import { type CliConfig } from '../lib/config.js';
export interface AuthProvider {
    issuer: string;
    tokenEndpoint: string;
    deviceEndpoint: string;
    userinfoEndpoint: string;
    revocationEndpoint: string;
    resource: string;
}
/** An issuer (discovered from One, or saved with credentials) is trusted only when its origin is exactly trustedIdentityIssuer(config). */
export declare function validateIdentityIssuer(raw: string, config: Pick<CliConfig, 'oneBaseUrl' | 'identityBaseUrl'>): string;
export declare function identityProvider(config: CliConfig, issuer: string): Promise<AuthProvider>;
/**
 * Older One deployments answer the protected-resource path with a sign-in
 * redirect or an HTML page; those mean "no Identity metadata" (legacy login).
 * JSON that is present but malformed or names another resource still aborts.
 */
export declare function discoverAuthProvider(config: CliConfig): Promise<AuthProvider | undefined>;