import { User } from "@authhero/adapter-interfaces";
import { Context } from "hono";
import { Bindings, Variables } from "../types";
import { EnrichedClient } from "../helpers/client";
/**
 * TRANSITIONAL helpers for the auth2 → auth0 provider migration.
 *
 * Historically every native database user has been stored with
 * `provider = "auth2"` and `user_id = "auth2|<id>"`. We're moving onto the
 * `"auth0"` provider value, one tenant at a time, by setting
 * `init({ usernamePasswordProvider })` to return `"auth0"` for the
 * migrated tenants.
 *
 * Two surfaces are exposed:
 *
 * - {@link resolveUsernamePasswordProvider} — used at WRITE sites to pick
 *   the value to stamp on a new row. Defaults to `"auth2"`.
 * - {@link isUsernamePasswordProvider} / {@link getUsernamePasswordUser} /
 *   {@link getPrimaryUsernamePasswordUser} — used at READ sites to match
 *   existing rows under EITHER value, so a tenant can have a mix of
 *   `auth2|*` and `auth0|*` rows during/after the cutover.
 *
 * Once every tenant has been backfilled to a single provider value, this
 * module and its callers can be deleted in favour of a plain constant.
 */
declare const LEGACY_PROVIDER = "auth2";
declare const TARGET_PROVIDER = "auth0";
export type UsernamePasswordProviderValue = typeof LEGACY_PROVIDER | typeof TARGET_PROVIDER;
export declare function resolveUsernamePasswordProvider(env: Bindings, tenant_id: string): Promise<UsernamePasswordProviderValue>;
export declare function isUsernamePasswordProvider(provider: string | undefined | null): boolean;
interface DualReadParams {
    env: Bindings;
    tenant_id: string;
    username: string;
}
/**
 * Look up a native database user, accepting either provider value.
 *
 * ALWAYS tries `"auth2"` first, then `"auth0"`, regardless of the tenant's
 * configured write value. The `auth2` row is the one carrying the bcrypt
 * password legacy users have been logging in with — if both rows happen
 * to coexist for the same identifier (partial backfill, Auth0 import,
 * etc.) we want login to keep using the `auth2` row so credentials
 * continue to work. The migration script merges the duplicates.
 */
export declare function getUsernamePasswordUser({ env, tenant_id, username, }: DualReadParams): Promise<User | null>;
/**
 * Same as {@link getUsernamePasswordUser} but resolves to the primary user
 * if a linked secondary is matched. Same `auth2`-first ordering.
 */
export declare function getPrimaryUsernamePasswordUser({ env, tenant_id, username, }: DualReadParams): Promise<User | null>;
/**
 * Find-or-create wrapper that first looks for an existing native database
 * user under EITHER provider value, and only creates a new row (under the
 * configured provider) if none exists. Prevents duplicating an existing
 * `auth2|*` user when the tenant is migrated to `"auth0"`.
 */
export declare function getOrCreateUsernamePasswordUser(ctx: Context<{
    Bindings: Bindings;
    Variables: Variables;
}>, params: {
    client: EnrichedClient;
    username: string;
    connection: string;
    ip?: string;
}): Promise<User>;
export {};
