import { Client, AuthenticationProvider } from '@microsoft/microsoft-graph-client';
import { Adapter, FilesError } from '../index.js';

interface OneDriveAdapterOptions {
    /**
     * App-only (client credentials) auth. Required for unattended access to
     * SharePoint or OneDrive-for-Business — the app acts on its own behalf.
     * Cannot use `/me/drive`; you must pass `driveId`, `siteId`, or `userId`
     * to target a specific drive.
     */
    clientCredentials?: {
        tenantId: string;
        clientId: string;
        clientSecret: string;
    };
    /**
     * Delegated (3-legged) auth via OAuth refresh token. The adapter mints
     * fresh access tokens against `clientId`/`clientSecret`. `tenantId`
     * defaults to `"common"`. Mutually exclusive with the other auth
     * shapes.
     */
    oauth?: {
        clientId: string;
        clientSecret: string;
        refreshToken: string;
        tenantId?: string;
    };
    /**
     * Static or dynamic access token. Pass a string for a one-shot token, or
     * an async function to mint fresh tokens on demand (e.g. via
     * `@azure/identity`, NextAuth, or your own broker). The adapter does not
     * cache the result — your callable is responsible for caching/refresh.
     */
    accessToken?: string | (() => string | Promise<string>);
    /**
     * Pre-built `@microsoft/microsoft-graph-client` `Client` — escape hatch
     * for callers that already wire auth themselves. `signedUploadUrl()`
     * still works because Graph's upload-session URL is pre-authenticated
     * by Graph itself.
     */
    client?: Client;
    /**
     * Target a specific drive by id (`/drives/{driveId}`). Works with any
     * auth shape; **required** for `clientCredentials` since `/me/drive` is
     * not available without an interactive user. Mutually exclusive with
     * `siteId`/`userId`.
     */
    driveId?: string;
    /**
     * Target the default document library of a SharePoint site
     * (`/sites/{siteId}/drive`). Mutually exclusive with `driveId`/`userId`.
     */
    siteId?: string;
    /**
     * Target a specific user's drive (`/users/{userId}/drive`). Typical with
     * app-only auth. Mutually exclusive with `driveId`/`siteId`.
     */
    userId?: string;
    /**
     * Logical "bucket root" — virtual keys live under this folder path,
     * which must already exist on the drive. Defaults to the drive root.
     */
    rootFolderPath?: string;
    /**
     * When `true`, `upload()` also creates an anonymous-view sharing link
     * and `url()` returns that link's `webUrl`. When `false` (default),
     * `url()` throws — Graph has no signed URL primitive for private items.
     *
     * **Tenant policy note:** anonymous links are blocked on tenants where
     * an admin has disabled them. Upload will surface Graph's `accessDenied`
     * error in that case.
     */
    publicByDefault?: boolean;
    /**
     * Maximum time (ms) to wait for an async copy operation to complete.
     * Graph returns 202 + a monitor URL; the adapter polls until completed
     * or this timeout elapses, at which point the call throws `Provider`.
     * Defaults to 60_000.
     */
    copyTimeoutMs?: number;
}
type OneDriveClient = Client;
type OneDriveAdapter = Adapter<OneDriveClient> & {
    readonly basePath: string;
    readonly rootFolderPath: string;
};
declare const mapGraphError: (err: unknown) => FilesError;
declare const buildAuthProvider: (opts: OneDriveAdapterOptions) => AuthenticationProvider | undefined;
declare const onedrive: (opts?: OneDriveAdapterOptions) => OneDriveAdapter;

export { type OneDriveAdapter, type OneDriveAdapterOptions, type OneDriveClient, buildAuthProvider, mapGraphError, onedrive };