import { Command } from '@oclif/core';
import { BaseCommand } from './base-command.js';
import type { AuthMethod } from './config.js';
import type { ResolvedB2CConfig } from '../config/index.js';
import { OAuthStrategy } from '../auth/oauth.js';
import { ImplicitOAuthStrategy } from '../auth/oauth-implicit.js';
/**
 * Base command for operations requiring OAuth authentication.
 * Use this for platform-level operations like ODS, APIs.
 *
 * Environment variables:
 * - SFCC_CLIENT_ID: OAuth client ID
 * - SFCC_CLIENT_SECRET: OAuth client secret
 *
 * For B2C instance specific operations, use InstanceCommand instead.
 */
export declare abstract class OAuthCommand<T extends typeof Command> extends BaseCommand<T> {
    static baseFlags: {
        'client-id': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
        'client-secret': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
        'auth-scope': import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
        'short-code': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
        'tenant-id': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
        'auth-methods': import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
        'user-auth': import("@oclif/core/interfaces").BooleanFlag<boolean>;
        'account-manager-host': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
        'log-level': import("@oclif/core/interfaces").OptionFlag<"trace" | "debug" | "info" | "warn" | "error" | "silent" | undefined, import("@oclif/core/interfaces").CustomOptions>;
        debug: import("@oclif/core/interfaces").BooleanFlag<boolean>;
        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
        jsonl: import("@oclif/core/interfaces").BooleanFlag<boolean>;
        lang: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
        instance: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
        'project-directory': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
        'extra-query': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
        'extra-body': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
        'extra-headers': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
    };
    protected loadConfiguration(): ResolvedB2CConfig;
    /**
     * Gets the configured Account Manager host.
     */
    protected get accountManagerHost(): string;
    /**
     * Gets the default authentication methods in priority order.
     * This method is used by getOAuthStrategy() when no auth methods are specified in config.
     * Subclasses can override this to change the default priority.
     *
     * @returns Array of auth methods in priority order (first is highest priority)
     */
    protected getDefaultAuthMethods(): AuthMethod[];
    /**
     * Returns a default client ID for implicit OAuth flows when no client ID is configured.
     * Returns undefined by default. Subclasses (AmCommand, OdsCommand, etc.) override this
     * to return DEFAULT_PUBLIC_CLIENT_ID for platform-level commands that support public client tokens.
     */
    protected getDefaultClientId(): string | undefined;
    /**
     * Gets an OAuth auth strategy based on allowed auth methods and available credentials.
     *
     * Iterates through allowed methods (in priority order) and returns the first
     * strategy for which the required credentials are available.
     *
     * For the implicit flow, falls back to getDefaultClientId() when no client ID
     * is explicitly configured.
     *
     * @throws Error if no allowed method has the required credentials configured
     */
    protected getOAuthStrategy(): OAuthStrategy | ImplicitOAuthStrategy;
    /**
     * Check if OAuth credentials are available.
     * Returns true if clientId is configured (with or without clientSecret),
     * or if a default client ID is available for implicit flows.
     */
    protected hasOAuthCredentials(): boolean;
    /**
     * Check if full OAuth credentials (client credentials flow) are available.
     * Returns true only if both clientId and clientSecret are configured.
     */
    protected hasFullOAuthCredentials(): boolean;
    /**
     * Validates that OAuth credentials are configured, errors if not.
     * Only clientId is required (implicit flow can be used without clientSecret).
     */
    protected requireOAuthCredentials(): void;
    /**
     * Get the tenant ID from resolved config, throwing if not available.
     * @throws Error if tenant ID is not provided through any source
     */
    protected requireTenantId(): string;
}
