@techelusive/nest-auth 0.0.0-stage → 0.2.1

package/dist/constants.d.ts

@@ -0,0 +1,1326 @@
+import type { AuthSettings } from './features/settings/settings.types';
+/**
+ * Every fixed number, name and limit used by the library lives in this file.
+ *
+ * Values that an app may want to change at runtime (password length, token lifetimes, which
+ * sign-in methods are on) are NOT here: they are settings, see `features/settings/settings.defaults.ts`.
+ * What stays here are security limits that should only change with a code review.
+ */
+export declare const SECOND_IN_MILLISECONDS = 1000;
+export declare const MINUTE_IN_SECONDS = 60;
+export declare const HOUR_IN_SECONDS: number;
+export declare const DAY_IN_SECONDS: number;
+/** Postgres error code for "a unique index would be broken", e.g. an email that is already used. */
+export declare const POSTGRES_UNIQUE_VIOLATION_CODE = "23505";
+/** Size of the development-only local encryption key (AES-256). */
+export declare const LOCAL_ENCRYPTION_KEY_BYTES = 32;
+/** AES-GCM: 12-byte random IV per value, 16-byte authentication tag. */
+export declare const AES_GCM_INITIALIZATION_VECTOR_BYTES = 12;
+export declare const AES_GCM_AUTH_TAG_BYTES = 16;
+export declare const AUTH_OPTIONS_TOKEN = "TECHELUSIVE_AUTH_OPTIONS";
+export declare const TOKEN_PREFIX: {
+    readonly refreshToken: "rt";
+    readonly emailVerificationLink: "ev";
+    readonly passwordResetLink: "pr";
+    readonly magicSignInLink: "ml";
+    readonly emailChangeLink: "ec";
+    readonly organizationInvitation: "oi";
+    readonly signInChallenge: "ch";
+    readonly apiKey: "ak";
+};
+export type TokenPrefix = (typeof TOKEN_PREFIX)[keyof typeof TOKEN_PREFIX];
+/** Random bytes in every token above: 32 bytes = 256 bits, impossible to guess. */
+export declare const RANDOM_TOKEN_BYTES = 32;
+/** Access tokens use the JWT "typ" from RFC 9068, so an access token can't be confused with other JWTs. */
+export declare const ACCESS_TOKEN_JWT_TYPE = "at+jwt";
+/** The only algorithm we sign with: ECDSA P-256 + SHA-256. */
+/** JWT signature algorithms: ES256 for our own tokens, RS256 for Google and Apple ID tokens. */
+export declare const JWT_ALGORITHM: {
+    readonly es256: "ES256";
+    readonly rs256: "RS256";
+};
+export type JwtAlgorithm = (typeof JWT_ALGORITHM)[keyof typeof JWT_ALGORITHM];
+export declare const SIGNING_ALGORITHM: "ES256";
+/** Algorithm Google and Apple sign their ID tokens with. */
+export declare const PROVIDER_ID_TOKEN_ALGORITHM: "RS256";
+/** Allowed difference between our clock and the token's timestamps. */
+export declare const CLOCK_SKEW_TOLERANCE_SECONDS = 30;
+/** For each kind of emailed link: the prefix of its token. */
+export declare const LINK_TOKEN_KINDS: {
+    readonly verify_email: {
+        readonly prefix: "ev";
+    };
+    readonly reset_password: {
+        readonly prefix: "pr";
+    };
+    readonly magic_sign_in: {
+        readonly prefix: "ml";
+    };
+    readonly change_email: {
+        readonly prefix: "ec";
+    };
+};
+/**
+ * An account whose email is still unverified after this long is treated as possibly created by
+ * someone else; if the real owner then proves the email by code, link or Google, any password set
+ * on it is removed (see UsersService.removeUnprovenPassword).
+ */
+export declare const UNVERIFIED_ACCOUNT_GRACE_SECONDS: number;
+/**
+ * Users without a password must have signed in this recently to change their email (proof that
+ * the person holding the session is the owner, not someone who found an unlocked device).
+ */
+export declare const RECENT_SIGN_IN_SECONDS: number;
+/** A passkey ceremony (browser prompt) must finish within this time. */
+export declare const PASSKEY_CHALLENGE_LIFETIME_SECONDS: number;
+/** How long a deactivated user has, after proving who they are, to confirm reactivation. */
+export declare const REACTIVATION_CHALLENGE_LIFETIME_SECONDS: number;
+/** Wrong guesses allowed per code before it stops working. 5 guesses of a 6-digit code = 1 in 200,000 chance. */
+export declare const ONE_TIME_CODE_MAX_ATTEMPTS = 5;
+/** Wrong 2FA codes allowed per sign-in attempt before the user must start again. */
+export declare const TWO_FACTOR_MAX_ATTEMPTS = 5;
+/** Longer passwords are refused so nobody can make the server hash megabytes of text. */
+export declare const PASSWORD_MAX_LENGTH = 128;
+/** The lowest minimum length an app may configure (NIST SP 800-63B). */
+export declare const PASSWORD_MIN_LENGTH_FLOOR = 8;
+/** Argon2id settings recommended by OWASP: 64 MB of memory, 3 passes, 1 thread. */
+export declare const ARGON2_HASHING_OPTIONS: {
+    readonly memoryCost: number;
+    readonly timeCost: 3;
+    readonly parallelism: 1;
+};
+/** Have I Been Pwned range API. Only the first 5 characters of the password's SHA-1 are sent. */
+export declare const BREACHED_PASSWORD_API_URL = "https://api.pwnedpasswords.com/range/";
+/** If the breach check is slower than this, skip it rather than block the user. */
+export declare const BREACHED_PASSWORD_CHECK_TIMEOUT_MS = 2000;
+/** Characters of the password's SHA-1 hash sent to the breach service (its "k-anonymity" range). */
+export declare const BREACHED_PASSWORD_HASH_PREFIX_LENGTH = 5;
+/** What counts as a "symbol" when settings.password.requireSymbol is on: anything not a letter, digit or space. */
+export declare const PASSWORD_SYMBOL_PATTERN: RegExp;
+/** RFC 4648 base32 alphabet, used for authenticator-app secrets. */
+export declare const BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+export declare const TOTP_DIGITS = 6;
+export declare const TOTP_PERIOD_SECONDS = 30;
+/** Accept codes from one 30-second step before or after now, for phones with slightly wrong clocks. */
+export declare const TOTP_ALLOWED_DRIFT_STEPS = 1;
+/** 20 random bytes = 160 bits, the size RFC 4226 recommends. */
+export declare const TOTP_SECRET_BYTES = 20;
+/** Name shown in the user's authenticator app next to the code. Apps can override it. */
+export declare const TOTP_DEFAULT_ISSUER_NAME = "Techelusive";
+export declare const BACKUP_CODE_COUNT = 10;
+/** Backup codes look like "k7m2-x9p4": 8 characters from an alphabet without look-alikes (no 0/o, 1/l/i). */
+export declare const BACKUP_CODE_LENGTH = 8;
+/** Backup codes are shown split in two for readability: "k7m2-x9p4". */
+export declare const BACKUP_CODE_DISPLAY_GROUP_LENGTH: number;
+export declare const BACKUP_CODE_ALPHABET = "abcdefghjkmnpqrstuvwxyz23456789";
+export interface RateLimitRule {
+    maximumAttempts: number;
+    windowSeconds: number;
+}
+export declare const RATE_LIMITS: {
+    readonly signUpPerIp: {
+        readonly maximumAttempts: 10;
+        readonly windowSeconds: number;
+    };
+    readonly signInPerIp: {
+        readonly maximumAttempts: 30;
+        readonly windowSeconds: number;
+    };
+    readonly signInPerAccount: {
+        readonly maximumAttempts: 10;
+        readonly windowSeconds: number;
+    };
+    readonly sendCodePerIp: {
+        readonly maximumAttempts: 10;
+        readonly windowSeconds: number;
+    };
+    readonly sendCodePerDestination: {
+        readonly maximumAttempts: 5;
+        readonly windowSeconds: number;
+    };
+    readonly sendEmailLinkPerIp: {
+        readonly maximumAttempts: 10;
+        readonly windowSeconds: number;
+    };
+    readonly sendEmailLinkPerEmail: {
+        readonly maximumAttempts: 3;
+        readonly windowSeconds: number;
+    };
+    readonly refreshPerIp: {
+        readonly maximumAttempts: 120;
+        readonly windowSeconds: 60;
+    };
+    readonly twoFactorPerUser: {
+        readonly maximumAttempts: 10;
+        readonly windowSeconds: number;
+    };
+    readonly changePasswordPerUser: {
+        readonly maximumAttempts: 5;
+        readonly windowSeconds: number;
+    };
+    readonly changeEmailPerUser: {
+        readonly maximumAttempts: 5;
+        readonly windowSeconds: number;
+    };
+    readonly exportDataPerUser: {
+        readonly maximumAttempts: 5;
+        readonly windowSeconds: number;
+    };
+};
+/** Passkeys: no attestation (privacy), discoverable credentials, and fingerprint/face/PIN always required. */
+export declare const PASSKEY_ATTESTATION_TYPE = "none";
+export declare const PASSKEY_RESIDENT_KEY = "required";
+export declare const PASSKEY_USER_VERIFICATION = "required";
+/** Name given to a passkey when the user doesn't type one. */
+export declare const DEFAULT_PASSKEY_NAME = "Passkey";
+/** Most passkeys one user may register. */
+export declare const MAXIMUM_PASSKEYS_PER_USER = 20;
+/** Longest passkey name. */
+export declare const PASSKEY_NAME_MAX_LENGTH = 60;
+/** Prefix for rate-limit counters in Redis, so they never clash with the app's own keys. */
+export declare const RATE_LIMIT_REDIS_KEY_PREFIX = "auth:rate-limit:";
+/** The settings table holds exactly one row, with this id. */
+export declare const SETTINGS_ROW_ID = 1;
+/** Signing keys are re-read this often, so a key rotation reaches every server quickly. */
+export declare const SIGNING_KEYS_CACHE_SECONDS = 60;
+/** Settings are re-read this often, so an admin's change reaches every server quickly. */
+export declare const SETTINGS_CACHE_SECONDS = 10;
+/**
+ * How long the guard trusts its last "session still active and user still ACTIVE" check.
+ * Signing out a device or suspending a user takes effect within this time.
+ */
+export declare const SESSION_CHECK_CACHE_SECONDS = 5;
+/** Retired signing keys stay published this long, so tokens they signed keep verifying until they expire. */
+export declare const RETIRED_SIGNING_KEY_PUBLISH_SECONDS: number;
+/** Social providers this library supports (Instagram has no consumer sign-in API since Dec 2024). */
+export declare const SOCIAL_PROVIDER: {
+    readonly google: "google";
+    readonly apple: "apple";
+    readonly facebook: "facebook";
+};
+export type SocialProvider = (typeof SOCIAL_PROVIDER)[keyof typeof SOCIAL_PROVIDER];
+export declare const SOCIAL_PROVIDERS: SocialProvider[];
+export declare const GOOGLE_PUBLIC_KEYS_URL = "https://www.googleapis.com/oauth2/v3/certs";
+export declare const GOOGLE_TOKEN_ISSUERS: string[];
+export declare const APPLE_PUBLIC_KEYS_URL = "https://appleid.apple.com/auth/keys";
+export declare const APPLE_TOKEN_ISSUER = "https://appleid.apple.com";
+/** Graph API version 26 (July 2026). Meta retires versions about two years after release; bump when needed. */
+export declare const FACEBOOK_GRAPH_API_URL = "https://graph.facebook.com/v26.0";
+/** Provider public keys are cached this long (providers rotate them rarely and announce them early). */
+export declare const SOCIAL_PUBLIC_KEYS_CACHE_SECONDS: number;
+/** Give up on a provider API call after this long. */
+export declare const SOCIAL_PROVIDER_TIMEOUT_MS = 5000;
+/** A token signed by a key we don't know triggers a fresh key download at most this often. */
+export declare const UNKNOWN_KEY_REFETCH_WAIT_SECONDS = 60;
+/** Longest ID / access token accepted from a social provider. */
+export declare const SOCIAL_TOKEN_INPUT_MAX_LENGTH = 8192;
+/** Longest nonce accepted with an Apple / Google ID token. */
+export declare const NONCE_INPUT_MAX_LENGTH = 256;
+/** Facebook profile fields requested after sign-in. */
+export declare const FACEBOOK_PROFILE_FIELDS = "id,email,first_name,last_name";
+/** MSG91 v5 Flow API: sends an SMS from a DLT-approved template. */
+export declare const MSG91_FLOW_API_URL = "https://control.msg91.com/api/v5/flow";
+export declare const MSG91_REQUEST_TIMEOUT_MS = 10000;
+/** Header carrying the signature: "t=<unix time>,v1=<hex HMAC-SHA256 of '<t>.<body>'>". */
+export declare const WEBHOOK_SIGNATURE_HEADER = "X-Techelusive-Signature";
+export declare const WEBHOOK_EVENT_HEADER = "X-Techelusive-Event";
+export declare const WEBHOOK_DELIVERY_ID_HEADER = "X-Techelusive-Delivery";
+/** Receivers should reject signatures older than this (stops replays). */
+export declare const WEBHOOK_SIGNATURE_TOLERANCE_SECONDS: number;
+export declare const WEBHOOK_REQUEST_TIMEOUT_MS = 10000;
+/** Failed deliveries are retried with growing waits: 1 min, 5 min, 30 min, 2 h, 6 h, 12 h, 24 h. */
+export declare const WEBHOOK_RETRY_DELAYS_SECONDS: number[];
+/** How often the delivery worker looks for webhooks to send. */
+export declare const WEBHOOK_WORKER_INTERVAL_MS = 5000;
+/** Deliveries handled per worker run. */
+export declare const WEBHOOK_WORKER_BATCH_SIZE = 20;
+export declare const WEBHOOK_SECRET_BYTES = 32;
+/** Prefix of webhook signing secrets, so they are easy to recognise (e.g. in secret scanners). */
+export declare const WEBHOOK_SECRET_PREFIX = "whsec_";
+/** A delivery claimed by a worker is retried after this long if that worker crashes mid-send. */
+export declare const WEBHOOK_CLAIM_TIMEOUT_SECONDS = 60;
+/** Longest error text / response kept for a failed delivery. */
+export declare const WEBHOOK_ERROR_MAX_LENGTH = 500;
+/** Most webhooks one app may register. */
+export declare const MAXIMUM_WEBHOOKS = 50;
+export declare const WEBHOOK_URL_MAX_LENGTH = 2048;
+export declare const WEBHOOK_DESCRIPTION_MAX_LENGTH = 200;
+/** Webhook delivery requests carry this User-Agent. */
+export declare const WEBHOOK_USER_AGENT = "techelusive-nest-auth-webhooks/1.0";
+/**
+ * Addresses webhooks may never be sent to (blocks SSRF: tricking the server into calling its own
+ * private network or the cloud metadata service at 169.254.169.254).
+ */
+export declare const BLOCKED_IPV4_RANGES: ReadonlyArray<[network: string, prefixLength: number]>;
+export declare const BLOCKED_IPV6_RANGES: ReadonlyArray<[network: string, prefixLength: number]>;
+export declare const ACCOUNT_STATUS: {
+    readonly pendingVerification: "PENDING_VERIFICATION";
+    readonly active: "ACTIVE";
+    readonly suspended: "SUSPENDED";
+    readonly deactivated: "DEACTIVATED";
+    readonly deleted: "DELETED";
+};
+export type AccountStatus = (typeof ACCOUNT_STATUS)[keyof typeof ACCOUNT_STATUS];
+export declare const ACCOUNT_STATUSES: AccountStatus[];
+/** Roles inside an organization, from most to least powerful. */
+export declare const ORGANIZATION_ROLE: {
+    readonly owner: "owner";
+    readonly admin: "admin";
+    readonly member: "member";
+};
+export type OrganizationRole = (typeof ORGANIZATION_ROLE)[keyof typeof ORGANIZATION_ROLE];
+export declare const ORGANIZATION_ROLES: OrganizationRole[];
+/** Higher number = more power. An admin can manage members and admins; only owners can manage owners. */
+export declare const ORGANIZATION_ROLE_RANK: Record<OrganizationRole, number>;
+/** Most organizations one user may belong to. */
+export declare const MAXIMUM_ORGANIZATIONS_PER_USER = 100;
+/** Role names: letters, digits, "_", "-", ":" (e.g. "user", "seller", "orders:read"). */
+export declare const ROLE_NAME_PATTERN: RegExp;
+/** Role every new user gets unless the app's settings say otherwise. */
+export declare const DEFAULT_USER_ROLE = "user";
+/** Role allowed to use the /auth/admin endpoints unless the app's settings say otherwise. */
+export declare const DEFAULT_ADMIN_ROLE = "admin";
+export declare const MAXIMUM_ROLES_PER_USER = 20;
+/** Longest suspension reason an admin may record. */
+export declare const SUSPENSION_REASON_MAX_LENGTH = 500;
+/** Phone numbers must be in international E.164 form, e.g. +919876543210. */
+export declare const PHONE_NUMBER_PATTERN: RegExp;
+export declare const EMAIL_MAX_LENGTH = 254;
+/**
+ * A practical email check: something@domain.tld with no spaces. Real proof that an address works
+ * is the verification email, not a regular expression.
+ */
+export declare const EMAIL_PATTERN: RegExp;
+export declare const DISPLAY_NAME_MAX_LENGTH = 100;
+/** Longest phone number accepted as typed (spaces and dashes are removed afterwards). */
+export declare const PHONE_NUMBER_INPUT_MAX_LENGTH = 32;
+/** Longest token accepted in a request body; real tokens are much shorter, this just blocks junk. */
+export declare const RANDOM_TOKEN_INPUT_MAX_LENGTH = 128;
+/** Longest one-time or 2FA code accepted in a request body. */
+export declare const CODE_INPUT_MAX_LENGTH = 16;
+export declare const ORGANIZATION_NAME_MAX_LENGTH = 100;
+/** Organization handles such as "acme-india". */
+export declare const ORGANIZATION_SLUG_PATTERN: RegExp;
+/** User agent strings are cut to this length before saving. */
+export declare const USER_AGENT_MAX_LENGTH = 300;
+export declare const DEFAULT_PAGE_SIZE = 50;
+export declare const MAXIMUM_PAGE_SIZE = 200;
+export declare const SETTINGS_LIMITS: {
+    readonly maximumRolesInList: 10;
+    readonly maximumAllowedEmailDomains: 100;
+    readonly maximumCountryCodes: 250;
+    readonly maximumClientIds: 10;
+    readonly facebookAppIdMaxLength: 50;
+    readonly codeLength: {
+        readonly minimum: 6;
+        readonly maximum: 8;
+    };
+    readonly codeExpiresInMinutes: {
+        readonly minimum: 1;
+        readonly maximum: 15;
+    };
+    readonly accessTokenMinutes: {
+        readonly minimum: 5;
+        readonly maximum: 60;
+    };
+    readonly refreshTokenDays: {
+        readonly minimum: 1;
+        readonly maximum: 90;
+    };
+    readonly sessionDays: {
+        readonly minimum: 1;
+        readonly maximum: 365;
+    };
+    readonly resendAfterSeconds: {
+        readonly minimum: 30;
+        readonly maximum: 300;
+    };
+    readonly emailVerificationLinkHours: {
+        readonly minimum: 1;
+        readonly maximum: 72;
+    };
+    readonly passwordResetLinkMinutes: {
+        readonly minimum: 10;
+        readonly maximum: 180;
+    };
+    readonly magicLinkMinutes: {
+        readonly minimum: 5;
+        readonly maximum: 60;
+    };
+    readonly emailChangeLinkMinutes: {
+        readonly minimum: 10;
+        readonly maximum: 240;
+    };
+    readonly invitationDays: {
+        readonly minimum: 1;
+        readonly maximum: 30;
+    };
+    readonly twoFactorChallengeMinutes: {
+        readonly minimum: 2;
+        readonly maximum: 15;
+    };
+    readonly expiredRecordDays: {
+        readonly minimum: 1;
+        readonly maximum: 90;
+    };
+    readonly webhookDeliveryDays: {
+        readonly minimum: 1;
+        readonly maximum: 365;
+    };
+    /** 0 keeps the audit log forever. */
+    readonly auditLogDays: {
+        readonly minimum: 0;
+        readonly maximum: 3650;
+    };
+};
+/** An email domain such as "myapp.com". */
+export declare const EMAIL_DOMAIN_PATTERN: RegExp;
+/** A country calling code such as "+91". */
+export declare const COUNTRY_CALLING_CODE_PATTERN: RegExp;
+/** An OAuth client id (Google client id, Apple bundle / services id). */
+export declare const OAUTH_CLIENT_ID_PATTERN: RegExp;
+/** How a user proved who they are. Stored on the session and in the token's "amr" claim. */
+export declare const SIGN_IN_METHOD: {
+    readonly password: "password";
+    readonly emailOtp: "email_otp";
+    readonly magicLink: "magic_link";
+    readonly phoneOtp: "phone_otp";
+    readonly google: "google";
+    readonly apple: "apple";
+    readonly facebook: "facebook";
+    readonly passkey: "passkey";
+};
+export type SignInMethod = (typeof SIGN_IN_METHOD)[keyof typeof SIGN_IN_METHOD];
+/** Added to "amr" when the user also passed two-factor authentication. */
+export declare const TWO_FACTOR_AMR_VALUE = "two_factor";
+/** The "status" field of sign-in and register responses. */
+export declare const SIGN_IN_STATUS: {
+    readonly signedIn: "signed_in";
+    readonly twoFactorRequired: "two_factor_required";
+    readonly verificationRequired: "verification_required";
+};
+/** Details a new account may need, listed in VALIDATION_ERROR's `missingSignUpDetails`. */
+export declare const SIGN_UP_DETAIL: {
+    readonly firstName: "firstName";
+    readonly lastName: "lastName";
+    readonly acceptTerms: "acceptTerms";
+    readonly acceptPrivacyPolicy: "acceptPrivacyPolicy";
+    readonly email: "email";
+};
+/** What a user may still have to verify before the account becomes ACTIVE. */
+export declare const PENDING_VERIFICATION: {
+    readonly email: "email";
+    readonly phone: "phone";
+};
+export type PendingVerification = (typeof PENDING_VERIFICATION)[keyof typeof PENDING_VERIFICATION];
+/** Half-finished sign-ins (auth_sign_in_challenges.purpose). */
+export declare const CHALLENGE_PURPOSE: {
+    readonly twoFactor: "two_factor";
+    readonly passkeyRegistration: "passkey_registration";
+    readonly passkeySignIn: "passkey_sign_in";
+    readonly reactivateAccount: "reactivate_account";
+};
+export type ChallengePurpose = (typeof CHALLENGE_PURPOSE)[keyof typeof CHALLENGE_PURPOSE];
+/** Emailed single-use links (auth_link_tokens.purpose). */
+export declare const LINK_PURPOSE: {
+    readonly verifyEmail: "verify_email";
+    readonly resetPassword: "reset_password";
+    readonly magicSignIn: "magic_sign_in";
+    readonly changeEmail: "change_email";
+};
+export type LinkTokenPurpose = (typeof LINK_PURPOSE)[keyof typeof LINK_PURPOSE];
+/** Where a one-time code is sent (auth_one_time_codes.channel). */
+export declare const CODE_CHANNEL: {
+    readonly email: "email";
+    readonly sms: "sms";
+};
+export type CodeChannel = (typeof CODE_CHANNEL)[keyof typeof CODE_CHANNEL];
+/** State of one webhook delivery. */
+export declare const WEBHOOK_DELIVERY_STATUS: {
+    readonly pending: "pending";
+    readonly delivered: "delivered";
+    readonly failed: "failed";
+};
+export type WebhookDeliveryStatus = (typeof WEBHOOK_DELIVERY_STATUS)[keyof typeof WEBHOOK_DELIVERY_STATUS];
+/** Event name of the delivery sent by "test webhook". */
+export declare const WEBHOOK_TEST_EVENT_NAME = "webhook.test";
+/** The `type` of each email the library asks the app to send. */
+export declare const EMAIL_TYPE: {
+    readonly verifyEmail: "verify_email";
+    readonly resetPassword: "reset_password";
+    readonly magicSignIn: "magic_sign_in";
+    readonly signInCode: "sign_in_code";
+    readonly organizationInvitation: "organization_invitation";
+    readonly passwordChanged: "password_changed";
+    readonly newSignIn: "new_sign_in";
+    /** To the NEW address: a link that confirms the change. */
+    readonly confirmEmailChange: "confirm_email_change";
+    /** To the OLD address after the change, so the owner notices an unwanted change. */
+    readonly emailChanged: "email_changed";
+};
+/** Why a session ended (auth_sessions.revoked_reason, "session.revoked" event). */
+export declare const SESSION_END_REASON: {
+    readonly signedOut: "signed_out";
+    readonly signedOutEverywhere: "signed_out_everywhere";
+    readonly signedOutByUser: "signed_out_by_user";
+    readonly signedOutByAdmin: "signed_out_by_admin";
+    readonly refreshTokenReused: "refresh_token_reused";
+    readonly accountNotActive: "account_not_active";
+    readonly accountSuspended: "account_suspended";
+    readonly accountDeactivated: "account_deactivated";
+    readonly accountDeleted: "account_deleted";
+    readonly passwordReset: "password_reset";
+    readonly passwordChanged: "password_changed";
+    readonly twoFactorEnabled: "two_factor_enabled";
+    readonly emailProvenByOwner: "email_proven_by_owner";
+};
+export type SessionEndReason = (typeof SESSION_END_REASON)[keyof typeof SESSION_END_REASON];
+/** Why a sign-in failed ("user.sign_in_failed" event). */
+export declare const SIGN_IN_FAILURE_REASON: {
+    readonly wrongEmailOrPassword: "wrong_email_or_password";
+    readonly wrongTwoFactorCode: "wrong_two_factor_code";
+    readonly passkeySignatureInvalid: "passkey_signature_invalid";
+    readonly accountNotVerified: "account_not_verified";
+    readonly accountSuspended: "account_suspended";
+};
+export type SignInFailureReason = (typeof SIGN_IN_FAILURE_REASON)[keyof typeof SIGN_IN_FAILURE_REASON];
+/** How a password changed ("user.password_changed" event, `how`). */
+export declare const PASSWORD_CHANGE_KIND: {
+    readonly reset: "reset";
+    readonly changed: "changed";
+    readonly firstSet: "set";
+    readonly removedUnverified: "removed_unverified_password";
+};
+export type PasswordChangeKind = (typeof PASSWORD_CHANGE_KIND)[keyof typeof PASSWORD_CHANGE_KIND];
+/** A sign-in method a user may remove (checked so they always keep at least one). */
+export declare const REMOVABLE_SIGN_IN_METHOD: {
+    readonly password: "password";
+    readonly social: "social";
+    readonly passkey: "passkey";
+};
+export type RemovableSignInMethod = (typeof REMOVABLE_SIGN_IN_METHOD)[keyof typeof REMOVABLE_SIGN_IN_METHOD];
+/** Who did something, in the audit log's performedBy: "admin:<id>", "user:<id>". */
+export declare const PERFORMED_BY_PREFIX: {
+    readonly admin: "admin:";
+    readonly user: "user:";
+};
+/** Encryption context "purpose" values: an encrypted value only decrypts for the same purpose and row. */
+export declare const ENCRYPTION_PURPOSE: {
+    readonly signingKey: "signing_key";
+    readonly totpSecret: "totp_secret";
+    readonly webhookSigningSecret: "webhook_signing_secret";
+};
+/** Stored encrypted values start with "<method>:", telling which method encrypted them. */
+export declare const ENCRYPTED_VALUE_METHOD: {
+    readonly kms: "kms";
+    readonly local: "local";
+};
+/** Sort orders used in queries. */
+export declare const SORT_ORDER: {
+    readonly newestFirst: "DESC";
+    readonly oldestFirst: "ASC";
+};
+/** Smallest page number in paged lists. */
+export declare const FIRST_PAGE = 1;
+/** Value of NODE_ENV in production. */
+export declare const PRODUCTION_ENVIRONMENT = "production";
+/** Text encodings used with Buffer. */
+export declare const TEXT_ENCODING: {
+    readonly utf8: "utf8";
+    readonly base64: "base64";
+    readonly base64Url: "base64url";
+    readonly hex: "hex";
+};
+/** Hash functions. SHA-1 appears only where a standard requires it (TOTP, breached-password API). */
+export declare const HASH_ALGORITHM: {
+    readonly sha256: "sha256";
+    readonly sha1: "sha1";
+};
+/** Cipher for the development-only local encryption key. */
+export declare const LOCAL_ENCRYPTION_CIPHER = "aes-256-gcm";
+/** JWT ECDSA signatures use the raw r||s form, not DER. */
+export declare const ECDSA_SIGNATURE_ENCODING = "ieee-p1363";
+/** Token-signing key pair: an elliptic-curve key on P-256 (what ES256 means). */
+export declare const SIGNING_KEY_PAIR_TYPE = "ec";
+export declare const SIGNING_KEY_CURVE = "P-256";
+/** JSON Web Key fields and values. */
+export declare const JWK_EXPORT_FORMAT = "jwk";
+export declare const JWK_KEY_TYPE: {
+    readonly ellipticCurve: "EC";
+    readonly rsa: "RSA";
+};
+export declare const JWK_USE_SIGNATURE = "sig";
+/** Separator between an encrypted value's method prefix and its data ("kms:..."). */
+export declare const ENCRYPTED_VALUE_SEPARATOR = ":";
+/** Random salt size for hashed short codes. */
+export declare const SHORT_CODE_SALT_BYTES = 16;
+/** Authenticator apps read QR codes holding "otpauth://totp/<label>?<parameters>". */
+export declare const AUTHENTICATOR_APP_URL_PREFIX = "otpauth://totp/";
+export declare const URL_QUERY_SEPARATOR = "?";
+/** Name of the TOTP hash in authenticator-app URLs (otpauth://...&algorithm=SHA1). */
+export declare const TOTP_URL_ALGORITHM_NAME = "SHA1";
+export declare const ROUTE_PARAM: {
+    readonly provider: "provider";
+    readonly sessionId: "sessionId";
+    readonly passkeyId: "passkeyId";
+    readonly organizationId: "organizationId";
+    readonly memberUserId: "memberUserId";
+    readonly invitationId: "invitationId";
+    readonly userId: "userId";
+    readonly apiKeyId: "apiKeyId";
+    readonly webhookId: "webhookId";
+    readonly deliveryId: "deliveryId";
+};
+export declare const ROUTES: {
+    /** Email + password, email verification, passwordless and account routes share this prefix. */
+    readonly auth: {
+        readonly prefix: "auth";
+        readonly register: "register";
+        readonly login: "login";
+        readonly emailSendVerification: "email/send-verification";
+        readonly emailVerify: "email/verify";
+        readonly emailSendOtp: "email/send-otp";
+        readonly emailVerifyOtp: "email/verify-otp";
+        readonly magicLinkSend: "magic-link/send";
+        readonly magicLinkVerify: "magic-link/verify";
+        readonly phoneSendOtp: "phone/send-otp";
+        readonly phoneVerifyOtp: "phone/verify-otp";
+        readonly passwordForgot: "password/forgot";
+        readonly passwordReset: "password/reset";
+        readonly passwordChange: "password/change";
+        readonly refresh: "refresh";
+        readonly logout: "logout";
+        readonly logoutAll: "logout-all";
+        readonly me: "me";
+        readonly signInMethods: "sign-in-methods";
+        readonly sessions: "sessions";
+        readonly session: "sessions/:sessionId";
+        readonly deactivate: "deactivate";
+        readonly reactivate: "reactivate";
+        readonly emailChange: "email/change";
+        readonly emailChangeConfirm: "email/change/confirm";
+        readonly exportMyData: "me/export";
+        readonly health: "health";
+    };
+    readonly social: {
+        readonly prefix: "auth/social";
+        readonly signIn: ":provider";
+        readonly link: ":provider/link";
+        readonly unlink: ":provider";
+    };
+    readonly passkeys: {
+        readonly prefix: "auth/passkeys";
+        readonly registerOptions: "register/options";
+        readonly registerVerify: "register/verify";
+        readonly signInOptions: "sign-in/options";
+        readonly signInVerify: "sign-in/verify";
+        readonly passkey: ":passkeyId";
+    };
+    readonly twoFactor: {
+        readonly prefix: "auth/2fa";
+        readonly setup: "setup";
+        readonly enable: "enable";
+        readonly disable: "disable";
+        readonly backupCodes: "backup-codes";
+        readonly verify: "verify";
+    };
+    readonly organizations: {
+        readonly prefix: "auth/organizations";
+        readonly switch: "switch";
+        readonly acceptInvitation: "invitations/accept";
+        readonly organization: ":organizationId";
+        readonly members: ":organizationId/members";
+        readonly member: ":organizationId/members/:memberUserId";
+        readonly invitations: ":organizationId/invitations";
+        readonly invitation: ":organizationId/invitations/:invitationId";
+    };
+    readonly admin: {
+        readonly prefix: "auth/admin";
+        readonly users: "users";
+        readonly user: "users/:userId";
+        readonly userRoles: "users/:userId/roles";
+        readonly userSuspend: "users/:userId/suspend";
+        readonly userUnsuspend: "users/:userId/unsuspend";
+        readonly userVerifyEmail: "users/:userId/verify-email";
+        readonly userResetTwoFactor: "users/:userId/reset-2fa";
+        readonly userLogoutAll: "users/:userId/logout-all";
+        readonly settings: "settings";
+        readonly auditLog: "audit-log";
+        readonly rotateSigningKey: "signing-keys/rotate";
+        readonly apiKeys: "api-keys";
+        readonly apiKey: "api-keys/:apiKeyId";
+        readonly webhooks: "webhooks";
+        readonly webhook: "webhooks/:webhookId";
+        readonly webhookRotateSecret: "webhooks/:webhookId/rotate-secret";
+        readonly webhookTest: "webhooks/:webhookId/test";
+        readonly webhookDeliveries: "webhooks/:webhookId/deliveries";
+        readonly webhookRetryDelivery: "webhooks/:webhookId/deliveries/:deliveryId/retry";
+        readonly stats: "stats";
+        readonly runCleanup: "maintenance/cleanup";
+    };
+    readonly wellKnown: {
+        readonly prefix: ".well-known";
+        readonly jwks: "jwks.json";
+    };
+};
+/** HTTP header names and values the library reads or sends. */
+export declare const HTTP_HEADER: {
+    readonly authorization: "authorization";
+    readonly userAgent: "user-agent";
+    readonly contentType: "Content-Type";
+    readonly accept: "accept";
+    readonly cacheControl: "Cache-Control";
+    readonly retryAfter: "Retry-After";
+    readonly outgoingUserAgent: "User-Agent";
+    readonly cookie: "cookie";
+    readonly setCookie: "Set-Cookie";
+    readonly origin: "origin";
+};
+export declare const JSON_CONTENT_TYPE = "application/json";
+/** Requests of other kinds (WebSockets, microservices) are not checked by AuthGuard. */
+export declare const HTTP_CONTEXT_TYPE = "http";
+/** The JWKS document may be cached by clients for 5 minutes. */
+export declare const JWKS_CACHE_CONTROL = "public, max-age=300";
+export declare const RATE_LIMIT_KEY: {
+    readonly signUpPerIp: (ipAddress: string | null) => string;
+    readonly signInPerIp: (ipAddress: string | null) => string;
+    readonly signInPerAccount: (email: string) => string;
+    readonly sendCodePerIp: (ipAddress: string | null) => string;
+    readonly sendCodePerDestination: (destination: string) => string;
+    readonly sendEmailLinkPerIp: (ipAddress: string | null) => string;
+    readonly sendEmailLinkPerEmail: (email: string) => string;
+    readonly refreshPerIp: (ipAddress: string | null) => string;
+    readonly twoFactorPerUser: (userId: string) => string;
+    readonly changePasswordPerUser: (userId: string) => string;
+    readonly changeEmailPerUser: (userId: string) => string;
+    readonly exportDataPerUser: (userId: string) => string;
+};
+/** Builds the audit log's performedBy value. */
+export declare const PERFORMED_BY: {
+    readonly admin: (adminUserId: string) => string;
+    readonly user: (userId: string) => string;
+};
+/** User agent recorded for actions taken by scripts and jobs (SYSTEM_REQUEST). */
+export declare const SYSTEM_USER_AGENT = "system";
+/** Names shown in log lines, one per component. */
+export declare const LOG_CONTEXT: {
+    readonly exceptionFilter: "AuthExceptionFilter";
+    readonly rateLimiter: "RateLimiter";
+    readonly apiKeys: "ApiKeys";
+    readonly events: "AuthEvents";
+    readonly notifications: "Notifications";
+    readonly passwordPolicy: "PasswordPolicy";
+    readonly sessions: "Sessions";
+    readonly signingKeys: "SigningKeys";
+    readonly socialProviders: "SocialProviders";
+    readonly webhookDelivery: "WebhookDelivery";
+    readonly consoleEmailSender: "ConsoleEmailSender";
+    readonly dataRetention: "DataRetention";
+};
+/** In-process caches are emptied when they grow past these sizes (protects memory under attack). */
+export declare const SESSION_CHECK_CACHE_MAX_ENTRIES = 100000;
+export declare const IN_MEMORY_RATE_LIMIT_MAX_ENTRIES = 50000;
+export declare const PASSWORD_REQUIREMENT: {
+    readonly minimumLength: (minimumLength: number) => string;
+    readonly maximumLength: (maximumLength: number) => string;
+    readonly uppercaseLetter: "an uppercase letter";
+    readonly lowercaseLetter: "a lowercase letter";
+    readonly number: "a number";
+    readonly symbol: "a symbol";
+    readonly differentFromCurrent: "different from your current password";
+};
+/** Trailing slashes removed from the issuer URL ("https://api.myapp.com/" -> "https://api.myapp.com"). */
+export declare const TRAILING_SLASHES_PATTERN: RegExp;
+/** Characters removed from typed input before it is checked. */
+export declare const PHONE_FORMATTING_CHARACTERS_PATTERN: RegExp;
+export declare const BACKUP_CODE_FORMATTING_CHARACTERS_PATTERN: RegExp;
+export declare const WHITESPACE_PATTERN: RegExp;
+export declare const BASE32_PADDING_PATTERN: RegExp;
+export declare const LEADING_PLUS_PATTERN: RegExp;
+/** Only base64url characters (the body of a random token). */
+export declare const BASE64URL_TEXT_PATTERN: RegExp;
+/** Only digits (a typed TOTP code). */
+export declare const DIGITS_ONLY_PATTERN: RegExp;
+/** Characters with special meaning in SQL LIKE patterns, escaped in admin user search. */
+export declare const SQL_LIKE_SPECIAL_CHARACTERS_PATTERN: RegExp;
+export declare const SQL_LIKE_ESCAPE_CHARACTER = "\\";
+export declare const SQL_LIKE_ANY_TEXT = "%";
+/** Joins nested settings field names: "password.minimumLength". */
+export declare const SETTINGS_PATH_SEPARATOR = ".";
+/** Patterns for the character rules above. */
+export declare const UPPERCASE_LETTER_PATTERN: RegExp;
+export declare const LOWERCASE_LETTER_PATTERN: RegExp;
+export declare const DIGIT_PATTERN: RegExp;
+export declare const VALIDATION_PROBLEM: {
+    readonly namesRequired: "firstName and lastName are required";
+    readonly tooManyOrganizations: "too many organizations";
+    readonly tooManyPasskeys: "too many passkeys";
+    readonly tooManyWebhooks: "too many webhooks";
+    readonly unknownEventNames: (unknownNames: string[]) => string;
+    readonly settingsNotAnObject: "settings must be an object";
+    readonly refreshLongerThanSession: "tokens.refreshTokenDays cannot be more than tokens.sessionDays";
+    readonly noSignInMethodEnabled: "at least one sign-in method must stay enabled";
+    readonly googleClientIdsRequired: "google.clientIds is required when Google is enabled";
+    readonly appleClientIdsRequired: "apple.clientIds is required when Apple is enabled";
+    readonly facebookAppIdRequired: "facebook.appId is required when Facebook is enabled";
+    readonly adminRolesRequired: "admin.adminRoles must name at least one role";
+    /** "password.minimumLength must not be less than 8" */
+    readonly atPath: (path: string, message: string) => string;
+    readonly emailDomainFormat: "each domain must look like example.com";
+    readonly countryCodeFormat: "each code must look like +91";
+};
+/** Problems found in AuthModule options at startup (the app refuses to start and lists them). */
+export declare const OPTIONS_PROBLEM: {
+    readonly dataSourceRequired: "dataSource is required (your TypeORM DataSource)";
+    readonly emailSenderRequired: "emailSender with a send() method is required";
+    readonly issuerMustBeHttps: "issuer must be an https URL in production";
+    readonly issuerMustBeUrl: "issuer must be a full URL, e.g. https://api.myapp.com";
+    readonly encryptionRequired: "encryption is required: { awsKmsKeyId, awsRegion } or, for development, { localKey }";
+    readonly localKeyNotForProduction: "encryption.localKey is for development only; use AWS KMS in production";
+    readonly localKeyWrongSize: "encryption.localKey must be 32 random bytes in base64 (openssl rand -base64 32)";
+    readonly kmsDetailsRequired: "encryption needs both awsKmsKeyId and awsRegion";
+    readonly legacyLocalKeyWrongSize: "encryption.legacyLocalKey must be the old 32-byte base64 local key";
+    readonly relyingPartyIdMustBeDomain: "passkeys.relyingPartyId must be a bare domain such as \"myapp.com\"";
+    readonly relyingPartyNameRequired: "passkeys.relyingPartyName is required";
+    readonly allowedOriginsRequired: "passkeys.allowedOrigins needs at least one origin";
+    readonly cookieAllowedOriginsRequired: "refreshTokenCookie.allowedOrigins needs at least one origin, e.g. [\"https://app.myapp.com\"]";
+    readonly hostCookieRules: "refreshTokenCookie: a name starting with \"__Host-\" requires path \"/\" and no domain";
+    readonly redisRequiredInProduction: "redisUrl is required in production so rate limits are shared by every server (set singleServer: true if you really run one process)";
+};
+/** Why a webhook URL was refused (UNSAFE_WEBHOOK_URL `problem`). */
+export declare const URL_SAFETY_PROBLEM: {
+    readonly invalidUrl: "not a valid URL";
+    readonly hasCredentials: "URL must not contain a username or password";
+    readonly notHttps: "URL must use https";
+    readonly doesNotResolve: "host name does not resolve";
+    readonly privateAddress: "URL points to a private network address";
+};
+/** lastError of a webhook delivery that could not be sent. */
+export declare const WEBHOOK_DELIVERY_ERROR: {
+    readonly webhookUnavailable: "webhook removed or disabled";
+    readonly unsafeUrl: (problem: string) => string;
+    readonly httpStatus: (status: number) => string;
+};
+/** Message inside the "webhook.test" delivery. */
+export declare const WEBHOOK_TEST_MESSAGE = "This is a test delivery.";
+export declare const HTTP_METHOD: {
+    readonly post: "POST";
+};
+/** Outgoing webhook calls never follow redirects (a redirect could point at a private address). */
+export declare const FETCH_REDIRECT_MODE_MANUAL = "manual";
+/** Responses in this range count as success. */
+export declare const SUCCESS_STATUS_RANGE: {
+    readonly from: 200;
+    readonly toExclusive: 300;
+};
+export declare const URL_PROTOCOL: {
+    readonly https: "https:";
+    readonly http: "http:";
+};
+/** Hosts allowed over plain http outside production, for local webhook testing. */
+export declare const LOCAL_DEVELOPMENT_HOSTS: string[];
+/** Node's names and numbers for IP versions. */
+export declare const IP_FAMILY: {
+    readonly ipv4: "ipv4";
+    readonly ipv6: "ipv6";
+};
+export declare const IP_VERSION_6 = 6;
+/** "::ffff:10.0.0.1" style IPv4-mapped IPv6 address; group 1 is the IPv4 part. */
+export declare const IPV4_MAPPED_IPV6_PATTERN: RegExp;
+/** Square brackets around IPv6 hosts in URLs ("[::1]"). */
+export declare const URL_IPV6_BRACKETS_PATTERN: RegExp;
+/** haveibeenpwned.com range API: padded responses hide which prefix was asked about. */
+export declare const BREACHED_PASSWORD_API: {
+    readonly paddingHeader: "Add-Padding";
+    readonly paddingHeaderValue: "true";
+    readonly lineSeparator: "\n";
+    readonly countSeparator: ":";
+};
+/** Facebook Graph API paths and query parameters. */
+export declare const FACEBOOK_API: {
+    readonly debugTokenPath: "/debug_token";
+    readonly profilePath: "/me";
+    readonly inputTokenParameter: "input_token";
+    readonly accessTokenParameter: "access_token";
+    readonly fieldsParameter: "fields";
+    readonly appSecretProofParameter: "appsecret_proof";
+    readonly appAccessToken: (appId: string, appSecret: string) => string;
+};
+/** Apple sends email_verified either as a boolean or as this string. */
+export declare const APPLE_TRUE_STRING = "true";
+/** MSG91 request details. */
+export declare const MSG91_API: {
+    readonly authKeyHeader: "authkey";
+    readonly defaultCodeVariableName: "otp";
+    readonly errorResponseType: "error";
+};
+/** JWT: header.payload.signature */
+export declare const JWT_PART_SEPARATOR = ".";
+export declare const JWT_PART_COUNT = 3;
+/** Random tokens look like "<prefix>_<43 base64url characters>". */
+export declare const TOKEN_PREFIX_SEPARATOR = "_";
+/** Length of 32 random bytes written in base64url. */
+export declare const RANDOM_TOKEN_BASE64URL_LENGTH = 43;
+/** Short codes are hashed as "<salt>:<code>". */
+export declare const SALTED_CODE_SEPARATOR = ":";
+/** Digits of a numeric code are chosen from 0 to 9. */
+export declare const DECIMAL_BASE = 10;
+/** TOTP: an 8-byte big-endian counter; codes are left-padded with zeros. */
+export declare const TOTP_COUNTER_BYTES = 8;
+export declare const TOTP_CODE_PAD_CHARACTER = "0";
+/** Authenticator-app label "Issuer:account". */
+export declare const TOTP_LABEL_SEPARATOR = ":";
+/** Base32 packs 5 bits per character; bytes have 8 bits. */
+export declare const BASE32_BITS_PER_CHARACTER = 5;
+export declare const BITS_PER_BYTE = 8;
+export declare const BASE32_CHARACTER_MASK = 31;
+export declare const BYTE_MASK = 255;
+/** Backup codes are shown as "k7m2-x9p4". */
+export declare const BACKUP_CODE_DISPLAY_SEPARATOR = "-";
+/** First and last name are joined with a space for display. */
+export declare const DISPLAY_NAME_SEPARATOR = " ";
+/** Email masking keeps the first character: "a***@mail.com". */
+export declare const EMAIL_MASK: {
+    readonly visibleCharacters: 1;
+    readonly hiddenPart: "***";
+    readonly domainSeparator: "@";
+};
+/** Phone masking keeps the country code and the last 4 digits: "+91******3210". */
+export declare const PHONE_MASK: {
+    readonly visibleStart: 3;
+    readonly visibleEnd: 4;
+    readonly maskCharacter: "*";
+};
+/** A bare passkey relying-party id is a domain, so it contains neither of these. */
+export declare const RELYING_PARTY_ID_FORBIDDEN_CHARACTERS: string[];
+/** Webhook signature header: "t=<unix time>,v1=<hex HMAC>" over "<t>.<raw body>". */
+export declare const WEBHOOK_SIGNATURE_FORMAT: {
+    readonly timestampKey: "t";
+    readonly signatureKey: "v1";
+    readonly partSeparator: ",";
+    readonly keyValueSeparator: "=";
+    readonly signedContentSeparator: ".";
+};
+export declare const METADATA_KEY: {
+    readonly publicRoute: "techelusive-auth:public-route";
+    readonly requiredRoles: "techelusive-auth:required-roles";
+    readonly checkSessionInDatabase: "techelusive-auth:check-session";
+    readonly apiKeyScopes: "techelusive-auth:api-key-scopes";
+    readonly adminOnly: "techelusive-auth:admin-only";
+    readonly clearsRefreshTokenCookie: "techelusive-auth:clears-refresh-token-cookie";
+    readonly libraryController: "techelusive-auth:library-controller";
+};
+/** Name of the property the guard puts on the Express request (read by @CurrentUser). */
+export declare const CALLER_REQUEST_PROPERTY = "techelusiveAuthCaller";
+/** "Authorization: Bearer <token>" */
+export declare const BEARER_TOKEN_PATTERN: RegExp;
+/** Longest API key name. */
+export declare const API_KEY_NAME_MAX_LENGTH = 100;
+/** Most scopes on one API key. */
+export declare const MAXIMUM_API_KEY_SCOPES = 50;
+/** API key scopes look like "rides:read" or "admin". */
+export declare const API_KEY_SCOPE_PATTERN: RegExp;
+/** Characters of an API key (after "ak_") shown in lists so people can tell keys apart. */
+export declare const API_KEY_PREVIEW_LENGTH = 6;
+/** "Last used" on an API key is updated at most this often, to avoid a write on every request. */
+export declare const API_KEY_LAST_USED_UPDATE_SECONDS = 60;
+/** Header used by servers calling your API with an API key. */
+export declare const API_KEY_HEADER = "x-api-key";
+export declare const AUTH_EVENTS: {
+    readonly userCreated: "user.created";
+    readonly userUpdated: "user.updated";
+    readonly userDeleted: "user.deleted";
+    readonly userSignedIn: "user.signed_in";
+    readonly userSignInFailed: "user.sign_in_failed";
+    readonly userSignedOut: "user.signed_out";
+    readonly userActivated: "user.activated";
+    readonly userSuspended: "user.suspended";
+    readonly userDeactivated: "user.deactivated";
+    readonly userReactivated: "user.reactivated";
+    readonly userRolesChanged: "user.roles_changed";
+    readonly phoneVerified: "user.phone_verified";
+    readonly onboardingCompleted: "user.onboarding_completed";
+    readonly emailVerified: "user.email_verified";
+    readonly emailChangeRequested: "user.email_change_requested";
+    readonly emailChanged: "user.email_changed";
+    readonly passwordChanged: "user.password_changed";
+    readonly passwordResetRequested: "user.password_reset_requested";
+    readonly twoFactorEnabled: "user.two_factor_enabled";
+    readonly twoFactorDisabled: "user.two_factor_disabled";
+    readonly passkeyAdded: "user.passkey_added";
+    readonly passkeyRemoved: "user.passkey_removed";
+    readonly socialAccountLinked: "user.social_account_linked";
+    readonly socialAccountUnlinked: "user.social_account_unlinked";
+    readonly sessionRevoked: "session.revoked";
+    readonly refreshTokenReused: "session.refresh_token_reused";
+    readonly organizationCreated: "organization.created";
+    readonly organizationDeleted: "organization.deleted";
+    readonly organizationMemberAdded: "organization.member_added";
+    readonly organizationMemberRemoved: "organization.member_removed";
+    readonly organizationMemberRoleChanged: "organization.member_role_changed";
+    readonly organizationUpdated: "organization.updated";
+    readonly organizationInvitationSent: "organization.invitation_sent";
+    readonly apiKeyCreated: "api_key.created";
+    readonly apiKeyRevoked: "api_key.revoked";
+    readonly settingsChanged: "settings.changed";
+};
+export type AuthEventName = (typeof AUTH_EVENTS)[keyof typeof AUTH_EVENTS];
+export declare const SUCCESS_MESSAGES: {
+    readonly registered: "Your account has been created. Please verify your details to continue.";
+    readonly verificationEmailSent: "If this email needs verifying, a verification link is on its way.";
+    readonly emailVerified: "Your email has been verified.";
+    readonly passwordResetEmailSent: "If an account exists for this email, a password reset link is on its way.";
+    readonly passwordReset: "Your password has been reset. Please sign in with your new password.";
+    readonly passwordChanged: "Your password has been changed. Other devices have been signed out.";
+    readonly codeSent: "If this destination can receive codes, a code is on its way.";
+    readonly magicLinkSent: "If this email can sign in, a sign-in link is on its way.";
+    readonly signedOut: "You have been signed out.";
+    readonly signedOutEverywhere: "You have been signed out on all devices.";
+    readonly accountDeactivated: "Your account has been deactivated. Sign in again at any time to reactivate it.";
+    readonly accountDeleted: "Your account has been deleted.";
+    readonly emailChangeRequested: "If this email can be used, a confirmation link is on its way to it.";
+    readonly emailChanged: "Your email has been changed.";
+};
+export declare const AUTH_ERRORS: {
+    readonly validationFailed: {
+        readonly status: 400;
+        readonly code: "VALIDATION_ERROR";
+        readonly message: "Some fields are missing or invalid.";
+    };
+    readonly invalidEmail: {
+        readonly status: 400;
+        readonly code: "INVALID_EMAIL";
+        readonly message: "Enter a valid email address.";
+    };
+    readonly invalidPhone: {
+        readonly status: 400;
+        readonly code: "INVALID_PHONE";
+        readonly message: "Enter a valid phone number with country code, e.g. +919876543210.";
+    };
+    readonly invalidPassword: {
+        readonly status: 400;
+        readonly code: "INVALID_PASSWORD";
+        readonly message: "This password does not meet the password rules.";
+    };
+    readonly breachedPassword: {
+        readonly status: 400;
+        readonly code: "INVALID_PASSWORD";
+        readonly message: "This password has appeared in a data breach. Please choose a different one.";
+    };
+    readonly termsNotAccepted: {
+        readonly status: 400;
+        readonly code: "TERMS_NOT_ACCEPTED";
+        readonly message: "Please accept the terms of service.";
+    };
+    readonly privacyPolicyNotAccepted: {
+        readonly status: 400;
+        readonly code: "PRIVACY_POLICY_NOT_ACCEPTED";
+        readonly message: "Please accept the privacy policy.";
+    };
+    readonly emailDomainNotAllowed: {
+        readonly status: 400;
+        readonly code: "EMAIL_DOMAIN_NOT_ALLOWED";
+        readonly message: "Sign up is limited to approved email domains.";
+    };
+    readonly phoneCountryNotAllowed: {
+        readonly status: 400;
+        readonly code: "PHONE_COUNTRY_NOT_ALLOWED";
+        readonly message: "Phone numbers from this country are not supported.";
+    };
+    readonly invalidCredentials: {
+        readonly status: 401;
+        readonly code: "INVALID_CREDENTIALS";
+        readonly message: "Invalid email or password.";
+    };
+    readonly invalidOtp: {
+        readonly status: 400;
+        readonly code: "INVALID_OTP";
+        readonly message: "This code is incorrect.";
+    };
+    readonly otpExpired: {
+        readonly status: 400;
+        readonly code: "OTP_EXPIRED";
+        readonly message: "This code has expired or was used too many times. Please request a new one.";
+    };
+    readonly invalidOrExpiredLink: {
+        readonly status: 400;
+        readonly code: "INVALID_TOKEN";
+        readonly message: "This link is invalid, expired or already used.";
+    };
+    readonly unauthorized: {
+        readonly status: 401;
+        readonly code: "UNAUTHORIZED";
+        readonly message: "Please sign in to continue.";
+    };
+    readonly invalidAccessToken: {
+        readonly status: 401;
+        readonly code: "INVALID_TOKEN";
+        readonly message: "Your session has expired. Please sign in again.";
+    };
+    readonly invalidRefreshToken: {
+        readonly status: 401;
+        readonly code: "INVALID_TOKEN";
+        readonly message: "Your session has expired. Please sign in again.";
+    };
+    readonly invalidApiKey: {
+        readonly status: 401;
+        readonly code: "INVALID_API_KEY";
+        readonly message: "The API key is missing, invalid or revoked.";
+    };
+    readonly invalidSocialToken: {
+        readonly status: 401;
+        readonly code: "INVALID_SOCIAL_TOKEN";
+        readonly message: "We could not confirm your sign-in with this provider.";
+    };
+    readonly invalidPasskey: {
+        readonly status: 401;
+        readonly code: "INVALID_PASSKEY";
+        readonly message: "We could not confirm this passkey.";
+    };
+    readonly invalidTwoFactorCode: {
+        readonly status: 401;
+        readonly code: "INVALID_OTP";
+        readonly message: "This code is incorrect.";
+    };
+    readonly accountNotVerified: {
+        readonly status: 403;
+        readonly code: "ACCOUNT_NOT_VERIFIED";
+        readonly message: "Please finish verifying your account.";
+    };
+    readonly accountSuspended: {
+        readonly status: 403;
+        readonly code: "ACCOUNT_SUSPENDED";
+        readonly message: "This account has been suspended. Please contact support.";
+    };
+    readonly accountDeactivated: {
+        readonly status: 403;
+        readonly code: "ACCOUNT_DEACTIVATED";
+        readonly message: "This account is deactivated. Reactivate it to continue.";
+    };
+    readonly forbidden: {
+        readonly status: 403;
+        readonly code: "FORBIDDEN";
+        readonly message: "You do not have permission to do this.";
+    };
+    readonly missingApiKeyScope: {
+        readonly status: 403;
+        readonly code: "FORBIDDEN";
+        readonly message: "This API key is not allowed to do this.";
+    };
+    readonly signUpClosed: {
+        readonly status: 403;
+        readonly code: "SIGN_UP_CLOSED";
+        readonly message: "Sign up is currently closed.";
+    };
+    readonly signInMethodDisabled: {
+        readonly status: 403;
+        readonly code: "SIGN_IN_METHOD_DISABLED";
+        readonly message: "This sign-in method is not available.";
+    };
+    readonly featureDisabled: {
+        readonly status: 403;
+        readonly code: "FEATURE_DISABLED";
+        readonly message: "This feature is not turned on.";
+    };
+    readonly notFound: {
+        readonly status: 404;
+        readonly code: "NOT_FOUND";
+        readonly message: "Not found.";
+    };
+    readonly accountAlreadyExists: {
+        readonly status: 409;
+        readonly code: "ACCOUNT_ALREADY_EXISTS";
+        readonly message: "An account with these details already exists.";
+    };
+    readonly accountExistsWithOtherMethod: {
+        readonly status: 409;
+        readonly code: "ACCOUNT_EXISTS_WITH_OTHER_METHOD";
+        readonly message: "An account with this email already exists. Sign in your usual way, then link this account from your profile.";
+    };
+    readonly socialAccountAlreadyLinked: {
+        readonly status: 409;
+        readonly code: "SOCIAL_ACCOUNT_IN_USE";
+        readonly message: "This account is already linked to another user.";
+    };
+    readonly cannotRemoveLastSignInMethod: {
+        readonly status: 409;
+        readonly code: "LAST_SIGN_IN_METHOD";
+        readonly message: "Add another way to sign in before removing this one.";
+    };
+    readonly twoFactorAlreadyEnabled: {
+        readonly status: 409;
+        readonly code: "TWO_FACTOR_ALREADY_ENABLED";
+        readonly message: "Two-factor authentication is already on.";
+    };
+    readonly twoFactorNotEnabled: {
+        readonly status: 409;
+        readonly code: "TWO_FACTOR_NOT_ENABLED";
+        readonly message: "Two-factor authentication is not on.";
+    };
+    readonly twoFactorSetupNotStarted: {
+        readonly status: 409;
+        readonly code: "TWO_FACTOR_SETUP_NOT_STARTED";
+        readonly message: "Start two-factor setup first.";
+    };
+    readonly organizationSlugTaken: {
+        readonly status: 409;
+        readonly code: "ORGANIZATION_SLUG_TAKEN";
+        readonly message: "This organization handle is already taken.";
+    };
+    readonly alreadyOrganizationMember: {
+        readonly status: 409;
+        readonly code: "ALREADY_MEMBER";
+        readonly message: "This person is already a member.";
+    };
+    readonly lastOrganizationOwner: {
+        readonly status: 409;
+        readonly code: "LAST_OWNER";
+        readonly message: "An organization needs at least one owner.";
+    };
+    readonly accountNotDeactivated: {
+        readonly status: 409;
+        readonly code: "ACCOUNT_NOT_DEACTIVATED";
+        readonly message: "This account is not deactivated.";
+    };
+    readonly emailInUse: {
+        readonly status: 409;
+        readonly code: "EMAIL_IN_USE";
+        readonly message: "This email is already used by another account.";
+    };
+    readonly emailUnchanged: {
+        readonly status: 400;
+        readonly code: "EMAIL_UNCHANGED";
+        readonly message: "This is already your email.";
+    };
+    readonly recentSignInRequired: {
+        readonly status: 403;
+        readonly code: "RECENT_SIGN_IN_REQUIRED";
+        readonly message: "For your security, please sign in again and then retry.";
+    };
+    readonly originNotAllowed: {
+        readonly status: 403;
+        readonly code: "FORBIDDEN";
+        readonly message: "This request did not come from an allowed website.";
+    };
+    readonly tooManyRequests: {
+        readonly status: 429;
+        readonly code: "TOO_MANY_REQUESTS";
+        readonly message: "Too many attempts. Please try again later.";
+    };
+    readonly resendTooSoon: {
+        readonly status: 429;
+        readonly code: "TOO_MANY_REQUESTS";
+        readonly message: "Please wait a minute before requesting another code.";
+    };
+    readonly invalidSettings: {
+        readonly status: 400;
+        readonly code: "INVALID_SETTINGS";
+        readonly message: "Some settings are not valid.";
+    };
+    readonly unsafeWebhookUrl: {
+        readonly status: 400;
+        readonly code: "UNSAFE_WEBHOOK_URL";
+        readonly message: "Webhook URLs must be public https addresses.";
+    };
+    readonly notConfigured: {
+        readonly status: 501;
+        readonly code: "NOT_CONFIGURED";
+        readonly message: "This feature is not set up on the server.";
+    };
+    readonly internalError: {
+        readonly status: 500;
+        readonly code: "INTERNAL_SERVER_ERROR";
+        readonly message: "Something went wrong. Please try again.";
+    };
+};
+export type AuthErrorName = keyof typeof AUTH_ERRORS;
+/** Codes for Nest HTTP errors that are not AuthErrors (e.g. thrown by your own code or by Nest itself). */
+export declare const ERROR_CODE_BY_HTTP_STATUS: Record<number, string>;
+/** One entry of AUTH_ERRORS. */
+export interface AuthErrorDefinition {
+    status: number;
+    code: string;
+    message: string;
+}
+/**
+ * The settings used when neither your code nor an admin has changed them.
+ * Secure by default: only email + password is on, verification is required, short-lived tokens.
+ */
+export declare const DEFAULT_SETTINGS: AuthSettings;
+/** How often each server runs the cleanup, and how long after start the first run waits. */
+export declare const DATA_RETENTION_INTERVAL_MS: number;
+export declare const DATA_RETENTION_FIRST_RUN_DELAY_MS: number;
+/** Rows deleted per statement, so a cleanup never holds locks for long. */
+export declare const DATA_RETENTION_BATCH_SIZE = 5000;
+/** Most batches per table per run; the rest waits for the next run. */
+export declare const DATA_RETENTION_MAX_BATCHES_PER_TABLE = 100;
+/** Names of the cleanup steps, used as keys in the cleanup report. */
+export declare const DATA_RETENTION_STEP: {
+    readonly endedSessions: "endedSessions";
+    readonly expiredRefreshTokens: "expiredRefreshTokens";
+    readonly linkTokens: "linkTokens";
+    readonly oneTimeCodes: "oneTimeCodes";
+    readonly signInChallenges: "signInChallenges";
+    readonly organizationInvitations: "organizationInvitations";
+    readonly webhookDeliveries: "webhookDeliveries";
+    readonly auditLog: "auditLog";
+};
+export type DataRetentionStep = (typeof DATA_RETENTION_STEP)[keyof typeof DATA_RETENTION_STEP];
+/** SQL condition marking a row of each step as old (`:cutoff` = now minus the days to keep). */
+export declare const DATA_RETENTION_OLD_ROW_CONDITION: Record<DataRetentionStep, string>;
+/**
+ * One batch of old rows (by primary key), so each DELETE statement stays short.
+ *
+ * @param tableName - The table to clean (from TypeORM metadata, never user input).
+ * @param oldRowCondition - Which rows count as old, from DATA_RETENTION_OLD_ROW_CONDITION.
+ * @returns A WHERE clause using the :cutoff and :batchSize parameters.
+ */
+export declare const DATA_RETENTION_BATCH_CONDITION: (tableName: string, oldRowCondition: string) => string;
+/** Cookies named "__Host-..." are locked by the browser to Secure, path "/" and no domain. */
+export declare const HOST_COOKIE_PREFIX = "__Host-";
+export declare const COOKIE_SAME_SITE: {
+    readonly strict: "Strict";
+    readonly lax: "Lax";
+    readonly none: "None";
+};
+export type CookieSameSite = (typeof COOKIE_SAME_SITE)[keyof typeof COOKIE_SAME_SITE];
+export declare const REFRESH_TOKEN_COOKIE_DEFAULTS: {
+    readonly name: "__Host-refresh_token";
+    /** "__Host-" cookies must use path "/" and no domain; with a custom name you may narrow it. */
+    readonly path: "/";
+    readonly sameSite: "Strict";
+};
+/** Cookie attribute names, written by serializeCookie(). */
+export declare const COOKIE_ATTRIBUTE: {
+    readonly maxAge: "Max-Age";
+    readonly path: "Path";
+    readonly domain: "Domain";
+    readonly sameSite: "SameSite";
+    readonly httpOnly: "HttpOnly";
+    readonly secure: "Secure";
+};
+export declare const COOKIE_PAIR_SEPARATOR = ";";
+/** Between a cookie's attributes in a Set-Cookie header. */
+export declare const COOKIE_ATTRIBUTE_SEPARATOR = "; ";
+export declare const COOKIE_NAME_VALUE_SEPARATOR = "=";
+/** Response fields holding the refresh token; moved into the cookie when cookie mode is on. */
+export declare const REFRESH_TOKEN_RESPONSE_FIELD = "refreshToken";
+/** Response field saying the refresh token is in the cookie instead of the body. */
+export declare const REFRESH_TOKEN_IN_COOKIE_FIELD = "refreshTokenInCookie";
+/** Response field with the refresh token's expiry time (sets the cookie's lifetime). */
+export declare const REFRESH_TOKEN_EXPIRES_AT_RESPONSE_FIELD = "refreshTokenExpiresAt";
+export declare const HEALTH_STATUS: {
+    readonly ok: "ok";
+    readonly error: "error";
+    readonly notUsed: "not_used";
+};
+export type HealthStatus = (typeof HEALTH_STATUS)[keyof typeof HEALTH_STATUS];
+/** A health check that takes longer than this counts as failed. */
+export declare const HEALTH_CHECK_TIMEOUT_MS = 2000;
+/** The cheapest query that proves PostgreSQL answers. */
+export declare const HEALTH_CHECK_QUERY = "SELECT 1";
+export declare const HEALTH_SERVICE_UNAVAILABLE_STATUS = 503;
+/** Most audit-log entries included in "download my data" (newest first). */
+export declare const DATA_EXPORT_AUDIT_LOG_LIMIT = 1000;
+/** Window of the admin stats endpoint ("sign-ins in the last 24 hours"). */
+export declare const ADMIN_STATS_WINDOW_SECONDS: number;