import { ADAuthError, ADConfig, ADGroup, ADTokens, ADUser, GraphAPIRequest, GraphAPIResponse, TokenRefreshResult } from './types';
/**
 * Common Graph API endpoints.
 */
export declare const GRAPH_ENDPOINTS: {
    readonly ME: "/me";
    readonly ME_PHOTO: "/me/photo/$value";
    readonly ME_MEMBER_OF: "/me/memberOf";
    readonly ME_TRANSITIVE_MEMBER_OF: "/me/transitiveMemberOf";
    readonly USERS: "/users";
    readonly GROUPS: "/groups";
    readonly DIRECTORY_ROLES: "/directoryRoles";
};
/**
 * Active Directory and Graph API client.
 *
 * Provides a unified interface for interacting with various AD providers
 * and the Microsoft Graph API. Handles token management, caching, and
 * automatic retries.
 *
 * @example
 * ```typescript
 * const client = new ADClient(config);
 * await client.initialize(tokens);
 *
 * const user = await client.getCurrentUser();
 * const groups = await client.getUserGroups();
 * ```
 */
export declare class ADClient {
    private readonly config;
    private tokens;
    private tokenRefreshPromise;
    private readonly onTokenRefresh?;
    private readonly onAuthError?;
    private readonly debug;
    /**
     * Create a new AD client instance.
     *
     * @param config - AD configuration
     * @param options - Additional options
     */
    constructor(config: ADConfig, options?: {
        onTokenRefresh?: (tokens: ADTokens) => void;
        onAuthError?: (error: ADAuthError) => void;
    });
    /**
     * Initialize the client with tokens.
     *
     * @param tokens - Initial AD tokens
     */
    initialize(tokens: ADTokens): void;
    /**
     * Update the current tokens.
     *
     * @param tokens - New tokens to use
     */
    setTokens(tokens: ADTokens): void;
    /**
     * Get the current access token.
     *
     * @returns Current access token or null
     */
    getAccessToken(): string | null;
    /**
     * Check if tokens are expired or about to expire.
     *
     * @param bufferMs - Buffer time in milliseconds (default: 5 minutes)
     * @returns Whether tokens need refresh
     */
    isTokenExpired(bufferMs?: number): boolean;
    /**
     * Refresh tokens using the refresh token.
     *
     * This method handles concurrent refresh requests by returning
     * the same promise for overlapping calls.
     *
     * @returns Token refresh result
     */
    refreshTokens(): Promise<TokenRefreshResult>;
    /**
     * Make a request to the Microsoft Graph API.
     *
     * @param request - Graph API request configuration
     * @returns Graph API response
     */
    graphRequest<T = unknown>(request: GraphAPIRequest): Promise<GraphAPIResponse<T>>;
    /**
     * Get the current authenticated user's profile from Graph API.
     *
     * @returns Current user with AD attributes
     */
    getCurrentUser(): Promise<ADUser>;
    /**
     * Get a user by their ID or UPN.
     *
     * @param userId - User ID or UPN
     * @returns User profile
     */
    getUser(userId: string): Promise<ADUser>;
    /**
     * Get the current user's profile photo.
     *
     * @returns Photo as blob URL or null
     */
    getUserPhoto(): Promise<string | null>;
    /**
     * Get the current user's group memberships.
     *
     * @param transitive - Include transitive (nested) memberships
     * @returns Array of AD groups
     */
    getUserGroups(transitive?: boolean): Promise<ADGroup[]>;
    /**
     * Check if user is a member of a specific group.
     *
     * @param groupId - Group ID to check
     * @param transitive - Check transitive membership
     * @returns Whether user is a member
     */
    checkGroupMembership(groupId: string, transitive?: boolean): Promise<boolean>;
    /**
     * Perform the actual token refresh operation.
     *
     * Note: This method intentionally uses raw fetch() rather than apiClient because:
     * 1. OAuth token endpoints require specific Content-Type (x-www-form-urlencoded)
     * 2. Token refresh is a foundational auth operation that apiClient depends on
     * 3. Auth endpoints are identity providers (Azure AD, etc.), not the main API
     *
     * @see {@link @/lib/api/api-client} for authenticated application API calls
     */
    private performTokenRefresh;
    /**
     * Get the client ID from configuration.
     */
    private getClientId;
    /**
     * Build the full Graph API URL.
     */
    private buildGraphUrl;
    /**
     * Execute a request with automatic retries.
     */
    private executeWithRetry;
    /**
     * Extract pagination information from Graph API response.
     */
    private extractPagination;
    /**
     * Extract skip token from next link URL.
     */
    private extractSkipToken;
    /**
     * Internal method to get user groups.
     */
    private getUserGroupsInternal;
    /**
     * Map Graph API user profile to ADUser.
     */
    private mapGraphUserToADUser;
    /**
     * Map Graph API groups to ADGroup array.
     */
    private mapGraphGroups;
    /**
     * Determine the group type from Graph API response.
     */
    private determineGroupType;
    /**
     * Get tenant ID from configuration.
     */
    private getTenantId;
    /**
     * Create an AD auth error object.
     */
    private createError;
    /**
     * Delay helper for retries.
     */
    private delay;
    /**
     * Log debug messages.
     */
    private log;
}
/**
 * Custom error class for Graph API client errors.
 */
export declare class GraphAPIClientError extends Error {
    readonly code: string;
    readonly details?: unknown | undefined;
    constructor(code: string, message: string, details?: unknown | undefined);
}
/**
 * Create a new AD client instance.
 *
 * @param config - AD configuration
 * @param options - Additional options
 * @returns Configured AD client
 */
export declare function createADClient(config: ADConfig, options?: {
    onTokenRefresh?: (tokens: ADTokens) => void;
    onAuthError?: (error: ADAuthError) => void;
}): ADClient;