/**
 * Security handling utilities for OpenAPI to MCP generator
 */
import { OpenAPIV3 } from 'openapi-types';
/**
 * Get environment variable name for a security scheme
 *
 * @param schemeName Security scheme name
 * @param type Type of security credentials
 * @returns Environment variable name
 */
export declare function getEnvVarName(schemeName: string, type: 'API_KEY' | 'BEARER_TOKEN' | 'BASIC_USERNAME' | 'BASIC_PASSWORD' | 'OAUTH_CLIENT_ID' | 'OAUTH_CLIENT_SECRET' | 'OAUTH_TOKEN' | 'OAUTH_SCOPES' | 'OPENID_TOKEN'): string;
/**
 * Generates code for handling API key security
 *
 * @param scheme API key security scheme
 * @returns Generated code
 */
export declare function generateApiKeySecurityCode(scheme: OpenAPIV3.ApiKeySecurityScheme): string;
/**
 * Generates code for handling HTTP security (Bearer/Basic)
 *
 * @returns Generated code
 */
export declare function generateHttpSecurityCode(): string;
/**
 * Options controlling generated security/execution code.
 */
export interface SecurityCodeOptions {
    /** Skip TLS verification for generated requests (issue #46). */
    insecure?: boolean;
    /** Send OAuth2 client credentials in the request body, not Basic header (issue #8). */
    oauthCredsInBody?: boolean;
    /** Inbound header names to forward to the upstream API (issue #55). */
    headerPassthrough?: string[];
    /** Generate and invoke a custom auth hook before built-in auth (issue #9). */
    customAuth?: boolean;
}
/**
 * Generates code for OAuth2 token acquisition.
 *
 * The env-var lookups are computed from the *runtime* `schemeName` argument
 * (not a literal placeholder) so per-scheme credentials resolve correctly
 * (issue #56).
 *
 * @param options Generation options affecting the emitted code
 * @returns Generated code for OAuth2 token acquisition
 */
export declare function generateOAuth2TokenAcquisitionCode(options?: SecurityCodeOptions): string;
/**
 * Returns the top-of-module import statements the generated security/execution
 * code requires, given the active options. These must be emitted at the top of
 * the generated module (ES module imports cannot appear mid-file).
 *
 * @param options Generation options
 * @returns Import statements (possibly empty), newline-terminated
 */
export declare function getSecurityModuleImports(options?: SecurityCodeOptions): string;
/**
 * Declaration for the request-scoped inbound-header store used by header
 * passthrough (issue #55). Exported so the web/streamable-http transports can
 * run each request inside `inboundHeaderStore.run(headers, ...)`, giving
 * concurrency-safe, per-request header forwarding (no shared global state).
 *
 * @param options Generation options
 * @returns Declaration source (empty unless header passthrough is enabled)
 */
export declare function getInboundHeaderStoreDeclaration(options?: SecurityCodeOptions): string;
/**
 * Generates code for executing API tools with security handling
 *
 * @param securitySchemes Security schemes from OpenAPI spec
 * @param options Generation options affecting the emitted code
 * @returns Generated code for the execute API tool function
 */
export declare function generateExecuteApiToolFunction(securitySchemes?: OpenAPIV3.ComponentsObject['securitySchemes'], options?: SecurityCodeOptions): string;
/**
 * Gets security scheme documentation for README
 *
 * @param securitySchemes Security schemes from OpenAPI spec
 * @returns Documentation for security schemes
 */
export declare function getSecuritySchemesDocs(securitySchemes?: OpenAPIV3.ComponentsObject['securitySchemes']): string;