import { type ProviderIdentity } from "./provider.js";
/**
 * Become two real signed-in Auth0 users.
 *
 * Auth0 has no "issue a session for this user" endpoint the way Clerk does, so
 * the route is the ordinary one a user takes, driven from the server: create
 * the user with a password only this run knows, then exchange that password for
 * a token.
 *
 *   1. `POST https://{domain}/oauth/token` with `grant_type=client_credentials`
 *      and `audience=https://{domain}/api/v2/` yields a Management API token.
 *      Skipped when `managementToken` is supplied directly.
 *   2. `POST https://{domain}/api/v2/users` (scope `create:users`) with
 *      `{ connection, email, password, email_verified: true }` creates the
 *      user. The reply's `user_id` is `auth0|…`, and that is the `sub` the
 *      application will see.
 *   3. `POST /oauth/token` with
 *      `grant_type=http://auth0.com/oauth/grant-type/password-realm`, `realm`
 *      set to the connection, `username`, `password`, `client_id`,
 *      `client_secret`, `audience` and `scope=openid profile email` returns
 *      `access_token` and `id_token`. The application must have the Password
 *      grant enabled; a tenant that does not is a refusal, not a fallback.
 *   4. `GET /userinfo` with that access token returns the profile, whose `sub`
 *      is the identity — Auth0's own statement of who the token belongs to.
 *
 * Built from https://auth0.com/docs/api/management/v2/users/post-users,
 * https://auth0.com/docs/get-started/authentication-and-authorization-flow/resource-owner-password-flow/call-your-api-using-resource-owner-password-flow
 * and https://auth0.com/docs/api/authentication/user-profile/get-user-info.
 *
 * ## Why `audience` is required rather than optional
 *
 * Without an `audience`, Auth0 issues an *opaque* access token: `/userinfo`
 * accepts it, and the application cannot validate it at all. Sending one would
 * make every probe come back 401 and turn a run into a wall of refusals that
 * look like the application defending itself. So a missing audience is stated
 * as missing and nothing is checked, which is the honest half of the trade.
 */
export interface Auth0AdminAuth {
    kind: "auth0_admin";
    /** The tenant domain, `your-tenant.eu.auth0.com`, or a full URL. */
    domain: string;
    /** The application whose Password grant is used to obtain the user's token. */
    clientId: string;
    clientSecret: string;
    /** The API identifier the application validates tokens for. */
    audience: string;
    /** The database connection users live in. */
    connection?: string;
    /** A Management API token, when the caller would rather supply one than have it minted. */
    managementToken?: string;
    /** Client credentials for the Management API, when they differ from the application's. */
    managementClientId?: string;
    managementClientSecret?: string;
}
export declare function becomeAuth0Users(auth: Auth0AdminAuth): Promise<ProviderIdentity>;
/** `tenant.eu.auth0.com`, `https://tenant.eu.auth0.com` and a trailing slash all work. */
export declare function originOf(domain: string): string;