/**
 * Internal webhook normalizer for E2E tests.
 *
 * Implements the WebhookNormalizer interface from @kici-dev/engine for internal
 * webhook sources. Used by the provider-agnostic E2E test suite to trigger the
 * full webhook processing pipeline without GitHub dependencies.
 *
 * Verification is always skipped (internal sources use verification='none').
 * Event type and routing key are extracted from custom headers.
 */
import type { WebhookNormalizer, SimulatedEvent, AccessCacheInvalidation } from '@kici-dev/engine';
/**
 * Internal provider implementation of WebhookNormalizer.
 *
 * Maps internal webhook headers and payloads to KiCI's universal SimulatedEvent format.
 * Designed for E2E tests where payloads use normalized provider-agnostic structures
 * (e.g., {ref: 'refs/heads/master', repository: {full_name: 'test/repo'}}).
 */
export declare class InternalWebhookNormalizer implements WebhookNormalizer {
    readonly provider: "internal";
    /**
     * Extract routing key from internal webhook headers.
     *
     * Checks x-kici-routing-key first (explicit routing), then falls back
     * to x-kici-source-id (generic source ID format).
     */
    extractRoutingKey(headers: Record<string, string>, _payload: unknown): string | null;
    /**
     * Extract delivery ID for deduplication.
     *
     * Checks x-delivery-id first, falls back to x-request-id.
     */
    extractDeliveryId(headers: Record<string, string>): string | null;
    /**
     * Extract event type from x-event-type header.
     */
    extractEventType(headers: Record<string, string>): string | null;
    /**
     * Verify signature -- always returns true.
     *
     * Internal sources use verification='none'. Actual verification is not
     * needed for E2E test infrastructure where both sender and receiver
     * are controlled by the test harness.
     */
    verifySignature(_body: string, _headers: Record<string, string>, _secret: string): boolean;
    /**
     * Extract repository identifier from an internal webhook payload.
     *
     * Internal events mimic GitHub-shaped payloads in E2E tests,
     * so we extract from payload.repository.full_name if present.
     */
    extractRepoIdentifier(payload: unknown): string | null;
    /**
     * Extract ref from an internal webhook payload.
     *
     * Internal events use GitHub-shaped payloads, so extraction logic
     * mirrors GitHub's: push -> payload.after, PR -> payload.pull_request.head.sha.
     */
    extractRef(eventType: string, payload: unknown): string;
    /**
     * Extract credentials -- internal sources carry no provider credentials.
     */
    extractCredentials(_payload: unknown): Record<string, unknown>;
    /**
     * Normalize an internal webhook event into a SimulatedEvent.
     *
     * Extracts branch information from payload.ref (stripping refs/heads/ prefix)
     * and preserves the raw payload for trigger matching. Falls back to '__internal__'
     * when no ref is present.
     */
    normalizeEvent(eventType: string, _action: string | null, payload: unknown): SimulatedEvent | null;
    /**
     * Map membership-related internal webhook events to ContributorCache
     * invalidations.
     *
     * Internal E2E payloads are GitHub-shaped by design, so the mapping
     * mirrors the GitHub normalizer exactly:
     *
     * - `member`: repo-user
     * - `organization`: user-in-org
     * - `membership`: user-in-org
     * - `team` (repo-scoped actions only): repo
     *
     * This lets Bucket C E2E tests exercise the invalidation path through
     * `sendInternalWebhook()` without requiring a real GitHub App.
     */
    getAccessCacheInvalidations(eventType: string, _action: string | null, payload: unknown): AccessCacheInvalidation[];
}
//# sourceMappingURL=normalizer.d.ts.map