/** Subset of the OIDC discovery document that this package consumes. */
export interface OIDCConfiguration {
    /** Issuer identifier. Same value the authorization server will claim in tokens. */
    issuer: string;
    /** Endpoint the browser is redirected to for authorization. */
    authorizationEndpoint: string;
    /** Endpoint for code → token exchange and refresh-token grants. */
    tokenEndpoint: string;
    /** Present on most providers (Keycloak, Auth0); OIDC spec does not require it. */
    revocationEndpoint?: string;
    /** Present on providers that implement RP-initiated logout (OIDC session management). */
    endSessionEndpoint?: string;
}
/** Options for `discoverOIDC`. */
export interface DiscoverOIDCOptions {
    /** Aborts the underlying fetch when fired. */
    signal?: AbortSignal;
    /** Permit non-HTTPS issuer URLs whose host is not a loopback literal. Default `false`. */
    allowInsecureIssuer?: boolean;
}
/**
 * Fetches and parses the OIDC discovery document. Fails fast (no
 * retry) so the caller does not open a browser against an unreachable
 * authorization server. Verifies the server's claimed `issuer` matches
 * the input URL per OIDC Discovery §3 — without this, a hostile
 * discovery response could redirect the authorization and token
 * endpoints to attacker hosts.
 *
 * Uses the OIDC well-known path as a convention; does not perform
 * OIDC-strength identity validation (no id_token / nonce / signature
 * checks). Callers needing identity assurance should layer that on top.
 */
export declare function discoverOIDC(issuerURL: string, options?: DiscoverOIDCOptions): Promise<OIDCConfiguration>;