/**
 * Helpers that call an upstream Auth0 tenant during lazy migration.
 *
 * Used by:
 * - password.ts: ROPG (password-realm grant) on missed local password lookup,
 *   followed by /userinfo to read the profile.
 * - refresh-token.ts: forward `grant_type=refresh_token` for tokens that don't
 *   match any local row.
 *
 * No M2M token is required: ROPG uses the configured client_id/client_secret,
 * and /userinfo is called with the access_token returned by ROPG.
 */
export type Auth0UpstreamErrorCode = "invalid_grant" | "invalid_request" | "unauthorized_client" | "mfa_required" | "access_denied" | "network_error" | "malformed_response" | string;
export declare class Auth0UpstreamError extends Error {
    readonly status: number;
    readonly code: Auth0UpstreamErrorCode;
    readonly description?: string;
    constructor(status: number, code: Auth0UpstreamErrorCode, description?: string);
}
export interface Auth0TokenResponse {
    access_token: string;
    id_token?: string;
    refresh_token?: string;
    expires_in?: number;
    token_type?: string;
    scope?: string;
}
export interface Auth0UserInfo {
    sub: string;
    email?: string;
    email_verified?: boolean;
    name?: string;
    given_name?: string;
    family_name?: string;
    nickname?: string;
    picture?: string;
    locale?: string;
    [key: string]: unknown;
}
export interface PasswordRealmGrantParams {
    tokenEndpoint: string;
    clientId: string;
    clientSecret: string;
    realm: string;
    username: string;
    password: string;
    audience?: string;
    scope?: string;
}
export declare function passwordRealmGrant(params: PasswordRealmGrantParams): Promise<Auth0TokenResponse>;
export interface UpstreamRefreshTokenGrantParams {
    tokenEndpoint: string;
    clientId: string;
    clientSecret: string;
    refreshToken: string;
    audience?: string;
    scope?: string;
}
export declare function upstreamRefreshTokenGrant(params: UpstreamRefreshTokenGrantParams): Promise<Auth0TokenResponse>;
export declare function fetchUserInfo(userinfoEndpoint: string, accessToken: string): Promise<Auth0UserInfo>;
