/** The header Atlassian writes the body HMAC to. */
export declare const ATLASSIAN_SIGNATURE_HEADER = "X-Hub-Signature";

/** HMAC-SHA-256 signature scheme over the raw body, `X-Hub-Signature: sha256=<hex>`.
 *  Structurally a `@voltro/plugin-webhooks` `HmacSignatureScheme`. */
export declare interface AtlassianSignatureScheme {
    readonly _tag: 'hmac';
    readonly algorithm: 'hmacSha256';
    readonly header: string;
    readonly includeTimestamp: false;
    readonly encoding: 'hex';
    readonly versionPrefix: 'sha256=';
}

export declare const atlassianSignatureScheme: (header?: string) => AtlassianSignatureScheme;

/** The minimal shape of an Atlassian webhook envelope the plugin surfaces.
 *  Everything beyond `webhookEvent` is kept loose — the app narrows per event
 *  (Atlassian's payloads are large and event-specific). */
export declare interface AtlassianWebhookEnvelope {
    readonly webhookEvent: string;
    readonly timestamp?: number;
    readonly issue?: unknown;
    readonly comment?: unknown;
    readonly page?: unknown;
    readonly user?: unknown;
    /** The full decoded body, for fields not surfaced above. */
    readonly raw: Record<string, unknown>;
}

/** A webhook-provider preset for inbound Jira/Confluence webhooks — a drop-in
 *  `@voltro/plugin-webhooks` `WebhookProviderDescriptor` (matched by shape).
 *
 *   export default defineIncomingWebhook({
 *     id: 'jira-events',
 *     provider: atlassianWebhookProvider(),
 *     payload: Schema.Any,
 *     handler: async (ctx) => {
 *       // signature already verified by the framework; switch on ctx.body.webhookEvent
 *     },
 *   })
 *
 *  The idempotency key defaults to the `X-Atlassian-Webhook-Identifier` header
 *  (present on Cloud) and falls back to a body-derived `<event>:<timestamp>`. */
export declare const atlassianWebhookProvider: (options?: {
    readonly signatureHeader?: string;
}) => {
    _tag: "webhookProvider";
    id: string;
    name: string;
    signature: AtlassianSignatureScheme;
    idempotency: {
        from: (headers: Readonly<Record<string, string>>, rawBody: Uint8Array) => string | undefined;
        ttl: "1d";
    };
    bodyType: "json";
    eventTypeFrom: (body: unknown) => string | undefined;
};

/** Atlassian's event-envelope discriminator lives in the body's
 *  `webhookEvent` field (e.g. `jira:issue_updated`, `comment_created`,
 *  `page_created`). */
export declare const eventTypeFromBody: (body: unknown) => string | undefined;

/**
 * Parse the raw JSON body into a typed envelope. Throws
 * {@link AtlassianWebhookError} (`reason: 'payload'`) on invalid JSON or a
 * missing `webhookEvent` discriminator — the caller maps that to a 400.
 */
export declare const parseWebhookEnvelope: (rawBody: Uint8Array) => AtlassianWebhookEnvelope;

/**
 * Verify an inbound Atlassian webhook's HMAC signature over the raw body.
 * Succeeds (returns `void`) on a valid signature; throws
 * {@link AtlassianWebhookError} (`reason: 'signature'`) on a missing/invalid
 * one — the caller maps that to a 401. Use this only on the raw-`PluginHttpRoute`
 * path; the `*.webhook.tsx` provider path verifies automatically.
 */
export declare const verifyWebhookSignature: (args: {
    readonly rawBody: Uint8Array;
    readonly headers: Readonly<Record<string, string>>;
    readonly secret: string;
    readonly signatureHeader?: string;
}) => void;

export { }