/**
 * SSO token retrieval for Okta and Azure AD.
 * Uses OAuth2 ROPC (Resource Owner Password Credentials) flow to get access tokens
 * without browser-based login.
 *
 * Note: ROPC is deprecated in OAuth 2.1 but still supported by Okta and Azure AD
 * for service accounts and automated testing scenarios.
 */
export type SsoProvider = 'okta' | 'azure_ad' | 'generic_oidc';
export interface SsoConfig {
    provider: SsoProvider;
    /** Okta domain (e.g. 'mycompany.okta.com') or Azure tenant ID */
    domain: string;
    /** OAuth2 client ID */
    clientId: string;
    /** OAuth2 client secret (for client_credentials or confidential ROPC) */
    clientSecret?: string;
    /** Scopes to request (space-separated). Default: 'openid profile' */
    scope?: string;
}
/**
 * Get an access token using ROPC flow (username + password → token).
 * Returns the access token string.
 */
export declare function getSsoToken(config: SsoConfig, username: string, password: string): Promise<string>;
/**
 * Get a client credentials token (no user — for service accounts).
 */
export declare function getSsoClientCredentialsToken(config: SsoConfig): Promise<string>;