import type { AuthStrategy, FetchInit, AccessTokenResponse } from './types.js';
import { decodeJWT } from './oauth.js';
/**
 * Configuration for JWT Bearer authentication.
 */
export interface JwtOAuthConfig {
    /** OAuth client ID */
    clientId: string;
    /** Path to JWT certificate file (cert.pem) */
    certPath: string;
    /** Path to JWT private key file (key.pem) */
    keyPath: string;
    /** Optional passphrase for encrypted private key */
    passphrase?: string;
    /** Account Manager hostname */
    accountManagerHost: string;
    /** OAuth scopes to request */
    scopes?: string[];
}
/**
 * OAuth 2.0 JWT Bearer authentication strategy.
 *
 * Implements RFC 7523 (JSON Web Token (JWT) Profile for OAuth 2.0 Client
 * Authentication and Authorization Grants).
 *
 * Key differences from client credentials flow:
 * - Uses public/private key pair instead of client secret
 * - Sends JWT as `client_assertion` in POST body (not Authorization header)
 * - JWT is self-signed and short-lived (60 seconds)
 *
 * @example
 * ```typescript
 * const strategy = new JwtOAuthStrategy({
 *   clientId: 'my-client-id',
 *   certPath: './cert.pem',
 *   keyPath: './key.pem',
 *   accountManagerHost: 'account.demandware.com',
 * });
 *
 * const response = await strategy.fetch('https://api.example.com/data');
 * ```
 */
export declare class JwtOAuthStrategy implements AuthStrategy {
    private readonly config;
    private readonly logger;
    private readonly cacheKey;
    private _hasHadSuccess;
    private readonly privateKey;
    /**
     * Creates a new JwtOAuthStrategy instance.
     *
     * Validates the provided configuration and caches the private key during construction
     * to avoid repeated file I/O during token requests.
     *
     * @param config - JWT OAuth configuration containing clientId, certificate/key file paths, and Account Manager host
     * @throws Error if clientId, certPath, keyPath, or accountManagerHost are missing
     * @throws Error if certificate or key files do not exist, are unreadable, or have invalid PEM format
     * @throws Error if the private key is encrypted but no passphrase is provided, or the passphrase is incorrect
     */
    constructor(config: JwtOAuthConfig);
    /**
     * Validates JWT configuration and checks that certificate/key files exist and are readable.
     */
    private validateConfig;
    /**
     * Performs a fetch request with JWT Bearer authentication.
     * Automatically injects the Authorization header with a fresh access token.
     * Includes 401 retry logic and x-dw-client-id header.
     */
    fetch(url: string, init?: FetchInit): Promise<Response>;
    /**
     * Returns the Authorization header value for legacy clients.
     */
    getAuthorizationHeader(): Promise<string>;
    /**
     * Gets the decoded JWT payload.
     */
    getJWT(): Promise<ReturnType<typeof decodeJWT>>;
    /**
     * Creates a new JwtOAuthStrategy with additional scopes merged in.
     * Used by clients that have specific scope requirements.
     *
     * @param additionalScopes - Scopes to add to this strategy's existing scopes
     * @returns A new JwtOAuthStrategy instance with merged scopes
     */
    withAdditionalScopes(additionalScopes: string[]): JwtOAuthStrategy;
    /**
     * Gets the full token response including expiration and scopes.
     * Useful for commands that need to display or return token metadata.
     */
    getTokenResponse(): Promise<AccessTokenResponse>;
    /**
     * Invalidates the cached access token, forcing re-authentication on next request.
     */
    invalidateToken(): void;
    /**
     * Gets an access token string, using cached token if still valid.
     */
    private getAccessToken;
    /**
     * Requests a new access token from Account Manager using JWT Bearer flow.
     * Returns the full token response and caches it.
     */
    private requestNewToken;
    /**
     * Creates and signs a JWT token for OAuth authentication.
     * Uses RS256 algorithm and Base64URL encoding per RFC 7519.
     */
    private createSignedJwt;
}