import { type Tree } from '@nx/devkit';
import type { InitGeneratorSchema } from './schema';
export declare function initGenerator(tree: Tree, rawOptions?: InitGeneratorSchema): Promise<void>;
/**
 * The stdio MCP server entry a host agent uses to launch LensMCP.
 *
 * issues/codex-security/61: this was `npx -y lensmcp mcp` — an UNVERSIONED specifier that `-y`
 * installs without a word. The spec is not resolved through the workspace lockfile, so every
 * uncached launch could fetch whatever the registry currently answers with, and package lifecycle
 * and bin code then runs with the coding agent user's privileges. A compromised publisher,
 * namespace or registry is the whole attack, and the entry that invites it is committed to the
 * repository, where nobody re-reads it.
 *
 * Two branches, both of which pin:
 *
 *  - the workspace already has `lensmcp` installed → `npx --no`, which resolves through
 *    `node_modules` and FAILS rather than fetching. The lockfile is then the pin, which is the
 *    strongest available and the common case immediately after this generator runs;
 *  - it does not → an exact `lensmcp@<version>` taken from this plugin's own version. The
 *    `@lensmcp/*` closure is released together with exact internal pins, so the plugin's version is
 *    the CLI's. `--yes` stays on that branch deliberately: an MCP host launches a stdio server with
 *    no TTY, so a suppressed prompt does not become a visible question — it becomes a hang. The
 *    mutable reference was the defect; the pin is what removes it, and the committed specifier is
 *    now something a reviewer can audit.
 */
export declare function mcpServerEntry(workspaceRoot: string, deps?: {
    exists?: (p: string) => boolean;
    version?: string;
}): {
    command: string;
    args: string[];
};
/**
 * This plugin's own version, for the pin above. Walks up from the compiled module rather than
 * hard-coding a depth, because the published package root and the source tree sit at different
 * levels. Returns undefined rather than guessing — an unpinned specifier is better than a wrong one.
 */
export declare function pluginVersion(from?: string): string | undefined;
export default initGenerator;