/**
 * Maps an authenticated n8n HTTP Request node onto an `HttpAuthDescriptor` — the
 * recipe the native `graph:httpRequest` function uses to inject auth from a
 * Pikku secret at request time.
 *
 * n8n keeps the actual auth material (secret value, and for generic header/query
 * auth the header/param NAME) in its own credential store, which the workflow
 * export never carries. So the export tells us the auth *type* but not always
 * the exact header — hence the `Authorization: Bearer` default + `todo` note for
 * generic header auth. OAuth2 and custom auth have no static recipe and stay a
 * throwing stub in v1 (the map returns `undefined`, same graceful-degradation
 * contract as `mapModel`).
 */
import type { HttpAuthDescriptor, N8nCredentialRef } from './types.js';
/** The node fields an auth recipe reads — satisfied by both N8nNode and ParsedNode. */
export interface AuthNode {
    name: string;
    parameters?: Record<string, unknown>;
    credentials?: Record<string, N8nCredentialRef>;
}
/**
 * When a predefined `nodeCredentialType` isn't in the table below: `'stub'`
 * leaves the node a throwing stub (no auth guess); `'bearer'` emits a
 * best-effort `Authorization: Bearer` + a TODO. Defaults to `'stub'`.
 */
export declare const UNKNOWN_PREDEFINED_FALLBACK: 'stub' | 'bearer';
/**
 * The auth recipe for an authenticated HTTP Request node, or `undefined` when it
 * has no static recipe (OAuth2, custom auth, unknown predefined type) — the
 * caller then leaves the node a throwing integration stub. No-auth nodes are
 * handled separately (they become a plain `graph:httpRequest`).
 */
export declare function httpAuthRecipe(node: AuthNode): HttpAuthDescriptor | undefined;