import type { RuleMatch } from "../../types";
export interface WorkflowNode {
    id?: string;
    name: string;
    type: string;
    typeVersion?: number;
    position?: [number, number];
    parameters?: Record<string, unknown>;
    credentials?: Record<string, unknown>;
    [key: string]: unknown;
}
export interface WorkflowDocument {
    name?: string;
    nodes?: WorkflowNode[];
    connections?: {
        [nodeName: string]: {
            main?: Array<Array<{
                node: string;
                type: string;
                index: number;
            }>>;
        };
    };
    steps?: Array<Record<string, unknown>>;
    modules?: Array<Record<string, unknown>>;
    [key: string]: unknown;
}
export interface ParsedWorkflow {
    document: WorkflowDocument;
    nodes: WorkflowNode[];
    workflowName: string;
}
/**
 * Attempt to parse JSON content as a workflow document (n8n, Zapier, Make, or generic).
 * Returns null if the content is not valid JSON or does not appear to be a workflow.
 */
export declare function parseWorkflow(content: string): ParsedWorkflow | null;
export declare function isAiNode(node: WorkflowNode): boolean;
export declare function isSecurityNode(node: WorkflowNode): boolean;
export declare function isTriggerNode(node: WorkflowNode): boolean;
export declare function isValidationNode(node: WorkflowNode): boolean;
/**
 * Build a predecessor map from an n8n connections object.
 * Maps target node name -> array of predecessor (source) node names.
 *
 * For sequential workflow formats (Zapier steps, Make modules) where explicit
 * connections are absent, implicit sequential edges are created from the node
 * ordering in the array (node[i] -> node[i+1]).
 */
export declare function buildPredecessorMap(connections: WorkflowDocument["connections"], nodes?: readonly WorkflowNode[]): Map<string, string[]>;
/**
 * Build a successor map from an n8n connections object.
 * Maps source node name -> array of successor (target) node names.
 *
 * Falls back to implicit sequential ordering when explicit connections are absent.
 */
export declare function buildSuccessorMap(connections: WorkflowDocument["connections"], nodes?: readonly WorkflowNode[]): Map<string, string[]>;
/**
 * BFS backward from a node to find all reachable trigger nodes.
 * Returns true if at least one trigger node is reachable.
 */
export declare function isReachableFromTrigger(nodeName: string, nodes: WorkflowNode[], predecessors: Map<string, string[]>): boolean;
/**
 * BFS forward from trigger nodes to see if nodeName is reachable.
 * Returns true if the target node is reachable from at least one trigger.
 */
export declare function isReachableToNode(nodeName: string, nodeNames: string[], triggerNames: string[], successors: Map<string, string[]>): boolean;
/**
 * Check if there is at least one security/validation node on every path
 * from triggers to the target node. This is a simplified check: it BFS backwards
 * from the target and checks if a security node exists on any path.
 */
export declare function hasSecurityOnPathToTarget(targetName: string, nodes: WorkflowNode[], predecessors: Map<string, string[]>): boolean;
/**
 * Find the character offset of a node name assignment in raw JSON content.
 * Looks for: "name": "NodeName" or "name":"NodeName"
 */
export declare function findNodeOffset(content: string, nodeName: string): number;
/**
 * Find the character offset of a string value in raw JSON content.
 */
export declare function findValueOffset(content: string, value: string): number;
export declare function createMatch(content: string, offset: number, evidence: string, confidence: number, message?: string): RuleMatch;
/**
 * Known API key / token patterns commonly hardcoded in workflow node parameters.
 * Ordered by specificity (most specific first).
 */
export declare const API_KEY_PATTERNS: Array<{
    pattern: RegExp;
    label: string;
    confidence: number;
}>;
/**
 * Parameter names that typically contain credential material.
 */
export declare const SENSITIVE_PARAM_NAMES: string[];
/**
 * String values that are clearly credential-like signals in node parameters.
 * These supplement the API_KEY_PATTERNS above by giving moderate confidence
 * for any value assigned to a sensitive parameter name.
 */
export declare function isCredentialLike(value: string): boolean;
/**
 * Collect all node names that are referenced in the connections object
 * as targets (i.e., they have incoming edges).
 */
export declare function getAllReferencedNodeNames(connections: WorkflowDocument["connections"]): Set<string>;