import { ApolloLink } from '@apollo/client';
import type { AuthContextValue } from '../types/auth.types.js';
/**
 * Creates an Apollo Link that prepends a valid Keycloak Bearer token to the
 * `Authorization` header of same-origin GraphQL operations.
 *
 * Integrates with {@link AuthContextValue.getAccessToken} so silent token
 * renewal is triggered transparently when the access token is expired.
 *
 * **Same-origin enforcement:** The token is attached only to operations where
 * the GraphQL endpoint URI has the same origin as `window.location`. Cross-origin
 * requests do not receive an Authorization header (CWE-319 mitigation).
 *
 * **Error handling:**
 * If `getAccessToken` rejects or throws, the error is propagated to the GraphQL
 * operation error handler. If the subscription is cancelled before the token
 * resolves, no error is emitted.
 *
 * **Usage:**
 * ```tsx
 * function ApolloSetup({ children }: { children: React.ReactNode }) {
 *   const { getAccessToken } = useAuth();
 *
 *   const client = useMemo(() => {
 *     const authLink = createAuthApolloLink(getAccessToken);
 *     const httpLink = new HttpLink({ uri: '/graphql' });
 *     return new ApolloClient({ link: authLink.concat(httpLink), cache: new InMemoryCache() });
 *   }, [getAccessToken]);
 *
 *   return <ApolloProvider client={client}>{children}</ApolloProvider>;
 * }
 * ```
 *
 * @param getAccessToken - The `getAccessToken` function from {@link useAuth}.
 * @returns An `ApolloLink` that attaches `Authorization: Bearer <token>` to same-origin operations.
 */
export declare const createAuthApolloLink: (getAccessToken: AuthContextValue["getAccessToken"]) => ApolloLink;
//# sourceMappingURL=apollo-link.d.ts.map