import type { Authenticatable, UserProvider } from './contracts.js';
type ModelClass = {
    query(): {
        where(col: string, val: unknown): {
            first(): Promise<Record<string, unknown> | null>;
        };
    };
    find(id: string | number): Promise<Record<string, unknown> | null>;
    update?(id: string | number, data: Record<string, unknown>): Promise<unknown>;
};
export declare class EloquentUserProvider implements UserProvider {
    private readonly model;
    private readonly hashCheck;
    private readonly hashMake?;
    constructor(model: ModelClass, hashCheck: (plain: string, hashed: string) => Promise<boolean>, hashMake?: ((plain: string) => Promise<string>) | undefined);
    retrieveById(id: string): Promise<Authenticatable | null>;
    retrieveByCredentials(credentials: Record<string, unknown>): Promise<Authenticatable | null>;
    validateCredentials(user: Authenticatable, credentials: Record<string, unknown>): Promise<boolean>;
    /**
     * Run a password verify against a throwaway hash and discard the result.
     * Called when no user matched the credentials, so that the "no such account"
     * path costs the same as the "wrong password" path — otherwise an attacker
     * can distinguish registered from unregistered identifiers by timing (the
     * real path pays the deliberately-expensive bcrypt/argon verify; the missing
     * path used to return instantly).
     */
    fakeValidateCredentials(credentials: Record<string, unknown>): Promise<void>;
    /**
     * Resolve a user by id and validate a "remember me" token against the stored
     * one in constant time. Returns null when the user is gone, has no stored
     * token (remember-me was never enabled / was cycled by logout), or the token
     * doesn't match — so a stolen-then-revoked cookie stops working immediately.
     */
    retrieveByToken(userId: string, token: string): Promise<Authenticatable | null>;
    /** Persist a new remember token on the user's row (null clears it). */
    updateRememberToken(userId: string, token: string | null): Promise<void>;
}
export declare function toAuthenticatable(record: Record<string, unknown>): Authenticatable & Record<string, unknown>;
export {};
//# sourceMappingURL=providers.d.ts.map