/**
 * Azure DevOps Sync Wrapper
 *
 * Wraps Azure DevOps sync operations with the SyncInterceptor for permission checks
 * and audit logging. This provides a consistent interface for all ADO sync
 * operations while ensuring they go through the permission enforcement layer.
 *
 * Usage:
 * ```typescript
 * const wrapper = new AdoSyncWrapper({
 *   client: new AdoClient(),
 *   interceptor,
 *   logger
 * });
 *
 * // All operations now go through permission enforcement
 * const workItem = await wrapper.createWorkItem(params);
 * ```
 *
 * @module sync/ado-sync-wrapper
 */
import { SyncInterceptor } from '../core/sync/sync-interceptor.js';
import { AdoClient, AdoWorkItem, AdoWorkItemCreate, AdoWorkItemUpdate, AdoWorkItemFilter } from '../integrations/ado/ado-client.js';
import { Logger } from '../utils/logger.js';
/**
 * Wrapper options
 */
export interface AdoSyncWrapperOptions {
    /**
     * Azure DevOps client instance
     */
    client: AdoClient;
    /**
     * Sync interceptor for permission checking
     */
    interceptor: SyncInterceptor;
    /**
     * Logger instance
     */
    logger?: Logger;
}
/**
 * Operation result with additional metadata
 */
export interface WrappedOperationResult<T> {
    /**
     * Whether the operation was allowed and succeeded
     */
    success: boolean;
    /**
     * The result of the operation (null if denied or failed)
     */
    result: T | null;
    /**
     * Reason for denial (if denied)
     */
    denialReason?: string;
    /**
     * Error message (if failed)
     */
    error?: string;
    /**
     * Duration of the operation in milliseconds
     */
    durationMs: number;
}
/**
 * AdoSyncWrapper - Permission-enforced Azure DevOps sync operations
 *
 * All Azure DevOps sync operations pass through the SyncInterceptor which:
 * 1. Checks permissions before execution
 * 2. Logs all attempts (success, denied, error)
 * 3. Provides consistent error handling
 */
export declare class AdoSyncWrapper {
    private readonly client;
    private readonly interceptor;
    private readonly logger;
    constructor(options: AdoSyncWrapperOptions);
    /**
     * Create an Azure DevOps work item
     *
     * @param item - Work item creation parameters
     * @param origin - Item origin (internal or external)
     * @returns Wrapped operation result
     */
    createWorkItem(item: AdoWorkItemCreate, origin?: 'internal' | 'external'): Promise<WrappedOperationResult<AdoWorkItem>>;
    /**
     * Update an Azure DevOps work item
     *
     * @param update - Work item update parameters
     * @param origin - Item origin (internal or external)
     * @returns Wrapped operation result
     */
    updateWorkItem(update: AdoWorkItemUpdate, origin?: 'internal' | 'external'): Promise<WrappedOperationResult<AdoWorkItem>>;
    /**
     * Update work item state (status)
     *
     * @param workItemId - Work item ID
     * @param newState - Target state (e.g., 'Active', 'Resolved', 'Closed')
     * @returns Wrapped operation result
     */
    updateState(workItemId: number, newState: string): Promise<WrappedOperationResult<AdoWorkItem>>;
    /**
     * List work items with filter (read-only, always allowed)
     *
     * @param filter - Work item filter
     * @returns Wrapped operation result
     */
    listWorkItems(filter?: AdoWorkItemFilter): Promise<WrappedOperationResult<AdoWorkItem[]>>;
    /**
     * Add tags to a work item
     *
     * @param workItemId - Work item ID
     * @param tags - Tags to add
     * @param origin - Item origin
     * @returns Wrapped operation result
     */
    addTags(workItemId: number, tags: string[], origin?: 'internal' | 'external'): Promise<WrappedOperationResult<AdoWorkItem>>;
    /**
     * Check if an operation would be allowed (pre-flight check)
     *
     * @param operation - Operation type
     * @param itemId - Item ID
     * @returns true if operation would be allowed
     */
    wouldAllow(operation: 'upsert-internal' | 'upsert-external' | 'update-status' | 'read', itemId: string): boolean;
    /**
     * Get the underlying client for operations that don't need interception
     */
    getClient(): AdoClient;
    /**
     * Convert interceptor result to wrapped result
     */
    private toWrappedResult;
}
//# sourceMappingURL=ado-sync-wrapper.d.ts.map