/**
 * Microsoft Graph client wrapper.
 *
 * Builds a `Client` from `@microsoft/microsoft-graph-client` whose auth provider
 * pulls from the per-account TokenStore, with auto-refresh when the access
 * token is within the refresh threshold of expiry.
 *
 * Centralises error classification — every Graph error decision keys off the
 * status code and the structured `error.code` field, never the prose body.
 * Aligns with `feedback_no_stdout_parsing_for_control_flow.md`.
 */
import { Client } from "@microsoft/microsoft-graph-client";
import type { TokenStore } from "../auth/token-store.js";
export interface GraphClientConfig {
    clientId: string;
    tenantId: string;
    accountId: string;
    tokenStore: TokenStore;
}
export type GraphErrorClass = {
    kind: "auth";
    statusCode: number;
    code: string;
} | {
    kind: "rate-limit-recoverable";
    statusCode: number;
    retryAfterMs: number;
} | {
    kind: "rate-limit-terminal";
    statusCode: number;
} | {
    kind: "on-prem";
    statusCode: number;
    mailServer?: string;
} | {
    kind: "5xx";
    statusCode: number;
    code: string;
} | {
    kind: "other";
    statusCode: number;
    code: string;
};
export declare function classifyGraphError(err: unknown): GraphErrorClass;
/**
 * Factory wrapping `Client.init`. Exported as a named function so tests can
 * `vi.spyOn(graphClient, "createGraphClient")` reliably (avoids the
 * destructured-ESM mock no-op pitfall).
 */
export declare function createGraphClient(config: GraphClientConfig): Client;
export declare function getOrRefreshAccessToken(config: GraphClientConfig): Promise<string>;
/**
 * Run a Graph call with classification, single retry on `auth` (refresh +
 * retry once), and respect for 429 Retry-After. All terminal classes throw
 * with operator-readable messages.
 */
export declare function callGraph<T>(config: GraphClientConfig, invoke: (client: Client) => Promise<T>, opts?: {
    tool: string;
}): Promise<T>;
//# sourceMappingURL=graph-client.d.ts.map