import * as lark from '@larksuiteoapi/node-sdk';
export type LarkClient = lark.Client;
export interface FeishuClientConfig {
    appId: string;
    appSecret: string;
    domain?: 'feishu' | 'lark';
}
/**
 * Logger that routes ALL lark SDK output to stderr. CRITICAL for the cortex-feishu MCP server:
 * it speaks the MCP JSON-RPC protocol over stdout, but the lark SDK logs via console.log (stdout)
 * by default. Any SDK info/error log emitted during a tool call (e.g. a Feishu API permission
 * error) would otherwise interleave with the protocol stream and corrupt the response. Console.error
 * writes to stderr, which the MCP transport ignores.
 */
export declare const stderrLogger: {
    error: (...m: unknown[]) => void;
    warn: (...m: unknown[]) => void;
    info: (...m: unknown[]) => void;
    debug: (...m: unknown[]) => void;
    trace: (...m: unknown[]) => void;
};
/** Construct a Feishu OpenAPI client (mirrors FeishuAdapter's constructor). */
export declare function createFeishuClient(config: FeishuClientConfig): LarkClient;
/**
 * Wrap a lark client so EVERY leaf API call (e.g. client.docx.v1.document.create)
 * is automatically tagged with a freshly-resolved user_access_token via
 * lark.withUserAccessToken — without editing each of the ~35 tool call sites.
 *
 * A recursive Proxy descends the resource tree (returning child proxies for objects)
 * and, on a method call, resolves the token first then invokes the real method with the
 * token option appended. The token is fetched per call so refreshes are picked up, and a
 * failing provider rejects the call (surfaced by guard()) — it never falls back to bot auth.
 */
export declare function wrapWithUserToken(client: LarkClient, getToken: () => Promise<string>): LarkClient;
/**
 * Build a client from environment variables. Returns null when credentials are
 * absent so the server can register tools that fail with a friendly message
 * rather than crashing at startup.
 *
 * FEISHU_AUTH_MODE selects identity for document operations (binary, no fallback):
 *   - 'bot' (default): app/tenant identity (docs owned by the bot).
 *   - 'user': the operator's Feishu account (docs owned by the user). App credentials are
 *     still required (used to refresh the user token). A missing/expired user token makes
 *     doc tools fail with a re-login hint rather than silently reverting to bot identity.
 */
export declare function buildFeishuClientFromEnv(env?: NodeJS.ProcessEnv): LarkClient | null;