import { Context } from "hono";
import { Connection, User } from "@authhero/adapter-interfaces";
import { Bindings, Variables } from "../types";
import { EnrichedClient } from "../helpers/client";
interface Auth0SourceCredentials {
    tokenEndpoint: string;
    userinfoEndpoint: string;
    clientId: string;
    clientSecret: string;
    realm?: string;
}
/**
 * Read the upstream migration credentials from a DB connection's
 * `options.configuration` (Auth0-shape: the destination connection holds the
 * upstream creds inline). Returns null if any required field is missing —
 * callers should treat this as "migration is not configured" and fall through
 * to the normal failure path.
 */
export declare function readAuth0SourceCredentials(dbConnection: Connection): Auth0SourceCredentials | null;
interface AttemptUpstreamPasswordParams {
    ctx: Context<{
        Bindings: Bindings;
        Variables: Variables;
    }>;
    client: EnrichedClient;
    username: string;
    password: string;
    /**
     * The local DB connection the login is targeting. Its `name` is sent as
     * `realm` to upstream Auth0 (unless `options.configuration.realm` overrides
     * it), and its `options.configuration` carries the upstream credentials.
     * Must have `options.import_mode: true` to be eligible.
     */
    dbConnection: Connection;
    /**
     * The local user, if one already exists. When null, a new user record is
     * created from the `/userinfo` profile on upstream success.
     */
    existingUser: User | null;
}
/**
 * Attempts to verify the supplied password against the upstream Auth0 tenant
 * via the password-realm grant. On success, creates the local user (if
 * missing), stores the bcrypt hash of the password locally, and returns the
 * user. On any failure, returns null — the caller surfaces the existing
 * INVALID_PASSWORD/USER_NOT_FOUND error so the upstream's existence is not
 * leaked to clients.
 *
 * Subsequent logins are served entirely locally because the password row now
 * exists on our side.
 */
export declare function attemptUpstreamPasswordFallback(params: AttemptUpstreamPasswordParams): Promise<User | null>;
export {};
