import type { AuthStrategy, AccessTokenResponse, DecodedJWT, FetchInit } from './types.js';
export interface OAuthConfig {
    clientId: string;
    clientSecret: string;
    scopes?: string[];
    accountManagerHost?: string;
}
/**
 * Decodes a JWT token without verification.
 * Exported for use by other auth strategies.
 */
export declare function decodeJWT(jwt: string): DecodedJWT;
/**
 * Generates a cache key for OAuth tokens.
 * Includes auth method to distinguish between client-credentials and JWT tokens.
 *
 * @param clientId - OAuth client ID
 * @param method - Authentication method (client-credentials or jwt)
 * @param accountManagerHost - Account Manager hostname
 * @param scopes - OAuth scopes (optional)
 * @returns Cache key string
 */
export declare function getOAuthCacheKey(clientId: string, method: 'client-credentials' | 'jwt', accountManagerHost: string, scopes?: string[]): string;
/**
 * Gets a cached OAuth token if valid.
 *
 * @param cacheKey - Cache key from getOAuthCacheKey()
 * @param requiredScopes - Scopes that must be present in the cached token
 * @returns Cached token response if valid, undefined otherwise
 */
export declare function getCachedOAuthToken(cacheKey: string, requiredScopes?: string[]): AccessTokenResponse | undefined;
/**
 * Stores an OAuth token in the global cache.
 *
 * @param cacheKey - Cache key from getOAuthCacheKey()
 * @param tokenResponse - Token response to cache
 */
export declare function setCachedOAuthToken(cacheKey: string, tokenResponse: AccessTokenResponse): void;
/**
 * Invalidates a cached OAuth token.
 *
 * @param cacheKey - Cache key from getOAuthCacheKey()
 */
export declare function invalidateCachedOAuthToken(cacheKey: string): void;
/**
 * OAuth 2.0 Client Credentials authentication strategy.
 *
 * Implements the client credentials flow for automated/server-side authentication
 * with no user interaction required. Automatically manages token caching, expiration,
 * and 401 retry logic with single-flight token requests to prevent thundering herd
 * on the token endpoint.
 *
 * @example
 * ```typescript
 * import { OAuthStrategy } from '@salesforce/b2c-tooling-sdk';
 *
 * const auth = new OAuthStrategy({
 *   clientId: 'your-client-id',
 *   clientSecret: 'your-client-secret',
 *   scopes: ['sfcc.products'],
 * });
 *
 * const response = await auth.fetch('https://api.example.com/products');
 * ```
 */
export declare class OAuthStrategy implements AuthStrategy {
    private config;
    private accountManagerHost;
    private _hasHadSuccess;
    private cacheKey;
    /**
     * Creates a new OAuthStrategy instance with the provided OAuth configuration.
     *
     * @param config - OAuth client credentials and optional configuration
     */
    constructor(config: OAuthConfig);
    /**
     * Performs a fetch request with OAuth bearer token authentication.
     *
     * Automatically injects the Authorization header and client ID header with a valid
     * access token. Implements 401 retry logic: if a previously-successful request
     * returns 401, invalidates the cached token and retries once with a fresh token.
     * Does not retry on initial 401 to avoid retrying with bad credentials.
     *
     * @param url - The URL to fetch
     * @param init - Optional fetch init options (headers, body, method, etc.)
     * @returns The fetch response
     */
    fetch(url: string, init?: FetchInit): Promise<Response>;
    getAuthorizationHeader(): Promise<string>;
    /**
     * Gets the decoded JWT payload
     */
    getJWT(): Promise<DecodedJWT>;
    /**
     * Gets the full token response including expiration and scopes.
     * Useful for commands that need to display or return token metadata.
     */
    getTokenResponse(): Promise<AccessTokenResponse>;
    /**
     * Invalidates the cached token, forcing re-authentication on next request
     */
    invalidateToken(): void;
    /**
     * Creates a new OAuthStrategy with additional scopes merged in.
     * Used by clients that have specific scope requirements.
     *
     * @param additionalScopes - Scopes to add to this strategy's existing scopes
     * @returns A new OAuthStrategy instance with merged scopes
     */
    withAdditionalScopes(additionalScopes: string[]): OAuthStrategy;
    /**
     * Gets an access token, using cache if valid
     */
    private getAccessToken;
    /**
     * Returns a fresh token, coalescing concurrent callers onto a single in-flight
     * token request keyed by cacheKey. Prevents stampeding the AM token endpoint
     * when many requests trigger refresh at once.
     */
    private refreshTokenSingleflight;
    /**
     * Performs client credentials grant flow
     */
    private clientCredentialsGrant;
}