import type { CommonOptions } from "../../shared/cli-options.js";
export interface BrandLoginOptions extends CommonOptions {
    environmentName?: string;
    orgId?: string;
    clientId?: string;
    clientSecret?: string;
    authority?: string;
    audience?: string;
    /** Skip the overwrite confirmation when a credential already exists for this org. */
    force?: boolean;
}
/**
 * Provision a Sitecore Brand credential for a Sitecore
 * organization. The flow is:
 *
 *   1. Resolve `orgId` (flag → env profile → error).
 *   2. Detect an existing credential for this org and confirm overwrite.
 *   3. Acquire `clientId` (flag → prompt) and `clientSecret`
 *      (flag → prompt, masked).
 *   4. Mint a test token against `auth.sitecorecloud.io/oauth/token`
 *      with `audience=https://api.sitecorecloud.io`, requesting the
 *      Brand scope set.
 *   5. Refuse to persist the credential if the granted scopes are
 *      missing — operators who paste the Pages/Sites automation
 *      client by mistake get a pointed error explaining the fix
 *      ([[project-scai-ai-skills-credential-model]]).
 *   6. Write `brand[orgId].clientId` to `sitecoreai.cli.json`,
 *      store the secret in the OS keychain, and cache the minted
 *      token (keyed by orgId — multiple env profiles in the same
 *      org share both the credential and the cached token).
 *
 * `--print` is intentionally not supported here — the minted token
 * is short-lived and printing it would tempt operators to script
 * around the keychain. Use the library surface
 * (`acquireBrandToken`) for non-interactive automation.
 */
export declare const runBrandLogin: (options: BrandLoginOptions) => Promise<void>;