najm-auth 3.2.0 → 3.3.0

package/README.md

@@ -129,9 +129,10 @@ auth({
   database?: string                        // Default: 'default'
   blacklistPrefix?: string                 // Default: 'auth:blacklist:'
 
-  // Registration
-  defaultRole?: string | null              // Auto-assign role to new users
-  bcryptRounds?: number                    // Default: 10 (valid: 4-31)
+  // Registration
+  defaultRole?: string | null              // Auto-assign role to new users
+  publicRegistration?: boolean             // Default: true; mounts POST /auth/register
+  bcryptRounds?: number                    // Default: 10 (valid: 4-31)
 
   // Frontend
   frontendUrl?: string                     // Password reset link base URL
@@ -181,7 +182,7 @@ All routes are prefixed with `/auth` and auto-registered by the plugin.
 
 | Method | Path | Description | Auth |
 |--------|------|-------------|------|
-| `POST` | `/auth/register` | Register new user | None |
+| `POST` | `/auth/register` | Register new user (omitted when `publicRegistration: false`) | None |
 | `POST` | `/auth/login` | Login with email/password | None |
 | `POST` | `/auth/refresh` | Refresh access token (cookie) | None (uses refresh cookie) |
 | `POST` | `/auth/session/recover` | Reissue signed session without token rotation | Refresh cookie + recovery header |
@@ -194,7 +195,12 @@ All routes are prefixed with `/auth` and auto-registered by the plugin.
 | `POST` | `/auth/oauth/google/link` | Link Google to the current user | ✅ Required |
 | `GET` | `/auth/credential-setup/setup` | Read the pending setup session | Setup cookie |
 | `POST` | `/auth/credential-setup/change` | Replace the temporary credential | Setup cookie |
-| `POST` | `/auth/credential-setup/cancel` | Abandon the setup session | Setup cookie |
+| `POST` | `/auth/credential-setup/cancel` | Abandon the setup session | Setup cookie |
+
+Applications with an approval-owned onboarding flow should set
+`publicRegistration: false`. This removes the unauthenticated route while
+retaining `AuthService.registerUser()`, `provisionUser()`, and other internal
+account-management APIs for trusted application services.
 
 ### Identity presets
 

package/dist/client/react/index.d.ts

@@ -1,4 +1,3 @@
-import * as react_jsx_runtime from 'react/jsx-runtime';
 import * as react from 'react';
 import { ReactNode, CSSProperties, ReactElement } from 'react';
 import { N as NajmAuthClient, H as HydrateSession } from '../../NajmAuthClient-ZtXTIUSF.js';
@@ -20,7 +19,7 @@ interface AuthProviderProps {
      */
     autoRefresh?: boolean;
 }
-declare function AuthProvider({ client, children, initialSession, autoRefresh, }: AuthProviderProps): react_jsx_runtime.JSX.Element;
+declare function AuthProvider({ client, children, initialSession, autoRefresh, }: AuthProviderProps): react.JSX.Element;
 
 interface AuthBoundaryProps {
     children: ReactNode;
@@ -28,7 +27,7 @@ interface AuthBoundaryProps {
     /** Only gate while we truly have no identity; default false. */
     requireToken?: boolean;
 }
-declare function AuthBoundary({ children, fallback, requireToken, }: AuthBoundaryProps): react_jsx_runtime.JSX.Element;
+declare function AuthBoundary({ children, fallback, requireToken, }: AuthBoundaryProps): react.JSX.Element;
 
 declare function useAuthClient(): NajmAuthClient;
 
@@ -240,7 +239,7 @@ interface SignedInProps {
  * </SignedIn>
  * ```
  */
-declare function SignedIn({ children }: SignedInProps): react_jsx_runtime.JSX.Element;
+declare function SignedIn({ children }: SignedInProps): react.JSX.Element;
 
 interface SignedOutProps {
     children: ReactNode;
@@ -256,7 +255,7 @@ interface SignedOutProps {
  * </SignedOut>
  * ```
  */
-declare function SignedOut({ children }: SignedOutProps): react_jsx_runtime.JSX.Element;
+declare function SignedOut({ children }: SignedOutProps): react.JSX.Element;
 
 interface AuthLoadingProps {
     children: ReactNode;
@@ -274,7 +273,7 @@ interface AuthLoadingProps {
  * <SignedOut>...</SignedOut>
  * ```
  */
-declare function AuthLoading({ children }: AuthLoadingProps): react_jsx_runtime.JSX.Element;
+declare function AuthLoading({ children }: AuthLoadingProps): react.JSX.Element;
 
 interface CanProps {
     /** Required permission (e.g., 'read:posts') */
@@ -300,7 +299,7 @@ interface CanProps {
  * </Can>
  * ```
  */
-declare function Can({ permission, role, children, fallback }: CanProps): react_jsx_runtime.JSX.Element;
+declare function Can({ permission, role, children, fallback }: CanProps): react.JSX.Element;
 
 interface RoleProps {
     /** Required role name */
@@ -324,7 +323,7 @@ interface RoleProps {
  * </Role>
  * ```
  */
-declare function Role(props: RoleProps): react_jsx_runtime.JSX.Element;
+declare function Role(props: RoleProps): react.JSX.Element;
 
 interface IfAuthProps {
     /** Render when authenticated — receives user */
@@ -346,7 +345,7 @@ interface IfAuthProps {
  * />
  * ```
  */
-declare function IfAuth({ authenticated, unauthenticated, loading }: IfAuthProps): react_jsx_runtime.JSX.Element;
+declare function IfAuth({ authenticated, unauthenticated, loading }: IfAuthProps): react.JSX.Element;
 
 interface ProtectedProps {
     children: ReactNode;
@@ -377,7 +376,7 @@ interface ProtectedProps {
  * </Protected>
  * ```
  */
-declare function Protected({ children, redirectTo, onUnauthenticated, role, permission, loadingFallback, fallback, }: ProtectedProps): react_jsx_runtime.JSX.Element;
+declare function Protected({ children, redirectTo, onUnauthenticated, role, permission, loadingFallback, fallback, }: ProtectedProps): react.JSX.Element;
 
 interface AuthGateProps {
     children: ReactNode;
@@ -407,7 +406,7 @@ interface AuthGateProps {
  * **Without SSR hydration** (client-side nav, hard reload without initialSession):
  * Shows `loader` while attempting a token refresh, then either opens or redirects.
  */
-declare function AuthGate({ children, loader, redirectTo, onUnauthenticated, role, permission, denied, }: AuthGateProps): react_jsx_runtime.JSX.Element;
+declare function AuthGate({ children, loader, redirectTo, onUnauthenticated, role, permission, denied, }: AuthGateProps): react.JSX.Element;
 
 interface UserNameProps {
     /** Optional fallback shown when no user is loaded */
@@ -422,7 +421,7 @@ interface UserNameProps {
  * <span>Hi, <UserName fallback="guest" />!</span>
  * ```
  */
-declare function UserName({ fallback }: UserNameProps): react_jsx_runtime.JSX.Element;
+declare function UserName({ fallback }: UserNameProps): react.JSX.Element;
 
 interface UserEmailProps {
     fallback?: string;
@@ -435,7 +434,7 @@ interface UserEmailProps {
  * <p>Email: <UserEmail fallback="Not available" /></p>
  * ```
  */
-declare function UserEmail({ fallback }: UserEmailProps): react_jsx_runtime.JSX.Element;
+declare function UserEmail({ fallback }: UserEmailProps): react.JSX.Element;
 
 interface UserRoleProps {
     fallback?: string;
@@ -448,7 +447,7 @@ interface UserRoleProps {
  * <span>Role: <UserRole fallback="none" /></span>
  * ```
  */
-declare function UserRole({ fallback }: UserRoleProps): react_jsx_runtime.JSX.Element;
+declare function UserRole({ fallback }: UserRoleProps): react.JSX.Element;
 
 interface UserAvatarProps {
     /** Pixel size of the avatar (default: 32) */
@@ -474,7 +473,7 @@ interface UserAvatarProps {
  * <UserAvatar className="my-avatar" />
  * ```
  */
-declare function UserAvatar({ size, className, style, alt }: UserAvatarProps): react_jsx_runtime.JSX.Element;
+declare function UserAvatar({ size, className, style, alt }: UserAvatarProps): react.JSX.Element;
 
 interface PermissionListProps {
     /** Render function for each permission */
@@ -492,7 +491,7 @@ interface PermissionListProps {
  * </PermissionList>
  * ```
  */
-declare function PermissionList({ children, fallback }: PermissionListProps): react_jsx_runtime.JSX.Element;
+declare function PermissionList({ children, fallback }: PermissionListProps): react.JSX.Element;
 
 interface SignOutButtonProps {
     /** A single clickable child element. Its `onClick` will be wired to logout. */
@@ -579,6 +578,6 @@ interface OAuthCallbackProps {
     }) => ReactNode);
     defaultRedirect?: string;
 }
-declare function OAuthCallback({ fallback, errorFallback, defaultRedirect, }: OAuthCallbackProps): react_jsx_runtime.JSX.Element;
+declare function OAuthCallback({ fallback, errorFallback, defaultRedirect, }: OAuthCallbackProps): react.JSX.Element;
 
 export { AuthBoundary, type AuthEventEntry, AuthGate, AuthLoading, AuthProvider, Can, GoogleLoginButton, IfAuth, LoginButton, OAuthCallback, PermissionList, Protected, RedirectToLogin, Role, type SessionStatus, SignOutButton, SignedIn, SignedOut, UserAvatar, UserEmail, UserName, UserRole, useAuth, useAuthClient, useAuthEvent, useAuthEvents, useChangePassword, useForgotPassword, useGoogleLogin, useLogin, useLogout, useOAuthCallback, usePermissions, useRegister, useResetPassword, useSession, useUser };

package/dist/index.d.ts

@@ -1,7 +1,8 @@
 import * as najm_core from 'najm-core';
 import { Container } from 'najm-core';
 import { ValidationPluginConfig } from 'najm-validation';
-import { RateLimitPluginConfig, TimeWindow } from 'najm-rate';
+import { RateLimitPluginConfig, RateLimitKeyContext, TimeWindow } from 'najm-rate';
+import { CachePluginConfig, CacheService } from 'najm-cache';
 import { EmailPluginConfig, EmailService } from 'najm-email';
 import { R as ResolvedIdentityConfig, I as IdentityConfig, T as TemporaryCredentialInput } from './ma-sNHnUGLO.js';
 export { D as DEFAULT_IDENTITY_PRESET, E as EXACT_TEMPORARY_CREDENTIAL_KIND, a as IDENTITY_PRESETS, b as IdentityNormalizer, c as IdentityPreset, d as IdentityPresetName, M as MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND, e as TemporaryCredential, f as TemporaryCredentialKind, g as compactPhone, i as isMoroccanCin, h as isTemporaryCredentialKind, m as moroccanCinTemporaryCredential, j as moroccoIdentityPreset, n as normalizeMoroccanCin, k as normalizeMoroccanPhone, l as normalizeTunisianPhone, r as resolveTemporaryCredentialKind, t as toTemporaryCredential, o as tunisiaIdentityPreset } from './ma-sNHnUGLO.js';
@@ -10,7 +11,6 @@ import { I18nService } from 'najm-i18n';
 import { TDb, SeedEntry } from 'najm-database';
 import { User, NewUser, RoleEntity, NewRoleEntity, Permission, NewPermission, RolePermission } from './schema/pg.js';
 export { CredentialSetupRequirement, CredentialSetupSession, NewCredentialSetupRequirement, NewCredentialSetupSession, NewOAuthAccount, NewRolePermission, NewToken, OAuthAccount, Token, authSchema, baseFields, credentialSetupRequirementsTable, credentialSetupSessionsTable, oauthAccountsTable, permissionsTable, rolePermissionsTable, rolesTable, tokenStatusEnum, tokenTypeEnum, tokensTable, userStatusEnum, usersTable } from './schema/pg.js';
-import { CacheService } from 'najm-cache';
 import { CookieService } from 'najm-cookies';
 import { Context } from 'hono';
 import { GuardResult } from 'najm-guard';
@@ -169,6 +169,8 @@ interface AuthConfig {
     frontendUrl: string;
     /** Registration mode: 'active' auto-activates, 'pending' requires admin approval (default: 'active') */
     registrationMode: 'active' | 'pending';
+    /** Whether the unauthenticated POST /auth/register route is mounted. */
+    publicRegistration: boolean;
     /** When true, users with emailVerified=false are blocked from logging in (default: false) */
     requireVerifiedEmail: boolean;
     /** Cookie path for the refresh token. Scope to the refresh endpoint to limit exposure (default: '/') */
@@ -234,6 +236,13 @@ type AuthPluginConfig = {
     frontendUrl?: string;
     /** Registration mode: 'active' auto-activates new users, 'pending' requires admin approval (default: 'active') */
     registrationMode?: 'active' | 'pending';
+    /**
+     * Mount the unauthenticated POST /auth/register route (default: true for
+     * backwards compatibility). Set false when onboarding belongs to an
+     * application-owned approval flow. Internal AuthService provisioning stays
+     * available.
+     */
+    publicRegistration?: boolean;
     /** Block login for users whose email is not verified (default: false) */
     requireVerifiedEmail?: boolean;
     /** Cookie path for the refresh token (default: '/'). Set e.g. '/auth' to keep it off unrelated routes. */
@@ -260,6 +269,15 @@ type AuthPluginConfig = {
     validation?: ValidationPluginConfig;
     /** Optional config forwarded to rateLimit() dependency */
     rateLimit?: RateLimitPluginConfig;
+    /**
+     * Optional config forwarded to the package-owned cache() dependency.
+     *
+     * Auth registers cache() itself, so a consumer cannot configure the store by
+     * registering its own plugin first. Pass it here to select a shared, durable
+     * backend — required in production wherever the cache backs rate limiting,
+     * since a per-process memory bucket resets on every restart.
+     */
+    cache?: CachePluginConfig;
     /** Email transport used by password reset and verification flows. */
     email?: EmailPluginConfig;
     /** AES-256-GCM key for reversible encryption (e.g. API keys). Falls back to NAJM_ENCRYPTION_KEY env var. */
@@ -1644,15 +1662,17 @@ declare class AuthService {
 }
 
 /**
- * Composite key: IP + hashed normalized login/registration identity.
- * Buckets rate limits per IP+credential combo so different users
- * on the same IP (e.g. localhost, NAT) don't share a single bucket.
+ * Composite key: resolved client address + hashed normalized identity.
+ * Buckets rate limits per client+credential combo so different users
+ * on the same address (e.g. localhost, NAT) don't share a single bucket.
+ *
+ * The address arrives already resolved through the configured trusted-proxy
+ * boundary; this module must never parse forwarding headers itself.
  */
-declare const authIdentityRateLimitKey: (ctx: Context) => Promise<string>;
+declare const authIdentityRateLimitKey: (ctx: Context, keyContext?: RateLimitKeyContext) => Promise<string>;
 declare class AuthController {
     private authService;
     constructor(authService: AuthService);
-    registerUser(body: RegisterDto): Promise<SanitizedUser>;
     loginUser(body: LoginDto): Promise<LoginResult>;
     inviteUser(body: InviteUserDto): Promise<Omit<{
         password: string;
@@ -1772,6 +1792,17 @@ declare class AuthIdentityContextService {
     configure(): Promise<void>;
 }
 
+/**
+ * Public self-registration is isolated from the rest of the auth transport so
+ * applications can omit this controller without disabling internal account
+ * provisioning through AuthService.
+ */
+declare class RegistrationController {
+    private authService;
+    constructor(authService: AuthService);
+    registerUser(body: RegisterDto): Promise<SanitizedUser>;
+}
+
 type IdentityResolver = (value: unknown) => string | null;
 /**
  * Build the identifier pipeline used by login lookup, lockout accounting, and
@@ -1811,7 +1842,10 @@ interface RunAsUser {
 }
 declare function runAsUser<T>(container: Container, user: RunAsUser, fn: () => Promise<T> | T): Promise<T>;
 
-declare const AUTH_MODULE: readonly [typeof AuthService, typeof AuthSessionService, typeof CookieManager, typeof EncryptionService, typeof AuthGuard, typeof AuthController, typeof AuthResolver, typeof AuthIdentityContextService];
+declare const AUTH_CORE_MODULE: readonly [typeof AuthService, typeof AuthSessionService, typeof CookieManager, typeof EncryptionService, typeof AuthGuard, typeof AuthController, typeof AuthResolver, typeof AuthIdentityContextService];
+declare const PUBLIC_REGISTRATION_MODULE: readonly [typeof RegistrationController];
+/** Full module retained for consumers that register the exported module directly. */
+declare const AUTH_MODULE: readonly [typeof AuthService, typeof AuthSessionService, typeof CookieManager, typeof EncryptionService, typeof AuthGuard, typeof AuthController, typeof AuthResolver, typeof AuthIdentityContextService, typeof RegistrationController];
 
 declare class PermissionRepository {
     db: TDb;
@@ -2765,4 +2799,4 @@ declare const authSeed: (config: AuthSeedConfig) => Record<string, SeedEntry>;
  */
 declare function seedAuthData(config: SeedAuthDataConfig): Promise<SeedAuthDataResult>;
 
-export { AUTH_CONFIG, en as AUTH_EN, AUTH_LOCALES, AUTH_LOGIN_RATE_LIMIT_ENV, AUTH_MODULE, AUTH_PERMISSIONS, AUTH_ROLE, AUTH_SCHEMA, AUTH_SUPPORTED_LANGUAGES, AUTH_USER, type AssignPermissionDto, type AssignRoleDto, type AssignRoleParams, type AuthConfig, AuthController, AuthGuard, type AuthLoginRateLimitConfig, type AuthPluginConfig, AuthQueries, type AuthRateLimitEnvironment, AuthResolver, type AuthSchema, type AuthSeedConfig, AuthService, AuthSessionService, type AuthUser, CREDENTIAL_SETUP_CODES, CREDENTIAL_SETUP_MODULE, Can, CanCreate, CanDelete, CanList, CanRead, CanUpdate, type ChainableGuard, type ChangePasswordDto, type CheckPermissionDto, type ConfiguredOwnership, type ConfirmResetPasswordDto, CookieManager, type CreatePermissionDto, type CreateRoleDto, type CreateTokenDto, type CreateUserDto, type CredentialSetupChangeDto, type CredentialSetupCode, type CredentialSetupConfig, CredentialSetupController, type CredentialSetupOptions, type CredentialSetupPasswordOptions, type CredentialSetupPending, CredentialSetupRepository, CredentialSetupRequirementRepository, type CredentialSetupRequirementRow, CredentialSetupRequirementService, CredentialSetupService, type CredentialSetupSessionInfo, type CredentialSetupStarted, DEFAULT_AUTH_LOGIN_RATE_LIMIT, DEFAULT_CREDENTIAL_SETUP_COOKIE_NAME, DEFAULT_CREDENTIAL_SETUP_TTL_MS, type DefineRolesOptions, type EmailParam, EncryptionService, type GoogleOAuthConfig, IdentityConfig, type IdentityResolver, type InviteUserDto, type JwtConfig, type JwtPayload, type LanguageParam, type LoginDto, type LoginResult, NewPermission, NewRoleEntity, NewUser, type OAuthConfig, type OAuthProvider, Owned, type OwnedMethods, type OwnershipConfig, type OwnershipProvider, type OwnershipRule, OwnershipToken, type OwnershipTokenOptions, PASSWORD_SETUP_PURPOSE, PasswordSetupService, Permission, PermissionController, PermissionGuard, type PermissionIdParam, PermissionRepository, PermissionService, PermissionValidator, Policy, type ProvisionUserInput, type ProvisionUserWithPasswordInput, type ProvisionUserWithSetupInput, ROLES, ROLE_GROUPS, type RefreshTokenDto, type RegisterDto, type ResetPasswordDto, type ResolvedCredentialSetupConfig, ResolvedIdentityConfig, type ResourceAccessor, type ResourceGuards, type ResourceGuardsOptions, type RevokeTokenDto, Role, RoleController, RoleEntity, RoleGuard, type RoleIdParam, type RoleInput, RolePermission, RoleRepository, RoleService, type RoleType, RoleValidator, type RunAsUser, type SanitizedUser, ScopeContext, type ScopeResult, type SeedAuthDataConfig, type SeedAuthDataResult, type SeedUserConfig, type SessionCookieData, TOKEN_STATUS, TOKEN_TYPE, TemporaryCredentialInput, type TokenIdParam, type TokenPair, TokenRepository, TokenService, USER_STATUS, type UpdatePermissionDto, type UpdateRoleDto, type UpdateTokenDto, type UpdateUserDto, User, UserController, type UserIdInParam, type UserIdParam, type UserListQuery, UserRepository, UserService, UserValidator, type UserWithPermissions, type VerifyTokenDto, assignPermissionDto, assignRoleDto, assignRoleParams, auth$1 as auth, authIdentityRateLimitKey, authSeed, avatarsPath, calculateAge, calculateYearsOfExperience, changePasswordDto, checkPermissionDto, clean, configureOwnership, confirmResetPasswordDto, createIdentityResolver, createPermissionDto, createRoleDto, createTokenDto, createUserDto, credentialSetupChangeDto, credentialSetupError, defaultCredentialSetupPasswordSchema, defineRoles, emailParam, formatDate, getAuthLocale, getAvatarFile, inviteUserDto, isAdmin, isAdministrator, isAuth, isEmailIdentifier, isEmpty, isFile, isPath, join, languageParam, loginDto, normalizeAuthIdentifier, normalizeSetupPurpose, own, parseSchema, permissionIdParam, pickProps, refreshTokenDto, registerDto, resetPasswordDto, resolveAuthLoginRateLimitConfig, revokeTokenDto, roleIdParam, runAsUser, seedAuthData, tokenIdParam, updatePermissionDto, updateRoleDto, updateTokenDto, updateUserDto, userIdInParam, userIdParam, userListQuery, verifyTokenDto, where };
+export { AUTH_CONFIG, AUTH_CORE_MODULE, en as AUTH_EN, AUTH_LOCALES, AUTH_LOGIN_RATE_LIMIT_ENV, AUTH_MODULE, AUTH_PERMISSIONS, AUTH_ROLE, AUTH_SCHEMA, AUTH_SUPPORTED_LANGUAGES, AUTH_USER, type AssignPermissionDto, type AssignRoleDto, type AssignRoleParams, type AuthConfig, AuthController, AuthGuard, type AuthLoginRateLimitConfig, type AuthPluginConfig, AuthQueries, type AuthRateLimitEnvironment, AuthResolver, type AuthSchema, type AuthSeedConfig, AuthService, AuthSessionService, type AuthUser, CREDENTIAL_SETUP_CODES, CREDENTIAL_SETUP_MODULE, Can, CanCreate, CanDelete, CanList, CanRead, CanUpdate, type ChainableGuard, type ChangePasswordDto, type CheckPermissionDto, type ConfiguredOwnership, type ConfirmResetPasswordDto, CookieManager, type CreatePermissionDto, type CreateRoleDto, type CreateTokenDto, type CreateUserDto, type CredentialSetupChangeDto, type CredentialSetupCode, type CredentialSetupConfig, CredentialSetupController, type CredentialSetupOptions, type CredentialSetupPasswordOptions, type CredentialSetupPending, CredentialSetupRepository, CredentialSetupRequirementRepository, type CredentialSetupRequirementRow, CredentialSetupRequirementService, CredentialSetupService, type CredentialSetupSessionInfo, type CredentialSetupStarted, DEFAULT_AUTH_LOGIN_RATE_LIMIT, DEFAULT_CREDENTIAL_SETUP_COOKIE_NAME, DEFAULT_CREDENTIAL_SETUP_TTL_MS, type DefineRolesOptions, type EmailParam, EncryptionService, type GoogleOAuthConfig, IdentityConfig, type IdentityResolver, type InviteUserDto, type JwtConfig, type JwtPayload, type LanguageParam, type LoginDto, type LoginResult, NewPermission, NewRoleEntity, NewUser, type OAuthConfig, type OAuthProvider, Owned, type OwnedMethods, type OwnershipConfig, type OwnershipProvider, type OwnershipRule, OwnershipToken, type OwnershipTokenOptions, PASSWORD_SETUP_PURPOSE, PUBLIC_REGISTRATION_MODULE, PasswordSetupService, Permission, PermissionController, PermissionGuard, type PermissionIdParam, PermissionRepository, PermissionService, PermissionValidator, Policy, type ProvisionUserInput, type ProvisionUserWithPasswordInput, type ProvisionUserWithSetupInput, ROLES, ROLE_GROUPS, type RefreshTokenDto, type RegisterDto, RegistrationController, type ResetPasswordDto, type ResolvedCredentialSetupConfig, ResolvedIdentityConfig, type ResourceAccessor, type ResourceGuards, type ResourceGuardsOptions, type RevokeTokenDto, Role, RoleController, RoleEntity, RoleGuard, type RoleIdParam, type RoleInput, RolePermission, RoleRepository, RoleService, type RoleType, RoleValidator, type RunAsUser, type SanitizedUser, ScopeContext, type ScopeResult, type SeedAuthDataConfig, type SeedAuthDataResult, type SeedUserConfig, type SessionCookieData, TOKEN_STATUS, TOKEN_TYPE, TemporaryCredentialInput, type TokenIdParam, type TokenPair, TokenRepository, TokenService, USER_STATUS, type UpdatePermissionDto, type UpdateRoleDto, type UpdateTokenDto, type UpdateUserDto, User, UserController, type UserIdInParam, type UserIdParam, type UserListQuery, UserRepository, UserService, UserValidator, type UserWithPermissions, type VerifyTokenDto, assignPermissionDto, assignRoleDto, assignRoleParams, auth$1 as auth, authIdentityRateLimitKey, authSeed, avatarsPath, calculateAge, calculateYearsOfExperience, changePasswordDto, checkPermissionDto, clean, configureOwnership, confirmResetPasswordDto, createIdentityResolver, createPermissionDto, createRoleDto, createTokenDto, createUserDto, credentialSetupChangeDto, credentialSetupError, defaultCredentialSetupPasswordSchema, defineRoles, emailParam, formatDate, getAuthLocale, getAvatarFile, inviteUserDto, isAdmin, isAdministrator, isAuth, isEmailIdentifier, isEmpty, isFile, isPath, join, languageParam, loginDto, normalizeAuthIdentifier, normalizeSetupPurpose, own, parseSchema, permissionIdParam, pickProps, refreshTokenDto, registerDto, resetPasswordDto, resolveAuthLoginRateLimitConfig, revokeTokenDto, roleIdParam, runAsUser, seedAuthData, tokenIdParam, updatePermissionDto, updateRoleDto, updateTokenDto, updateUserDto, userIdInParam, userIdParam, userListQuery, verifyTokenDto, where };