/**
 * Discovers the caller's identity type via /whoami/v1 and resolves
 * tenant IDs to their regional API hosts. Caches the mapping.
 */
import type { TokenManager } from "../auth/token-manager.js";
import type { SophosIdType } from "../types/sophos.js";
export interface TenantInfo {
    id: string;
    name: string;
    apiHost: string;
    dataRegion: string;
    dataGeography: string;
}
export interface CallerIdentity {
    id: string;
    idType: SophosIdType;
    apiHosts: {
        global: string;
        dataRegion?: string;
    };
}
export declare class TenantResolver {
    private tokenManager;
    private identity;
    private tenantCache;
    private tenantsLoaded;
    constructor(tokenManager: TokenManager);
    /**
     * Initialise: calls /whoami/v1 and discovers the caller identity.
     */
    init(): Promise<CallerIdentity>;
    getIdentity(): CallerIdentity;
    /**
     * Returns the ID type header name needed for partner/org API calls.
     */
    getIdHeader(): {
        name: string;
        value: string;
    };
    /**
     * Loads all tenants for partner/org callers. Paginates through all pages.
     */
    loadTenants(): Promise<TenantInfo[]>;
    /**
     * Resolves a tenant ID to its API host. Loads tenants if not cached.
     */
    resolveApiHost(tenantId: string): Promise<string>;
    /**
     * Returns the tenant ID to use. For single-tenant callers, returns the
     * identity ID. For partner/org callers, requires an explicit tenant ID.
     */
    resolveTenantId(providedTenantId?: string): string;
    /**
     * Returns all cached tenants.
     */
    getCachedTenants(): TenantInfo[];
}
//# sourceMappingURL=tenant-resolver.d.ts.map