/** Subset of `/api/sso-config` this package consumes. */
export interface SSOConfig {
    /** Keycloak base URL, e.g. `https://auth.example.com`. */
    url: string;
    /** Keycloak realm name. */
    realm: string;
    /** OAuth client ID for the axe-auth CLI. */
    mcpClientId: string;
}
/** Options for `discoverSSOConfig`. */
export interface DiscoverSSOConfigOptions {
    /** Aborts the underlying fetch when fired. */
    signal?: AbortSignal;
    /** Permit non-HTTPS axe server URLs whose host is not a loopback literal. Default `false`. */
    allowInsecure?: boolean;
}
/**
 * Fetches and parses the axe server's `/api/sso-config` discovery
 * endpoint. Used by `axe-auth login` to derive the OAuth issuer URL,
 * realm, and CLI-specific client ID from the axe server URL the user
 * supplied (or the SaaS prod default), so users no longer have to know
 * the underlying Keycloak coordinates.
 *
 * Distinguishes three failure shapes for the operator-relevant cases:
 *
 * - `mcpClientId` field absent: the axe server deployment predates the
 *   field entirely. Surfaces as "needs upgrading".
 * - `mcpClientId` is `null`: the axe server version supports the field
 *   but the operator has not configured `KEYCLOAK_MCP_PUBLIC_CLIENT_ID`.
 *   Surfaces as "ask the operator to configure".
 * - any non-empty string: returned as-is.
 *
 * Other failure modes (unreachable, non-2xx, malformed JSON, missing
 * `url` / `realm`) all map to `DISCOVERY_FAILED` with a descriptive
 * message. The caller is expected to surface these errors verbatim.
 */
export declare function discoverSSOConfig(serverURL: string, options?: DiscoverSSOConfigOptions): Promise<SSOConfig>;