import type { AuthStrategy, AccessTokenResponse, DecodedJWT, FetchInit } from './types.js';
export interface OAuthConfig {
    clientId: string;
    clientSecret: string;
    scopes?: string[];
    accountManagerHost?: string;
}
/**
 * Decodes a JWT token without verification.
 * Exported for use by other auth strategies.
 */
export declare function decodeJWT(jwt: string): DecodedJWT;
/**
 * Generates a cache key for OAuth tokens.
 * Includes auth method to distinguish between client-credentials and JWT tokens.
 *
 * @param clientId - OAuth client ID
 * @param method - Authentication method (client-credentials or jwt)
 * @param accountManagerHost - Account Manager hostname
 * @param scopes - OAuth scopes (optional)
 * @returns Cache key string
 */
export declare function getOAuthCacheKey(clientId: string, method: 'client-credentials' | 'jwt', accountManagerHost: string, scopes?: string[]): string;
/**
 * Gets a cached OAuth token if valid.
 *
 * @param cacheKey - Cache key from getOAuthCacheKey()
 * @param requiredScopes - Scopes that must be present in the cached token
 * @returns Cached token response if valid, undefined otherwise
 */
export declare function getCachedOAuthToken(cacheKey: string, requiredScopes?: string[]): AccessTokenResponse | undefined;
/**
 * Stores an OAuth token in the global cache.
 *
 * @param cacheKey - Cache key from getOAuthCacheKey()
 * @param tokenResponse - Token response to cache
 */
export declare function setCachedOAuthToken(cacheKey: string, tokenResponse: AccessTokenResponse): void;
/**
 * Invalidates a cached OAuth token.
 *
 * @param cacheKey - Cache key from getOAuthCacheKey()
 */
export declare function invalidateCachedOAuthToken(cacheKey: string): void;
export declare class OAuthStrategy implements AuthStrategy {
    private config;
    private accountManagerHost;
    private _hasHadSuccess;
    private cacheKey;
    constructor(config: OAuthConfig);
    fetch(url: string, init?: FetchInit): Promise<Response>;
    getAuthorizationHeader(): Promise<string>;
    /**
     * Gets the decoded JWT payload
     */
    getJWT(): Promise<DecodedJWT>;
    /**
     * Gets the full token response including expiration and scopes.
     * Useful for commands that need to display or return token metadata.
     */
    getTokenResponse(): Promise<AccessTokenResponse>;
    /**
     * Invalidates the cached token, forcing re-authentication on next request
     */
    invalidateToken(): void;
    /**
     * Creates a new OAuthStrategy with additional scopes merged in.
     * Used by clients that have specific scope requirements.
     *
     * @param additionalScopes - Scopes to add to this strategy's existing scopes
     * @returns A new OAuthStrategy instance with merged scopes
     */
    withAdditionalScopes(additionalScopes: string[]): OAuthStrategy;
    /**
     * Gets an access token, using cache if valid
     */
    private getAccessToken;
    /**
     * Returns a fresh token, coalescing concurrent callers onto a single in-flight
     * token request keyed by cacheKey. Prevents stampeding the AM token endpoint
     * when many requests trigger refresh at once.
     */
    private refreshTokenSingleflight;
    /**
     * Performs client credentials grant flow
     */
    private clientCredentialsGrant;
}
