */
export declare class GitHubWebhookNormalizer implements WebhookNormalizer {
    readonly provider: "github";
    /**
     * Extract routing key from GitHub webhook headers.
     *
     * Uses the X-GitHub-Hook-Installation-Target-ID header which identifies
     * the GitHub App receiving the webhook.
     *
     * @returns "github:{appId}" or null if header is missing
     */
    extractRoutingKey(headers: Record<string, string>, _payload: unknown): string | null;
    /**
     * Extract delivery ID from X-GitHub-Delivery header.
     *
     * GitHub sends a UUID as the delivery identifier for deduplication.
     */
    extractDeliveryId(headers: Record<string, string>): string | null;
    /**
     * Extract event type from X-GitHub-Event header.
     *
     * Returns the raw GitHub event type (e.g., "push", "pull_request").
     */
    extractEventType(headers: Record<string, string>): string | null;
    /**
     * Verify webhook signature using HMAC-SHA256.
     *
     * GitHub signs webhooks with the X-Hub-Signature-256 header using
     * the shared webhook secret configured on the GitHub App.
     */
    verifySignature(body: string, headers: Record<string, string>, secret: string): boolean;
    /**
     * Normalize a GitHub webhook event into a SimulatedEvent.
     *
     * Handles all 15 supported GitHub event types:
     * - pull_request, push, issue_comment, pull_request_review,
     *   pull_request_review_comment, repository_dispatch, release,
     *   create, delete, status, workflow_run, fork, star, watch
     * - push events with refs/tags/ prefix return type: 'tag'
     *
     * Returns null for events not in the supported list.
     */
    normalizeEvent(eventType: string, action: string | null, payload: unknown): SimulatedEvent | null;
    /**
     * Extract repository identifier from a GitHub webhook payload.
     *
     * Prefers repository.full_name, falls back to owner.login/name.
     */
    extractRepoIdentifier(payload: unknown): string | null;
    /**
     * Extract commit SHA or ref from a GitHub webhook payload.
     *
     * Maps each GitHub event type to the appropriate payload field
     * for lock file fetching.
     */
    extractRef(eventType: string, payload: unknown): string;
    /**
     * Extract GitHub-specific credentials from a webhook payload.
     *
     * Extracts installationId from payload.installation.id, needed for
     * generating installation tokens for repo access.
     */
    extractCredentials(payload: unknown): Record<string, unknown>;
    /**
     * Map GitHub membership-related webhook events to ContributorCache
     * invalidations. See WebhookNormalizer.getAccessCacheInvalidations.
     *
     * Covered event types:
     *
     * - `member` (`added` / `removed` / `edited`): a collaborator's repo
     *   permission changed -> `repo-user` invalidation for the exact
     *   `{repo, user}` pair.
     * - `organization` (`member_added` / `member_removed`): a user was added
     *   to or removed from the org. The user's effective permission on every
     *   repo under the org may have shifted -> `user-in-org`.
     * - `membership` (`added` / `removed`, usually team scope): same reasoning
     *   as `organization`. Slightly broader than strictly required, but the
     *   cache refills cheaply and over-invalidation is safe.
     * - `team` (`added_to_repository` / `removed_from_repository`): every
     *   member of the team gained or lost repo access -> `repo`.
     *
     * Any other event type (including other `team` actions like `created` /
     * `deleted` / `edited` which carry no repo context) returns `[]`.
     *
     * Payload fields are probed defensively; a missing field returns `[]`
     * rather than throwing — this is best-effort and we do not want a
     * malformed payload to crash webhook processing.
     */
    getAccessCacheInvalidations(eventType: string, _action: string | null, payload: unknown): AccessCacheInvalidation[];
}
//# sourceMappingURL=normalizer.d.ts.map