/**
 * GitHub Webhook ingestor.
 *
 * A concrete webhook ingestor that handles GitHub webhook events with optional
 * HMAC-SHA256 signature verification.
 *
 * Extends the generic `WebhookIngestor` base class, implementing GitHub-specific
 * signature verification (via `X-Hub-Signature-256`), event type extraction
 * (via `X-GitHub-Event` header), and data shaping.
 *
 * @see https://docs.github.com/en/webhooks
 */
import type { WebhookIngestorConfig } from '../types.js';
import { WebhookIngestor } from './base-webhook-ingestor.js';
export declare class GitHubWebhookIngestor extends WebhookIngestor {
    /**
     * Repository filter for multi-instance support.
     * When set, only webhooks from these repositories (owner/repo format) are accepted.
     * Set via `_repoFilter` on the webhook config (injected by IngestorManager).
     */
    private readonly repoFilter;
    /**
     * Organization filter for org-level webhook registration.
     * When set, lifecycle URLs target the org API instead of the repo API.
     * Set via `_orgFilter` on the webhook config (injected by IngestorManager).
     */
    private readonly orgFilter;
    constructor(connectionAlias: string, secrets: Record<string, string>, webhookConfig: WebhookIngestorConfig, bufferSize?: number, instanceId?: string);
    /**
     * Return the model ID for multi-instance webhook lifecycle management.
     * For org-level: the org name. For repo-level: the single repo name.
     */
    protected getModelId(): string | undefined;
    /**
     * Clone webhookConfig with lifecycle URLs rewritten for org-level endpoints.
     * Replaces `repos/${repoFilter}` with `orgs/${orgFilter}` in all lifecycle URLs.
     */
    private static withOrgLifecycle;
    /**
     * Filter webhooks by repository for multi-instance support.
     * When repoFilter is set, only events from those repos are accepted.
     * The repo is found in `body.repository.full_name` of GitHub webhook payloads.
     */
    protected shouldAcceptPayload(body: unknown): boolean;
    /**
     * Verify the GitHub webhook signature (HMAC-SHA256).
     *
     * If both `signatureHeader` and `signatureSecretName` are configured,
     * the signature is verified. If either is absent, verification is skipped.
     */
    protected verifySignature(headers: Record<string, string | string[] | undefined>, rawBody: Buffer): {
        valid: boolean;
        reason?: string;
    };
    /**
     * Extract the event type from the `X-GitHub-Event` header.
     */
    protected extractEventType(headers: Record<string, string | string[] | undefined>, _body: unknown): string;
    /**
     * Extract event data in the GitHub-specific shape:
     * `{ deliveryId, event, payload }`.
     */
    protected extractEventData(headers: Record<string, string | string[] | undefined>, body: unknown): unknown;
    /**
     * Extract the GitHub delivery ID as the idempotency key.
     *
     * Each webhook delivery from GitHub carries a unique `X-GitHub-Delivery`
     * UUID. Using this as the idempotency key prevents duplicate events
     * from webhook retries.
     */
    protected extractIdempotencyKey(headers: Record<string, string | string[] | undefined>, _body: unknown): string | undefined;
}
//# sourceMappingURL=github-webhook-ingestor.d.ts.map