/**
 * Universal-git webhook normalizer.
 *
 * Implements the `WebhookNormalizer` interface from `@kici-dev/engine` for any
 * forge that emits GitHub-shaped push / PR payloads. The structure of each
 * forge's payload is declared via JSONPath expressions in the source's
 * `git_config.payloadPaths`, so a single class covers Forgejo, Gitea, Gogs,
 * GitLab repo webhooks, and plain-GitHub repo webhooks.
 *
 * Signatures are verified per source in the upstream generic-webhook
 * verification path (HMAC-SHA256 / plain token / IP allow-list); this
 * normalizer therefore short-circuits `verifySignature` and relies on the
 * caller's pre-verification, same as `GenericWebhookNormalizer`.
 */
import type { WebhookNormalizer, SimulatedEvent } from '@kici-dev/engine';
import { type UniversalGitConfig } from './config.js';
/**
 * Webhook normalizer for universal-git sources.
 *
 * Each instance is bound to one source's expanded config (preset-resolved
 * `payloadPaths` + `eventMapping`). The orchestrator constructs one per
 * registered `generic_webhook_sources` row with a non-null `git_config`.
 */
export declare class UniversalGitWebhookNormalizer implements WebhookNormalizer {
    readonly provider: "generic";
    private readonly routingKey;
    private readonly paths;
    private readonly eventMapping;
    constructor(params: {
        routingKey: string;
        config: UniversalGitConfig;
    });
    /**
     * Routing key is pre-assigned per source. The generic source-id header is
     * still honoured for test compatibility, but the orchestrator pipeline
     * already knows the routing key by the time this is invoked.
     */
    extractRoutingKey(headers: Record<string, string>, _payload: unknown): string | null;
    /**
     * Most universal-git forges send one of the following (in priority order).
     * Returning null lets the pipeline fall back to request-level dedup.
     */
    extractDeliveryId(headers: Record<string, string>): string | null;
    /**
     * Event type header varies per forge. We accept all common spellings;
     * `normalizeEvent` collapses the value back to KiCI's canonical names via
     * the source's `eventMapping`.
     */
    extractEventType(headers: Record<string, string>): string | null;
    /**
     * Signature verification is performed by the generic webhook pipeline
     * upstream; the normalizer only cooperates by returning `true`.
     */
    verifySignature(_body: string, _headers: Record<string, string>, _secret: string): boolean;
    /**
     * Normalize the forge payload into a `SimulatedEvent`. Uses JSONPath
     * extraction for the repo identifier + ref + SHA so the same code works
     * against every supported forge.
     */
    normalizeEvent(eventType: string, action: string | null, payload: unknown): SimulatedEvent | null;
    /**
     * Repo identifier via JSONPath. Returns `null` when the expression
     * yields no match — callers treat this as "no repo context".
     */
    extractRepoIdentifier(payload: unknown): string | null;
    /**
     * Git ref / SHA extraction. For push, we resolve `pushSha`; for PR-shaped
     * events, we fall back to `pull_request.head.sha` (or `object_attributes.last_commit.id`
     * for GitLab). Unknown event types resolve to `HEAD` so the orchestrator
     * can still evaluate triggers against the default branch.
     */
    extractRef(eventType: string, payload: unknown): string;
    /**
     * Universal-git sources carry no provider-native auth in the payload —
     * the orchestrator resolves `credentialRef` out-of-band via the secret
     * store. This method therefore returns an empty record.
     */
    extractCredentials(_payload: unknown): Record<string, unknown>;
    /**
     * Extension hook used by the processor's `isDefaultBranchPush` check so it
     * does not need to hardcode `payload.repository.default_branch`. The
     * engine interface does not yet declare this method; it is consumed via
     * an optional chain (`normalizer.extractDefaultBranch?.(payload)`), so it
     * is safe to ship ahead of the interface change in Phase 3.
     */
    extractDefaultBranch(payload: unknown): string | null;
    /** Classify the raw event header against the source's eventMapping. */
    private classifyEvent;
}
//# sourceMappingURL=normalizer.d.ts.map