import { Command } from '@oclif/core';
import { BaseCommand } from './base-command.js';
import type { AuthMethod } from './config.js';
import type { ResolvedB2CConfig } from '../config/index.js';
import { OAuthStrategy } from '../auth/oauth.js';
import { ImplicitOAuthStrategy } from '../auth/oauth-implicit.js';
import { StatefulOAuthStrategy } from '../auth/stateful-oauth-strategy.js';
import { JwtOAuthStrategy } from '../auth/oauth-jwt.js';
/**
 * Base command for operations requiring OAuth authentication.
 * Use this for platform-level operations like ODS, APIs.
 *
 * Environment variables:
 * - SFCC_CLIENT_ID: OAuth client ID
 * - SFCC_CLIENT_SECRET: OAuth client secret
 *
 * For B2C instance specific operations, use InstanceCommand instead.
 */
export declare abstract class OAuthCommand<T extends typeof Command> extends BaseCommand<T> {
    private readonly _rawArgv;
    constructor(argv: string[], config: ConstructorParameters<typeof Command>[1]);
    static baseFlags: {
        'client-id': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
        'client-secret': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
        'auth-scope': import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
        'short-code': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
        'tenant-id': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
        'auth-methods': import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
        'user-auth': import("@oclif/core/interfaces").BooleanFlag<boolean>;
        'account-manager-host': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
        'jwt-cert': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
        'jwt-key': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
        'jwt-passphrase': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
        'log-level': import("@oclif/core/interfaces").OptionFlag<"trace" | "debug" | "info" | "warn" | "error" | "silent" | undefined, import("@oclif/core/interfaces").CustomOptions>;
        debug: import("@oclif/core/interfaces").BooleanFlag<boolean>;
        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
        jsonl: import("@oclif/core/interfaces").BooleanFlag<boolean>;
        lang: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
        instance: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
        'project-directory': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
        'extra-query': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
        'extra-body': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
        'extra-headers': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
    };
    protected loadConfiguration(): Promise<ResolvedB2CConfig>;
    /**
     * Gets the configured Account Manager host.
     */
    protected get accountManagerHost(): string;
    /**
     * Gets the default authentication methods in priority order.
     * This method is used by getOAuthStrategy() when no auth methods are specified in config.
     * Subclasses can override this to change the default priority — for example,
     * commands that talk to endpoints requiring a real user identity should
     * return `['implicit']` so that user-auth is preferred when the user has
     * not explicitly chosen an auth method.
     *
     * Explicit user input via `--auth-methods`, `--client-secret`, `--jwt-cert`,
     * etc. always wins over the default; this method only changes what happens
     * when the user has not specified anything.
     *
     * @returns Array of auth methods in priority order (first is highest priority)
     */
    protected getDefaultAuthMethods(): AuthMethod[];
    /**
     * Returns a default client ID for implicit OAuth flows when no client ID is configured.
     * Returns undefined by default. Subclasses (AmCommand, OdsCommand, etc.) override this
     * to return DEFAULT_PUBLIC_CLIENT_ID for platform-level commands that support public client tokens.
     */
    protected getDefaultClientId(): string | undefined;
    /**
     * Gets an OAuth auth strategy based on allowed auth methods and available credentials.
     *
     * Iterates through allowed methods (in priority order) and returns the first
     * strategy for which the required credentials are available.
     *
     * For the implicit flow, falls back to getDefaultClientId() when no client ID
     * is explicitly configured.
     *
     * @returns An OAuth strategy instance ({@link OAuthStrategy}, {@link JwtOAuthStrategy}, {@link ImplicitOAuthStrategy}, or {@link StatefulOAuthStrategy}) based on configured credentials and allowed authentication methods.
     * @throws Error if no allowed method has the required credentials configured
     */
    protected getOAuthStrategy(): OAuthStrategy | JwtOAuthStrategy | ImplicitOAuthStrategy | StatefulOAuthStrategy;
    /**
     * Detects explicit CLI flags that indicate intent to use stateless auth.
     * Only flags that mandate a specific auth flow are considered:
     * - --client-secret: indicates client-credentials flow
     * - --jwt-cert / --jwt-key: indicates JWT Bearer flow
     * - --user-auth: indicates browser-based implicit flow
     * - --auth-methods: explicit auth method selection
     *
     * Contextual flags (--client-id, --auth-scope, --short-code, --tenant-id,
     * --account-manager-host) are NOT included because they are handled by
     * isStatefulTokenValid (clientId/scope matching) or don't affect auth flow.
     */
    private detectExplicitAuthFlags;
    /**
     * Check if OAuth credentials are available.
     * Returns true if clientId is configured (with or without clientSecret),
     * or if a default client ID is available for implicit flows.
     */
    protected hasOAuthCredentials(): boolean;
    /**
     * Check if full OAuth credentials (client credentials flow) are available.
     * Returns true only if both clientId and clientSecret are configured.
     */
    protected hasFullOAuthCredentials(): boolean;
    /**
     * Validates that OAuth credentials are configured, errors if not.
     * Only clientId is required (implicit flow can be used without clientSecret).
     */
    protected requireOAuthCredentials(): void;
    /**
     * Get the tenant ID from resolved config, throwing if not available.
     * @throws Error if tenant ID is not provided through any source
     */
    protected requireTenantId(): string;
    /**
     * Organization ID (`f_ecom_*`) for API path parameters from the resolved tenant.
     */
    protected getOrganizationId(): string;
}