/**
 * Palantir Foundry v2 API client.
 * Handles OAuth2 auth (Authorization Code + Client Credentials), token refresh,
 * pre-flight credential validation, and structured error parsing.
 * @see https://www.palantir.com/docs/foundry/api/v2/general/overview/authentication
 */
import type { OAuth2TokenResponse, PageParams } from "./types.js";
export interface PalantirClientOptions {
    /** Foundry stack URL, e.g. https://foundry.example.com */
    stackUrl: string;
    /** OAuth2 client ID from Developer Console */
    clientId: string;
    /** OAuth2 client secret (for Client Credentials grant) */
    clientSecret?: string;
    /** OAuth2 redirect URL (for Authorization Code grant) */
    redirectUrl?: string;
    /** Pre-obtained bearer token */
    token?: string;
    /** Refresh token for renewal */
    refreshToken?: string;
    /** OAuth2 scopes to request */
    scopes?: string[];
    /** Custom fetch (for testing or non-standard runtimes) */
    fetch?: typeof globalThis.fetch;
    /** Ontology RID (for Ontology-scoped operations) */
    ontologyRid?: string;
}
export declare class PalantirClient {
    #private;
    readonly stackUrl: string;
    readonly clientId: string;
    readonly clientSecret?: string;
    readonly redirectUrl?: string;
    readonly scopes: string[];
    readonly ontologyRid?: string;
    private _tokenState?;
    private _fetch;
    /** Get the current access token (public accessor for namespace classes). */
    getAccessToken(): Promise<string | undefined>;
    /** Underlying fetch implementation (for namespace classes that need raw HTTP). */
    get rawFetch(): typeof globalThis.fetch;
    constructor(options: PalantirClientOptions);
    /** Build the OAuth2 authorization URL for redirect-based login. */
    getAuthorizationUrl(state?: string, codeChallenge?: string): string;
    /** Exchange authorization code for access token (Authorization Code grant). */
    exchangeCode(code: string): Promise<OAuth2TokenResponse>;
    /** Obtain token via Client Credentials grant (service user). */
    authenticateWithClientCredentials(): Promise<OAuth2TokenResponse>;
    /** Refresh the access token using a refresh token. */
    refreshAccessToken(): Promise<OAuth2TokenResponse>;
    /**
     * Validate that credentials are configured and the token is usable.
     * Calls GET /api/v2/admin/users/getCurrent to verify auth.
     * Throws PalantirCredentialError if credentials are missing.
     * Throws PalantirApiError if token is invalid/expired.
     */
    validateCredentials(): Promise<{
        authenticated: true;
        user: unknown;
    }>;
    /** Make a GET request to the Foundry API. */
    get<T = unknown>(path: string, params?: Record<string, unknown>): Promise<T>;
    /** Make a POST request to the Foundry API. */
    post<T = unknown>(path: string, body?: unknown): Promise<T>;
    /** Make a PUT request to the Foundry API. */
    put<T = unknown>(path: string, body?: unknown): Promise<T>;
    /** Make a DELETE request to the Foundry API. */
    delete<T = unknown>(path: string): Promise<T>;
    /** Fetch all pages from a paginated endpoint. Max 100 pages to prevent infinite loops. */
    getAllPages<T = unknown>(path: string, params?: PageParams & Record<string, unknown>): Promise<T[]>;
}
/** Create a client pre-configured for Client Credentials (service user) flow. */
export declare function createServiceClient(stackUrl: string, clientId: string, clientSecret: string, scopes?: string[]): PalantirClient;
/** Create a client pre-configured for Authorization Code (user) flow. */
export declare function createPublicClient(stackUrl: string, clientId: string, redirectUrl: string, scopes?: string[]): PalantirClient;
/** Create a client with a pre-obtained bearer token. */
export declare function createTokenClient(stackUrl: string, token: string, options?: {
    ontologyRid?: string;
}): PalantirClient;
//# sourceMappingURL=client.d.ts.map