/**
 * Portable workflow bundle (spec D23) — THE single serialization format shared by
 * export / import / save-as(duplicate) / Hub publish / Hub apply. Two invariants:
 *
 * 1. SANITIZED: credentials never leave the machine inside a bundle. Any params key that
 *    looks credential-shaped has its VALUE stripped and is recorded as a CredentialRequirement
 *    the importer must re-bind. Unknown-but-suspicious shapes fail toward stripping (§1.5:
 *    never silently carry a secret out).
 * 2. SELF-DESCRIBING: `requires` lists the capabilities (tool/agent/mcp/channel/skill) the
 *    graph references, so an importer (or the Hub apply checklist) can verify bindings
 *    BEFORE activating instead of failing mid-run.
 */
import type { WorkflowDef } from "./node-schema.js";
import type { TriggerDef } from "./workflow-trigger.js";
import type { ConcurrencyPolicy, WorkflowRecord } from "./workflow-store.js";
export declare const WORKFLOW_BUNDLE_SCHEMA_VERSION = 2;
export interface CapabilityRequirement {
    category: "agent" | "tool" | "skill" | "mcp" | "memory" | "channel";
    kind: string;
    /** Concrete capability reference (tool name / agent id / "server.tool" / channel name). */
    ref: string;
    /** Human-readable label shown in the apply/bind checklist. */
    label: string;
    nodeIds: string[];
}
export interface CredentialRequirement {
    /** Best-effort type hint; v1 marks all stripped values "custom" (vault types land in IT-7). */
    type: "apiKey" | "bearer" | "basic" | "oauth2" | "custom";
    /** Where the value was stripped from, e.g. `节点「发飞书」 params.headers.Authorization`. */
    label: string;
    nodeIds: string[];
}
export interface WorkflowBundle {
    schemaVersion: typeof WORKFLOW_BUNDLE_SCHEMA_VERSION;
    name: string;
    description?: string;
    def: WorkflowDef;
    trigger?: TriggerDef;
    concurrency?: ConcurrencyPolicy;
    requires: CapabilityRequirement[];
    credentialsRequired: CredentialRequirement[];
    meta?: {
        author?: string;
        tags?: string[];
        category?: string;
        version?: string;
        source?: "native" | "n8n";
    };
}
/** Placeholder left where a credential value was stripped (visibly broken > silently leaked). */
export declare const STRIPPED_CREDENTIAL_PLACEHOLDER = "__CREDENTIAL_REQUIRED__";
/** Derive the capability requirements a graph references (host-backed kinds only). */
export declare function deriveRequirements(def: WorkflowDef): CapabilityRequirement[];
/** Serialize a stored record into a sanitized, self-describing portable bundle. */
export declare function toWorkflowBundle(record: WorkflowRecord): WorkflowBundle;
export interface ParsedBundle {
    name: string;
    def: WorkflowDef;
    trigger?: TriggerDef;
    concurrency?: ConcurrencyPolicy;
    requires: CapabilityRequirement[];
    credentialsRequired: CredentialRequirement[];
}
/** Parse + validate an incoming bundle payload. fail-loud on malformed shapes (§1.5). */
export declare function fromWorkflowBundle(payload: unknown): ParsedBundle;
