import { Alepha, AlephaError, Page, PageQuery, Primitive, SchemaValidator, Static, StaticEncode, TNull, TObject, TOptional, TSchema, TUnion } from "alepha";
import { CryptoProvider, IssuerPrimitive, IssuerPrimitiveOptions, SecurityProvider, SigningConfig, UserAccount } from "alepha/security";
import { Page as Page$1, Repository } from "alepha/orm";
import { VerificationController, VerificationService } from "alepha/api/verifications";
import { CaptchaProvider } from "alepha/captcha";
import { OAuth2Profile, ServerAuthProvider, WithLinkFn, WithLoginFn } from "alepha/server/auth";
import { CacheProvider } from "alepha/cache";
import { DateTime, DateTimeProvider } from "alepha/datetime";
import { FileSystemProvider } from "alepha/system";
import { ParameterPrimitive } from "alepha/api/parameters";
import { BuildExtraConfigColumns, SQL, SQLWrapper } from "drizzle-orm";
import { LockConfig, LockStrength, PgColumn, PgColumnBuilderBase, PgDatabase, PgInsertValue, PgSelectBase, PgSequenceOptions, PgTableExtraConfigValue, PgTableWithColumns, PgTransaction, UpdateDeleteAction } from "drizzle-orm/pg-core";
import "drizzle-orm/pg-core/foreign-keys";
import { PgTransactionConfig } from "drizzle-orm/pg-core/session";
import { CryptoProvider as CryptoProvider$1 } from "alepha/crypto";
import * as DrizzleKit from "drizzle-kit/api";
import "drizzle-orm/d1";
import "drizzle-orm/sqlite-core";
import { FileController } from "alepha/api/files";
//#region ../../src/api/users/atoms/realmAuthSettingsAtom.d.ts
/**
 * Tri-state field requirement for realm auth settings.
 *
 * - `"none"`: Field is disabled and not shown.
 * - `"optional"`: Field is shown but not required.
 * - `"required"`: Field is shown and required.
 */
type FieldRequirement = "none" | "optional" | "required";
/**
 * Username-specific field requirement, extending {@link FieldRequirement}
 * with an additional auto-derivation mode.
 *
 * - `"none"` / `"optional"` / `"required"`: same as {@link FieldRequirement}.
 * - `"email"`: Field is hidden in the registration UI and the value is
 *   auto-derived from the user's email at signup. Same handling on
 *   credentials and OAuth flows. See `UsernameSlugger` for the rule and
 *   collision behavior.
 */
type UsernameFieldRequirement = FieldRequirement | "email";
declare const realmAuthSettingsAtom: import("alepha").Atom<import("zod").ZodObject<{
  displayName: import("zod").ZodOptional<import("zod").ZodString>;
  description: import("zod").ZodOptional<import("zod").ZodString>;
  logoUrl: import("zod").ZodOptional<import("zod").ZodString>;
  registrationAllowed: import("zod").ZodBoolean;
  email: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"none">, import("zod").ZodLiteral<"optional">, import("zod").ZodLiteral<"required">]>;
  username: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"none">, import("zod").ZodLiteral<"optional">, import("zod").ZodLiteral<"required">, import("zod").ZodLiteral<"email">]>;
  usernameRegExp: import("zod").ZodString;
  usernameBlocklist: import("zod").ZodArray<import("zod").ZodString>;
  phoneNumber: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"none">, import("zod").ZodLiteral<"optional">, import("zod").ZodLiteral<"required">]>;
  verifyEmailRequired: import("zod").ZodBoolean;
  verifyPhoneRequired: import("zod").ZodBoolean;
  firstNameLastName: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"none">, import("zod").ZodLiteral<"optional">, import("zod").ZodLiteral<"required">]>;
  resetPasswordAllowed: import("zod").ZodBoolean;
  captchaRequired: import("zod").ZodBoolean;
  adminEmails: import("zod").ZodArray<import("zod").ZodString>;
  adminUsernames: import("zod").ZodArray<import("zod").ZodString>;
  defaultRoles: import("zod").ZodArray<import("zod").ZodString>;
  verifyEmailUrl: import("zod").ZodOptional<import("zod").ZodString>;
  passwordPolicy: import("zod").ZodObject<{
    minLength: import("zod").ZodDefault<import("zod").ZodInt>;
    requireUppercase: import("zod").ZodBoolean;
    requireLowercase: import("zod").ZodBoolean;
    requireNumbers: import("zod").ZodBoolean;
    requireSpecialCharacters: import("zod").ZodBoolean;
  }, import("zod/v4/core").$strip>;
  loginRateLimit: import("zod").ZodObject<{
    ipMaxAttempts: import("zod").ZodDefault<import("zod").ZodInt>;
    accountMaxAttempts: import("zod").ZodDefault<import("zod").ZodInt>;
    windowMs: import("zod").ZodDefault<import("zod").ZodInt>;
  }, import("zod/v4/core").$strip>;
  registrationIpMaxAttempts: import("zod").ZodDefault<import("zod").ZodInt>;
  refreshToken: import("zod").ZodObject<{
    expirationIdle: import("zod").ZodOptional<import("zod").ZodInt>;
  }, import("zod/v4/core").$strip>;
}, import("zod/v4/core").$strip>, "alepha.api.users.realmAuthSettings">;
type RealmAuthSettings = Static<typeof realmAuthSettingsAtom.schema>;
//#endregion
//#region ../../src/api/users/audits/SessionAudits.d.ts
/**
 * Authentication & session-security audit events.
 *
 * Holds two audit types:
 * - `auth` — login / logout / token refresh / MFA.
 * - `security` — rate limiting, session invalidation, and related guards.
 *
 * Failed events are logged with `success: false`; severity (`warning`) is
 * derived centrally in `AuditService.create`. Register as a module variant
 * and log via the exposed primitives:
 * `sessionAudits(realm)?.auth.log("login", { success: false, … })`.
 */
declare class SessionAudits {
  readonly auth: import("alepha/api/audits").AuditPrimitive;
  readonly security: import("alepha/api/audits").AuditPrimitive;
}
//#endregion
//#region ../../src/api/users/audits/UserAudits.d.ts
/**
 * User-management audit events.
 *
 * Holds the `user` audit type. Mirrors the `$notification`/`$job` holder
 * pattern (see {@link UserNotifications}) — register as a module variant and
 * log via the exposed primitive: `userAudits(realm)?.user.log("create", …)`.
 */
declare class UserAudits {
  readonly user: import("alepha/api/audits").AuditPrimitive;
}
//#endregion
//#region ../../src/api/users/buckets/UserBuckets.d.ts
/**
 * User-specific file storage wrapper service.
 *
 * This service provides file storage for user-related files such as:
 * - User avatars/profile pictures
 *
 * Declared as a module variant — not auto-injected. It is instantiated
 * lazily the first time something calls `alepha.inject(UserBuckets)`.
 */
declare class UserBuckets {
  /**
   * Bucket for user avatar storage.
   */
  readonly avatars: import("alepha/bucket").BucketPrimitive;
}
//#endregion
//#region ../../src/orm/core/schemas/insertSchema.d.ts
/**
 * Transforms a TObject schema for insert operations.
 * All default properties at the root level are made optional.
 * Generated columns are excluded entirely.
 *
 * @example
 * Before: { name: string; age: number(default=0); fullName: generated }
 * After:  { name: string; age?: number; }
 */
type TObjectInsert<T extends TObject> = TObject<{ [K in keyof T["shape"] as T["shape"][K] extends {
  [PG_GENERATED]: any;
} ? never : K]: T["shape"][K] extends {
  [PG_DEFAULT]: any;
} | {
  [PG_ORGANIZATION]: any;
} ? TOptional<Extract<T["shape"][K], TSchema>> : T["shape"][K]; }>;
//#endregion
//#region ../../src/orm/core/schemas/updateSchema.d.ts
/**
 * Transforms a TObject schema for update operations.
 * All optional properties at the root level are made nullable (i.e., `T | null`).
 * Generated columns are excluded entirely.
 *
 * @example
 * Before: { name?: string; age: number; fullName: generated }
 * After:  { name?: string | null; age: number; }
 */
type TObjectUpdate<T extends TObject> = TObject<{ [K in keyof T["shape"] as T["shape"][K] extends {
  [PG_GENERATED]: any;
} ? never : K]: T["shape"][K] extends TOptional<infer U extends TSchema> ? TOptional<TUnion<[U, TNull]>> : T["shape"][K]; }>;
//#endregion
//#region ../../src/orm/core/primitives/$entity.d.ts
interface EntityPrimitiveOptions<T extends TObject, Keys = keyof Static<T>> {
  /**
   * The database table name that will be created for this entity.
   * If not provided, name will be inferred from the $repository variable name.
   */
  name: string;
  /**
   * TypeBox schema defining the table structure and column types.
   */
  schema: T;
  /**
   * Database indexes to create for query optimization.
   */
  indexes?: (Keys | {
    /**
     * Single column to index.
     */
    column: Keys;
    /**
     * Whether this should be a unique index (enforces uniqueness constraint).
     */
    unique?: boolean;
    /**
     * Custom name for the index. If not provided, generates name automatically.
     */
    name?: string;
    /**
     * Partial index condition. Only rows matching this SQL expression are indexed.
     */
    where?: SQL;
  } | {
    /**
     * Multiple columns for composite index (order matters for query optimization).
     */
    columns: Keys[];
    /**
     * Whether this should be a unique index (enforces uniqueness constraint).
     */
    unique?: boolean;
    /**
     * Custom name for the index. If not provided, generates name automatically.
     */
    name?: string;
    /**
     * Partial index condition. Only rows matching this SQL expression are indexed.
     */
    where?: SQL;
  } | {
    /**
     * SQL expressions for expression-based indexes.
     *
     * Can include column references and SQL functions like `LOWER()`, `UPPER()`, etc.
     * Columns and expressions can be mixed together.
     *
     * @example
     * ```ts
     * // Case-insensitive unique username per realm
     * indexes: [{
     *   expressions: (self) => [self.realm, sql`LOWER(${self.username})`],
     *   unique: true,
     *   name: "users_realm_username_lower_idx",
     * }]
     * ```
     */
    expressions: (self: Record<Keys & string, any>) => (SQL | any)[];
    /**
     * Whether this should be a unique index (enforces uniqueness constraint).
     */
    unique?: boolean;
    /**
     * Custom name for the index. If not provided, generates name automatically.
     */
    name: string;
    /**
     * Partial index condition. Only rows matching this SQL expression are indexed.
     */
    where?: SQL;
  })[];
  /**
   * Foreign key constraints to maintain referential integrity.
   */
  foreignKeys?: Array<{
    /**
     * Optional name for the foreign key constraint.
     */
    name?: string;
    /**
     * Local columns that reference the foreign table.
     */
    columns: Array<keyof Static<T>>;
    /**
     * Referenced columns in the foreign table.
     * Must be EntityColumn references from other entities.
     */
    foreignColumns: Array<() => EntityColumn<any>>;
  }>;
  /**
   * Additional table constraints for data validation.
   *
   * Constraints enforce business rules at the database level, providing
   * an additional layer of data integrity beyond application validation.
   *
   * **Constraint Types**:
   * - **Unique constraints**: Prevent duplicate values across columns
   * - **Check constraints**: Enforce custom validation rules with SQL expressions
   *
   * @example
   * ```ts
   * constraints: [
   *   {
   *     name: "unique_user_email",
   *     columns: ["email"],
   *     unique: true
   *   },
   *   {
   *     name: "valid_age_range",
   *     columns: ["age"],
   *     check: sql`age >= 0 AND age <= 150`
   *   },
   *   {
   *     name: "unique_user_username_per_tenant",
   *     columns: ["tenantId", "username"],
   *     unique: true
   *   }
   * ]
   * ```
   */
  constraints?: Array<{
    /**
     * Columns involved in this constraint.
     */
    columns: Array<keyof Static<T>>;
    /**
     * Optional name for the constraint.
     */
    name?: string;
    /**
     * Whether this is a unique constraint.
     */
    unique?: boolean | {};
    /**
     * SQL expression for check constraint validation.
     */
    check?: SQL;
  }>;
  /**
   * Advanced Drizzle ORM configuration for complex table setups.
   */
  config?: (self: BuildExtraConfigColumns<string, FromSchema<T>, "pg">) => PgTableExtraConfigValue[];
}
declare class EntityPrimitive<T extends TObject = TObject> {
  readonly options: EntityPrimitiveOptions<T>;
  constructor(options: EntityPrimitiveOptions<T>);
  alias(alias: string): this;
  get cols(): EntityColumns<T>;
  get name(): string;
  get schema(): T;
  protected _insertSchema?: TObjectInsert<T>;
  get insertSchema(): TObjectInsert<T>;
  protected _updateSchema?: TObjectUpdate<T>;
  get updateSchema(): TObjectUpdate<T>;
}
/**
 * Convert a schema to columns.
 */
type FromSchema<T extends TObject> = { [key in keyof T["properties"]]: PgColumnBuilderBase; };
type SchemaToTableConfig<T extends TObject> = {
  name: string;
  schema: string | undefined;
  columns: { [key in keyof T["properties"]]: PgColumn; };
  dialect: string;
};
type EntityColumn<T extends TObject> = {
  name: string;
  entity: EntityPrimitive<T>;
};
type EntityColumns<T extends TObject> = { [key in keyof T["properties"]]: EntityColumn<T>; };
//#endregion
//#region ../../src/orm/core/constants/PG_SYMBOLS.d.ts
declare const PG_DEFAULT: unique symbol;
declare const PG_PRIMARY_KEY: unique symbol;
declare const PG_CREATED_AT: unique symbol;
declare const PG_UPDATED_AT: unique symbol;
declare const PG_DELETED_AT: unique symbol;
declare const PG_VERSION: unique symbol;
declare const PG_IDENTITY: unique symbol;
declare const PG_ENUM: unique symbol;
declare const PG_REF: unique symbol;
declare const PG_GENERATED: unique symbol;
declare const PG_ORGANIZATION: unique symbol;
/**
 * @deprecated Use `PG_IDENTITY` instead.
 */
declare const PG_SERIAL: unique symbol;
type PgSymbols = {
  [PG_DEFAULT]: {};
  [PG_PRIMARY_KEY]: {};
  [PG_CREATED_AT]: {};
  [PG_UPDATED_AT]: {};
  [PG_DELETED_AT]: {};
  [PG_VERSION]: {};
  [PG_IDENTITY]: PgIdentityOptions;
  [PG_REF]: PgRefOptions;
  [PG_ENUM]: PgEnumOptions;
  [PG_GENERATED]: PgGeneratedOptions;
  [PG_ORGANIZATION]: PgOrganizationOptions;
  /**
   * @deprecated Use `PG_IDENTITY` instead.
   */
  [PG_SERIAL]: {};
};
type PgSymbolKeys = keyof PgSymbols;
interface PgOrganizationOptions {
  /**
   * Fail-closed tenant scoping. When `true`, the repository (a) refuses any
   * read/write with no resolved tenant instead of falling through to an
   * unfiltered "see/write everything" query, and (b) drops the
   * `OR organizationId IS NULL` "global row" escape — a scoped tenant never
   * sees NULL/global rows. Use for security-sensitive tables. Defaults to
   * `false` (the historic fail-open semantics).
   */
  strict?: boolean;
}
type PgIdentityOptions = {
  mode: "always" | "byDefault";
} & PgSequenceOptions & {
  name?: string;
};
interface PgEnumOptions {
  name?: string;
  description?: string;
}
interface PgGeneratedOptions {
  /**
   * SQL expression for the generated column.
   */
  expression: SQL;
  /**
   * Storage mode for the generated column.
   * - `"stored"` — value is computed on write and stored on disk (default for PostgreSQL).
   * - `"virtual"` — value is computed on read (default for SQLite).
   */
  mode?: "stored" | "virtual";
}
interface PgRefOptions {
  ref: () => {
    name: string;
    entity: EntityPrimitive;
  };
  actions?: {
    onUpdate?: UpdateDeleteAction;
    onDelete?: UpdateDeleteAction;
  };
}
//#endregion
//#region ../../src/orm/core/errors/DbError.d.ts
declare class DbError extends AlephaError {
  name: string;
  constructor(message: string, cause?: unknown);
}
//#endregion
//#region ../../src/orm/core/helpers/pgAttr.d.ts
/**
 * Type representation.
 */
type PgAttr<T extends TSchema, TAttr extends PgSymbolKeys> = T & { [K in TAttr]: PgSymbols[K]; };
interface PgAttrField {
  key: string;
  type: TSchema;
  data: any;
  nested?: any[];
  one?: boolean;
}
//#endregion
//#region ../../src/orm/core/interfaces/FilterOperators.d.ts
interface FilterOperators<TValue> {
  /**
   * Test that two values are equal.
   *
   * Remember that the SQL standard dictates that
   * two NULL values are not equal, so if you want to test
   * whether a value is null, you may want to use
   * `isNull` instead.
   *
   * ## Examples
   *
   * ```ts
   * // Select cars made by Ford
   * db.select().from(cars)
   *   .where(eq(cars.make, 'Ford'))
   * ```
   *
   * @see isNull for a way to test equality to NULL.
   */
  eq?: TValue;
  /**
   * Test that two values are not equal.
   *
   * Remember that the SQL standard dictates that
   * two NULL values are not equal, so if you want to test
   * whether a value is not null, you may want to use
   * `isNotNull` instead.
   *
   * ## Examples
   *
   * ```ts
   * // Select cars not made by Ford
   * db.select().from(cars)
   *   .where(ne(cars.make, 'Ford'))
   * ```
   *
   * @see isNotNull for a way to test whether a value is not null.
   */
  ne?: TValue;
  /**
   * Test that the first expression passed is greater than
   * the second expression.
   *
   * ## Examples
   *
   * ```ts
   * // Select cars made after 2000.
   * db.select().from(cars)
   *   .where(gt(cars.year, 2000))
   * ```
   *
   * @see gte for greater-than-or-equal
   */
  gt?: TValue;
  /**
   * Test that the first expression passed is greater than
   * or equal to the second expression. Use `gt` to
   * test whether an expression is strictly greater
   * than another.
   *
   * ## Examples
   *
   * ```ts
   * // Select cars made on or after 2000.
   * db.select().from(cars)
   *   .where(gte(cars.year, 2000))
   * ```
   *
   * @see gt for a strictly greater-than condition
   */
  gte?: TValue;
  /**
   * Test that the first expression passed is less than
   * the second expression.
   *
   * ## Examples
   *
   * ```ts
   * // Select cars made before 2000.
   * db.select().from(cars)
   *   .where(lt(cars.year, 2000))
   * ```
   *
   * @see lte for greater-than-or-equal
   */
  lt?: TValue;
  /**
   * Test that the first expression passed is less than
   * or equal to the second expression.
   *
   * ## Examples
   *
   * ```ts
   * // Select cars made before 2000.
   * db.select().from(cars)
   *   .where(lte(cars.year, 2000))
   * ```
   *
   * @see lt for a strictly less-than condition
   */
  lte?: TValue;
  /**
   * Test whether the first parameter, a column or expression,
   * has a value from a list passed as the second argument.
   *
   * ## Throws
   *
   * The argument passed in the second array can't be empty:
   * if an empty is provided, this method will throw.
   *
   * ## Examples
   *
   * ```ts
   * // Select cars made by Ford or GM.
   * db.select().from(cars)
   *   .where(inArray(cars.make, ['Ford', 'GM']))
   * ```
   *
   * @see notInArray for the inverse of this test
   */
  inArray?: TValue[];
  /**
   * Test whether the first parameter, a column or expression,
   * has a value that is not present in a list passed as the
   * second argument.
   *
   * ## Throws
   *
   * The argument passed in the second array can't be empty:
   * if an empty is provided, this method will throw.
   *
   * ## Examples
   *
   * ```ts
   * // Select cars made by any company except Ford or GM.
   * db.select().from(cars)
   *   .where(notInArray(cars.make, ['Ford', 'GM']))
   * ```
   *
   * @see inArray for the inverse of this test
   */
  notInArray?: TValue[];
  /**
   * Test whether an expression is not NULL. By the SQL standard,
   * NULL is neither equal nor not equal to itself, so
   * it's recommended to use `isNull` and `notIsNull` for
   * comparisons to NULL.
   *
   * ## Examples
   *
   * ```ts
   * // Select cars that have been discontinued.
   * db.select().from(cars)
   *   .where(isNotNull(cars.discontinuedAt))
   * ```
   *
   * @see isNull for the inverse of this test
   */
  isNotNull?: true;
  /**
   * Test whether an expression is NULL. By the SQL standard,
   * NULL is neither equal nor not equal to itself, so
   * it's recommended to use `isNull` and `notIsNull` for
   * comparisons to NULL.
   *
   * ## Examples
   *
   * ```ts
   * // Select cars that have no discontinuedAt date.
   * db.select().from(cars)
   *   .where(isNull(cars.discontinuedAt))
   * ```
   *
   * @see isNotNull for the inverse of this test
   */
  isNull?: true;
  /**
   * Test whether an expression is between two values. This
   * is an easier way to express range tests, which would be
   * expressed mathematically as `x <= a <= y` but in SQL
   * would have to be like `a >= x AND a <= y`.
   *
   * Between is inclusive of the endpoints: if `column`
   * is equal to `min` or `max`, it will be TRUE.
   *
   * ## Examples
   *
   * ```ts
   * // Select cars made between 1990 and 2000
   * db.select().from(cars)
   *   .where(between(cars.year, 1990, 2000))
   * ```
   *
   * @see notBetween for the inverse of this test
   */
  between?: [number, number];
  /**
   * Test whether an expression is not between two values.
   *
   * This, like `between`, includes its endpoints, so if
   * the `column` is equal to `min` or `max`, in this case
   * it will evaluate to FALSE.
   *
   * ## Examples
   *
   * ```ts
   * // Exclude cars made in the 1970s
   * db.select().from(cars)
   *   .where(notBetween(cars.year, 1970, 1979))
   * ```
   *
   * @see between for the inverse of this test
   */
  notBetween?: [number, number];
  /**
   * Compare a column to a pattern, which can include `%` and `_`
   * characters to match multiple variations. Including `%`
   * in the pattern matches zero or more characters, and including
   * `_` will match a single character.
   *
   * ## Examples
   *
   * ```ts
   * // Select all cars with 'Turbo' in their names.
   * db.select().from(cars)
   *   .where(like(cars.name, '%Turbo%'))
   * ```
   *
   * @see ilike for a case-insensitive version of this condition
   */
  like?: string;
  /**
   * The inverse of like - this tests that a given column
   * does not match a pattern, which can include `%` and `_`
   * characters to match multiple variations. Including `%`
   * in the pattern matches zero or more characters, and including
   * `_` will match a single character.
   *
   * ## Examples
   *
   * ```ts
   * // Select all cars that don't have "ROver" in their name.
   * db.select().from(cars)
   *   .where(notLike(cars.name, '%Rover%'))
   * ```
   *
   * @see like for the inverse condition
   * @see notIlike for a case-insensitive version of this condition
   */
  notLike?: string;
  /**
   * Case-insensitively compare a column to a pattern,
   * which can include `%` and `_`
   * characters to match multiple variations. Including `%`
   * in the pattern matches zero or more characters, and including
   * `_` will match a single character.
   *
   * Unlike like, this performs a case-insensitive comparison.
   *
   * ## Examples
   *
   * ```ts
   * // Select all cars with 'Turbo' in their names.
   * db.select().from(cars)
   *   .where(ilike(cars.name, '%Turbo%'))
   * ```
   *
   * @see like for a case-sensitive version of this condition
   */
  ilike?: string;
  /**
   * The inverse of ilike - this case-insensitively tests that a given column
   * does not match a pattern, which can include `%` and `_`
   * characters to match multiple variations. Including `%`
   * in the pattern matches zero or more characters, and including
   * `_` will match a single character.
   *
   * ## Examples
   *
   * ```ts
   * // Select all cars that don't have "Rover" in their name.
   * db.select().from(cars)
   *   .where(notLike(cars.name, '%Rover%'))
   * ```
   *
   * @see ilike for the inverse condition
   * @see notLike for a case-sensitive version of this condition
   */
  notIlike?: string;
  /**
   * Syntactic sugar for case-insensitive substring matching.
   * Automatically wraps the value with `%` wildcards on both sides.
   *
   * Equivalent to: `ilike: '%value%'`
   *
   * ## Examples
   *
   * ```ts
   * // Select all cars with "Turbo" anywhere in their name.
   * db.select().from(cars)
   *   .where({ name: { contains: 'Turbo' } })
   * // Same as: .where(ilike(cars.name, '%Turbo%'))
   * ```
   *
   * @see ilike for manual pattern matching
   * @see startsWith for prefix matching
   * @see endsWith for suffix matching
   */
  contains?: string;
  /**
   * Syntactic sugar for case-insensitive prefix matching.
   * Automatically appends a `%` wildcard to the end of the value.
   *
   * Equivalent to: `ilike: 'value%'`
   *
   * ## Examples
   *
   * ```ts
   * // Select all cars whose names start with "Ford".
   * db.select().from(cars)
   *   .where({ name: { startsWith: 'Ford' } })
   * // Same as: .where(ilike(cars.name, 'Ford%'))
   * ```
   *
   * @see ilike for manual pattern matching
   * @see contains for substring matching
   * @see endsWith for suffix matching
   */
  startsWith?: string;
  /**
   * Syntactic sugar for case-insensitive suffix matching.
   * Automatically prepends a `%` wildcard to the beginning of the value.
   *
   * Equivalent to: `ilike: '%value'`
   *
   * ## Examples
   *
   * ```ts
   * // Select all cars whose names end with "Turbo".
   * db.select().from(cars)
   *   .where({ name: { endsWith: 'Turbo' } })
   * // Same as: .where(ilike(cars.name, '%Turbo'))
   * ```
   *
   * @see ilike for manual pattern matching
   * @see contains for substring matching
   * @see startsWith for prefix matching
   */
  endsWith?: string;
  /**
   * Test that a column or expression contains all elements of
   * the list passed as the second argument.
   *
   * ## Throws
   *
   * The argument passed in the second array can't be empty:
   * if an empty is provided, this method will throw.
   *
   * ## Examples
   *
   * ```ts
   * // Select posts where its tags contain "Typescript" and "ORM".
   * db.select().from(posts)
   *   .where(arrayContains(posts.tags, ['Typescript', 'ORM']))
   * ```
   *
   * @see arrayContained to find if an array contains all elements of a column or expression
   * @see arrayOverlaps to find if a column or expression contains any elements of an array
   */
  arrayContains?: TValue;
  /**
   * Test that the list passed as the second argument contains
   * all elements of a column or expression.
   *
   * ## Throws
   *
   * The argument passed in the second array can't be empty:
   * if an empty is provided, this method will throw.
   *
   * ## Examples
   *
   * ```ts
   * // Select posts where its tags contain "Typescript", "ORM" or both,
   * // but filtering posts that have additional tags.
   * db.select().from(posts)
   *   .where(arrayContained(posts.tags, ['Typescript', 'ORM']))
   * ```
   *
   * @see arrayContains to find if a column or expression contains all elements of an array
   * @see arrayOverlaps to find if a column or expression contains any elements of an array
   */
  arrayContained?: TValue;
  /**
   * Test that a column or expression contains any elements of
   * the list passed as the second argument.
   *
   * ## Throws
   *
   * The argument passed in the second array can't be empty:
   * if an empty is provided, this method will throw.
   *
   * ## Examples
   *
   * ```ts
   * // Select posts where its tags contain "Typescript", "ORM" or both.
   * db.select().from(posts)
   *   .where(arrayOverlaps(posts.tags, ['Typescript', 'ORM']))
   * ```
   *
   * @see arrayContains to find if a column or expression contains all elements of an array
   * @see arrayContained to find if an array contains all elements of a column or expression
   */
  arrayOverlaps?: TValue;
}
//#endregion
//#region ../../src/orm/core/interfaces/PgQuery.d.ts
/**
 * Order direction for sorting
 */
type OrderDirection = "asc" | "desc";
/**
 * Single order by clause with column and direction
 */
interface OrderByClause<T> {
  column: keyof T;
  direction?: OrderDirection;
}
/**
 * Order by parameter - supports 3 modes:
 * 1. String: orderBy: "name" (defaults to ASC)
 * 2. Single object: orderBy: { column: "name", direction: "desc" }
 * 3. Array: orderBy: [{ column: "name", direction: "asc" }, { column: "age", direction: "desc" }]
 */
type OrderBy<T> = keyof T | OrderByClause<T> | Array<OrderByClause<T>>;
/**
 * Generic query interface for PostgreSQL entities
 */
interface PgQuery<T extends TObject = TObject> {
  distinct?: (keyof Static<T>)[];
  columns?: (keyof Static<T>)[];
  where?: PgQueryWhereOrSQL<T>;
  limit?: number;
  offset?: number;
  orderBy?: OrderBy<Static<T>>;
  groupBy?: (keyof Static<T>)[];
}
type PgStatic<T extends TObject, Relations extends PgRelationMap<T>> = Static<T> & { [K in keyof Relations]: Static<Relations[K]["join"]["schema"]> & (Relations[K]["with"] extends PgRelationMap<TObject> ? PgStatic<Relations[K]["join"]["schema"], Relations[K]["with"]> : {}); };
interface PgQueryRelations<T extends TObject = TObject, Relations extends PgRelationMap<T> | undefined = undefined> extends PgQuery<T> {
  with?: Relations;
  where?: PgQueryWhereOrSQL<T, Relations>;
}
type PgRelationMap<Base extends TObject> = Record<string, PgRelation<Base>>;
type PgRelation<Base extends TObject> = {
  type?: "left" | "inner" | "right";
  join: {
    schema: TObject;
    name: string;
  };
  on: SQLWrapper | readonly [keyof Static<Base>, {
    name: string;
  }];
  with?: PgRelationMap<TObject>;
};
//#endregion
//#region ../../src/orm/core/interfaces/PgQueryWhere.d.ts
type PgQueryWhere<T extends TObject, Relations extends PgRelationMap<TObject> | undefined = undefined> = (PgQueryWhereOperators<T> & PgQueryWhereConditions<T>) | (PgQueryWhereRelations<Relations> & PgQueryWhereOperators<T> & PgQueryWhereConditions<T, Relations>);
type PgQueryWhereOrSQL<T extends TObject, Relations extends PgRelationMap<TObject> | undefined = undefined> = SQLWrapper | PgQueryWhere<T, Relations>;
type PgQueryWhereOperators<T extends TObject> = { [Key in keyof Static<T>]?: FilterOperators<Static<T>[Key]> | Static<T>[Key]; };
type PgQueryWhereConditions<T extends TObject, Relations extends PgRelationMap<TObject> | undefined = undefined> = {
  /**
   * Combine a list of conditions with the `and` operator. Conditions
   * that are equal `undefined` are automatically ignored.
   *
   * ## Examples
   *
   * ```ts
   * db.select().from(cars)
   *   .where(
   *     and(
   *       eq(cars.make, 'Volvo'),
   *       eq(cars.year, 1950),
   *     )
   *   )
   * ```
   */
  and?: Array<PgQueryWhereOrSQL<T, Relations>>;
  /**
   * Combine a list of conditions with the `or` operator. Conditions
   * that are equal `undefined` are automatically ignored.
   *
   * ## Examples
   *
   * ```ts
   * db.select().from(cars)
   *   .where(
   *     or(
   *       eq(cars.make, 'GM'),
   *       eq(cars.make, 'Ford'),
   *     )
   *   )
   * ```
   */
  or?: Array<PgQueryWhereOrSQL<T, Relations>>;
  /**
   * Negate the meaning of an expression using the `not` keyword.
   *
   * ## Examples
   *
   * ```ts
   * // Select cars _not_ made by GM or Ford.
   * db.select().from(cars)
   *   .where(not(inArray(cars.make, ['GM', 'Ford'])))
   * ```
   */
  not?: PgQueryWhereOrSQL<T, Relations>;
  /**
   * Test whether a subquery evaluates to have any rows.
   *
   * ## Examples
   *
   * ```ts
   * // Users whose `homeCity` column has a match in a cities
   * // table.
   * db
   *   .select()
   *   .from(users)
   *   .where(
   *     exists(db.select()
   *       .from(cities)
   *       .where(eq(users.homeCity, cities.id))),
   *   );
   * ```
   *
   * @see notExists for the inverse of this test
   */
  exists?: SQLWrapper;
  /**
   * Test whether a subquery evaluates to have no rows.
   *
   * @see exists for the inverse of this test
   */
  notExists?: SQLWrapper;
};
type PgQueryWhereRelations<Relations extends PgRelationMap<TObject> | undefined = undefined> = Relations extends PgRelationMap<TObject> ? { [K in keyof Relations]?: PgQueryWhere<Relations[K]["join"]["schema"], Relations[K]["with"]>; } : {};
//#endregion
//#region ../../src/orm/core/interfaces/AggregateQuery.d.ts
type AggregateOp = "count" | "sum" | "avg" | "min" | "max";
/**
 * Select definition for aggregate queries.
 * - `true` means select the column value as-is (used for groupBy columns).
 * - `{ sum: true, avg: true, ... }` means compute those aggregations.
 */
type AggregateColumnSelect = true | Partial<Record<AggregateOp, true>>;
type AggregateSelect<T extends TObject> = { [K in keyof Static<T>]?: AggregateColumnSelect; };
/**
 * Maps a single column's select definition to its result type.
 * - `true` → original column type
 * - `{ sum: true, avg: true }` → `{ sum: number; avg: number }`
 */
type AggregateColumnResult<TValue, TSelect> = TSelect extends true ? TValue : { [Op in AggregateOp as TSelect extends Record<Op, true> ? Op : never]: number; };
/**
 * Result type for an aggregate query.
 */
type AggregateResult<T extends TObject, S extends AggregateSelect<T>> = { [K in keyof S & keyof Static<T>]: AggregateColumnResult<Static<T>[K], NonNullable<S[K]>>; };
/**
 * HAVING clause for aggregate queries.
 * Only applies to columns with aggregate operations (not `true`).
 */
type AggregateHaving<T extends TObject, S extends AggregateSelect<T>> = { [K in keyof S & keyof Static<T>]?: S[K] extends true ? never : { [Op in AggregateOp as S[K] extends Record<Op, true> ? Op : never]?: {
  gt?: number;
  gte?: number;
  lt?: number;
  lte?: number;
  eq?: number;
  ne?: number;
}; }; };
/**
 * Full aggregate query definition.
 */
interface AggregateQuery<T extends TObject, S extends AggregateSelect<T>> {
  /**
   * Columns and aggregate operations to select.
   */
  select: S;
  /**
   * WHERE clause to filter rows before aggregation.
   */
  where?: PgQueryWhereOrSQL<T>;
  /**
   * Columns to group by.
   */
  groupBy?: (keyof Static<T>)[];
  /**
   * HAVING clause to filter groups after aggregation.
   */
  having?: AggregateHaving<T, S>;
  /**
   * Order results. Supports dot notation for aggregate columns (e.g. "amount.sum").
   */
  orderBy?: string | {
    column: string;
    direction: "asc" | "desc";
  } | Array<{
    column: string;
    direction: "asc" | "desc";
  }>;
  /**
   * Limit the number of results.
   */
  limit?: number;
  /**
   * Offset for pagination.
   */
  offset?: number;
}
//#endregion
//#region ../../src/orm/core/providers/DbCacheProvider.d.ts
/**
 * Database query cache using a simple in-memory Map.
 *
 * Uses `{tableName}:{cacheKey}` as the storage key.
 * Provides per-table invalidation for write-through cache busting.
 *
 * This is intentionally self-contained (no external cache dependencies)
 * so the ORM module does not force `AlephaCache` on all consumers.
 */
declare class DbCacheProvider {
  protected readonly dateTime: DateTimeProvider;
  protected readonly store: Map<string, {
    value: unknown;
    expiresAt?: number;
  }>;
  protected storeKey(tableName: string, cacheKey: string): string;
  /**
   * Get a cached query result.
   */
  get<T>(tableName: string, cacheKey: string): Promise<T | undefined>;
  /**
   * Store a query result in the cache.
   */
  set<T>(tableName: string, cacheKey: string, value: T, ttl?: number): Promise<void>;
  /**
   * Invalidate all cached queries for a table.
   */
  invalidateTable(tableName: string): Promise<void>;
}
//#endregion
//#region ../../src/orm/core/providers/SequenceProvider.d.ts
/**
 * Portable, scoped numeric sequence provider — works identically on Postgres,
 * SQLite, and Cloudflare D1.
 *
 * Implementation: a single `alepha_sequences` table holds one row per
 * `(name, scope)` pair. Every call to {@link advance} runs an
 * `INSERT ... ON CONFLICT (name, scope) DO UPDATE SET value = value + step`
 * with `RETURNING value`, which is atomic on every supported driver:
 *
 * - **Postgres**: row-level lock on `ON CONFLICT DO UPDATE`.
 * - **SQLite / D1**: writes are serialized, atomic by construction.
 *
 * The repository pattern is the same one used by `DatabaseCacheProvider.incr()`
 * — see that file for the proof-of-design.
 *
 * Callers never instantiate this directly. They declare a {@link SequencePrimitive}
 * via `$sequence()` and call `.next(scope?)` on the primitive — this provider is
 * the engine behind that call.
 */
declare class SequenceProvider {
  protected readonly repository: Repository$1<import("zod").ZodObject<{
    id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
    createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
    updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
    name: import("zod").ZodString;
    scope: import("zod").ZodString;
    value: import("zod").ZodInt;
  }, import("zod/v4/core").$strip>>;
  protected readonly crypto: CryptoProvider$1;
  /**
   * Atomically advance the counter for `(name, scope)` and return the new value.
   *
   * If the row doesn't exist yet, it's inserted with `value = start` and that
   * value is returned. Subsequent calls increment by `step`.
   *
   * Scope defaults to "default" — pass any string to namespace per
   * tenant / campaign / parent entity / etc.
   */
  advance(name: string, scope?: string, opts?: {
    startWith?: number;
    incrementBy?: number;
  }): Promise<number>;
  /**
   * Read the current value without advancing it. Returns `null` if the
   * `(name, scope)` pair has never been advanced.
   */
  peek(name: string, scope?: string): Promise<number | null>;
  /**
   * Reset the counter for `(name, scope)` to an explicit value. Creates the row
   * if it doesn't exist.
   *
   * Mostly useful in tests and ops scripts — production code should rarely call
   * this, since it can produce duplicate IDs if anything still holds a previously
   * advanced value.
   */
  reset(name: string, scope: string | undefined, value: number): Promise<void>;
}
//#endregion
//#region ../../src/orm/core/primitives/$sequence.d.ts
interface SequencePrimitiveOptions {
  /**
   * Sequence name. Defaults to the primitive's property key. Two primitives
   * sharing the same name share the same counter table rows, which is rarely
   * what you want — prefer letting the property key drive the name.
   */
  name?: string;
  /**
   * Starting value used on the very first `.next()` for a `(name, scope)` pair.
   * Defaults to `1`.
   */
  startWith?: number;
  /**
   * Amount added on every call to `.next()`. Defaults to `1`.
   */
  incrementBy?: number;
}
declare class SequencePrimitive extends Primitive<SequencePrimitiveOptions> {
  protected readonly provider: SequenceProvider;
  get name(): string;
  /**
   * Atomically advance the counter and return the new value.
   *
   * Scope defaults to "default". Pass any string to keep an independent counter
   * per tenant / campaign / parent entity / etc.
   *
   * **Transaction semantics:** when called inside a `$transactional` block, the
   * increment participates in that transaction — commit advances the counter,
   * rollback unwinds it. This is intentionally different from PG-native
   * `nextval()` (which leaves gaps on rollback). It means a failed insert that
   * consumed a `shortId` returns the value to the pool instead of burning it.
   */
  next(scope?: string): Promise<number>;
  /**
   * Read the current value without advancing it. Returns `null` if the
   * `(name, scope)` pair has never been advanced.
   */
  current(scope?: string): Promise<number | null>;
  /**
   * Reset the counter for the given scope to an explicit value. Creates the row
   * if it doesn't exist. Mostly useful in tests and ops scripts.
   */
  reset(value: number, scope?: string): Promise<void>;
}
//#endregion
//#region ../../src/orm/core/services/ModelBuilder.d.ts
/**
 * Database-specific table configuration functions
 */
interface TableConfigBuilders<TConfig> {
  index: (name: string) => {
    on: (...columns: any[]) => TConfig;
  };
  uniqueIndex: (name: string) => {
    on: (...columns: any[]) => TConfig;
  };
  unique: (name: string) => {
    on: (...columns: any[]) => TConfig;
  };
  check: (name: string, sql: SQL) => TConfig;
  foreignKey: (config: {
    name: string;
    columns: any[];
    foreignColumns: any[];
  }) => TConfig;
}
/**
 * Abstract base class for transforming Alepha Primitives (Entity, Sequence, etc...)
 * into drizzle models (tables, enums, sequences, etc...).
 */
declare abstract class ModelBuilder {
  /**
   * Build a table from an entity primitive.
   */
  abstract buildTable(entity: EntityPrimitive, options: {
    tables: Map<string, unknown>;
    enums: Map<string, unknown>;
    schemas: Map<string, unknown>;
    schema: string;
  }): void;
  /**
   * Build a sequence from a sequence primitive.
   */
  abstract buildSequence(sequence: SequencePrimitive, options: {
    sequences: Map<string, unknown>;
    schema: string;
  }): void;
  /**
   * Convert camelCase to snake_case for column names.
   */
  protected toColumnName(str: string): string;
  /**
   * Build the table configuration function for any database.
   * This includes indexes, foreign keys, constraints, and custom config.
   *
   * @param entity - The entity primitive
   * @param builders - Database-specific builder functions
   * @param tableResolver - Function to resolve entity references to table columns
   * @param customConfigHandler - Optional handler for custom config
   */
  protected buildTableConfig<TConfig, TSelf>(entity: EntityPrimitive, builders: TableConfigBuilders<TConfig>, tableResolver?: (entityName: string) => any, customConfigHandler?: (config: any, self: TSelf) => TConfig[]): ((self: TSelf) => TConfig[]) | undefined;
}
//#endregion
//#region ../../src/orm/core/providers/DrizzleKitProvider.d.ts
declare class DrizzleKitProvider {
  protected readonly log: import("alepha/logger").Logger;
  protected readonly dateTime: DateTimeProvider;
  protected readonly alepha: Alepha;
  /**
   * Push-based synchronization using Drizzle Kit's introspection API.
   *
   * Reads the actual database state, diffs against current entity definitions,
   * and applies changes. No stored snapshots — no drift, no corruption.
   *
   * - SQLite: uses `pushSQLiteSchema` (requires sync driver — node:sqlite shim or bun-sqlite)
   * - PostgreSQL: uses `pushSchema` with schema filters
   *
   * Does nothing in production mode — use file-based migrations instead.
   */
  synchronize(provider: DatabaseProvider): Promise<void>;
  /**
   * Generate SQL migration statements by diffing two schema states.
   *
   * Used by tests (schema validation) and CLI (`alepha db migrations generate`).
   * Not part of the push sync flow.
   *
   * When `withoutSchema` is true, models are rebuilt without schema qualifiers
   * so the generated SQL is portable across different PostgreSQL schemas.
   */
  generateMigration(provider: DatabaseProvider, prevSnapshot?: any, options?: {
    withoutSchema?: boolean;
  }): Promise<{
    statements: string[];
    models: Record<string, unknown>;
    snapshot?: any;
  }>;
  /**
   * Load all tables, enums, sequences, etc. from the provider's repositories.
   */
  getModels(provider: DatabaseProvider): Record<string, unknown>;
  /**
   * Build schema-free models for migration generation.
   *
   * Rebuilds all entities with `schema = "public"` so Drizzle produces
   * SQL without schema qualifiers (e.g. `CREATE TABLE "users"` instead
   * of `CREATE TABLE "myschema"."users"`).
   *
   * The actual schema is applied at migration execution time via `search_path`.
   */
  getModelsWithoutSchema(provider: DatabaseProvider): Record<string, unknown>;
  /**
   * Preview schema push without executing any statements.
   *
   * Returns the SQL statements that would be executed, warnings, and
   * whether data loss would occur. Does NOT execute any SQL.
   */
  dryRunPush(provider: DatabaseProvider): Promise<{
    statements: string[];
    warnings: string[];
    hasDataLoss: boolean;
  }>;
  protected pushSqlite(kit: typeof DrizzleKit, models: Record<string, unknown>, provider: DatabaseProvider): Promise<void>;
  /**
   * Push schema changes to PostgreSQL using Drizzle Kit's pushSchema with schema filters.
   */
  protected pushPostgres(kit: typeof DrizzleKit, models: Record<string, unknown>, provider: DatabaseProvider): Promise<void>;
  /**
   * Execute a list of SQL statements against the provider.
   */
  protected executeStatements(statements: string[], provider: DatabaseProvider): Promise<void>;
  /**
   * Execute SQL statements, ignoring "already exists" errors.
   *
   * Used by the fallback migration path where push may have partially
   * applied changes before erroring, leaving some objects already created.
   */
  protected executeStatementsLenient(statements: string[], provider: DatabaseProvider): Promise<void>;
  protected createSchemaIfNotExists(provider: DatabaseProvider, schemaName: string): Promise<void>;
  /**
   * Wrap a Drizzle PgDatabase instance for compatibility with Drizzle Kit.
   *
   * Drizzle Kit's pushSchema expects execute() to return { rows: T[] }
   * (node-postgres/pg format), but postgres.js returns a Result that
   * extends Array directly — no .rows property.
   */
  protected wrapDbForDrizzleKit(db: any): any;
  /**
   * Try to load the official Drizzle Kit API.
   */
  importDrizzleKit(): typeof DrizzleKit;
}
//#endregion
//#region ../../src/orm/core/providers/drivers/DatabaseProvider.d.ts
type SQLLike = SQLWrapper | string;
declare abstract class DatabaseProvider {
  protected readonly alepha: Alepha;
  protected readonly dateTime: DateTimeProvider;
  protected readonly log: import("alepha/logger").Logger;
  protected abstract readonly builder: ModelBuilder;
  protected readonly kit: DrizzleKitProvider;
  abstract readonly db: PgDatabase<any>;
  abstract readonly dialect: "postgresql" | "sqlite";
  abstract readonly url: string;
  readonly enums: Map<string, unknown>;
  readonly tables: Map<string, unknown>;
  readonly sequences: Map<string, unknown>;
  readonly schemas: Map<string, unknown>;
  protected readonly entityPrimitives: EntityPrimitive[];
  protected readonly sequencePrimitives: SequencePrimitive[];
  get name(): string;
  get driver(): string;
  /**
   * Whether this driver supports SQL-level transactions (BEGIN/COMMIT/ROLLBACK).
   *
   * Drivers that do not (e.g. PGlite, Cloudflare D1) should override to `false`.
   */
  get supportsTransactions(): boolean;
  /**
   * Raw database connection handle (e.g. DatabaseSync, bun:sqlite Database).
   * Override in providers that expose native connections for introspection.
   */
  get nativeConnection(): unknown;
  get schema(): string;
  /**
   * Migration tracking table name, scoped by schema.
   *
   * Returns `migrations_{schema}` so that multiple schemas sharing the same
   * database each get their own migration history (e.g. `migrations_lore`,
   * `migrations_public`).
   */
  get migrationsTable(): string;
  /**
   * Log a database query with structured metadata for devtools inspection.
   */
  protected logQuery(sql: string, params: unknown[], duration: number, rowCount: number, error?: string): void;
  protected parseOperation(sql: string): string;
  table<T extends TObject>(entity: EntityPrimitive<T>): PgTableWithColumns<SchemaToTableConfig<T>>;
  registerEntity(entity: EntityPrimitive): void;
  registerSequence(sequence: SequencePrimitive): void;
  /**
   * Rebuild all models into fresh maps using a different schema.
   *
   * When called with `"public"`, produces schema-free models suitable for
   * migration generation (no schema qualifiers in the SQL output).
   */
  rebuildModels(targetSchema: string): {
    tables: Map<string, unknown>;
    enums: Map<string, unknown>;
    sequences: Map<string, unknown>;
    schemas: Map<string, unknown>;
  };
  /**
   * Run a function inside a database transaction with implicit tx propagation.
   *
   * The transaction object is stored in `alepha.store` so that all Repository
   * operations within `fn` automatically participate in the transaction without
   * explicit `{ tx }` drilling.
   *
   * Nesting is safe — if already inside a `transactional()` block, the inner
   * call reuses the outer transaction (no nested PG transactions / savepoints).
   */
  transactional<R>(fn: () => Promise<R>, config?: PgTransactionConfig): Promise<R>;
  abstract execute(statement: SQLLike): Promise<Record<string, unknown>[]>;
  run<T extends TObject>(statement: SQLLike, schema: T): Promise<Array<Static<T>>>;
  /**
   * Get migrations folder path - can be overridden
   */
  protected getMigrationsFolder(): string;
  /**
   * Migration orchestration.
   *
   * - Production: file-based migrations from the migrations folder
   * - Dev / Test: push-based sync (introspects actual DB, no snapshots)
   * - Serverless: skipped (migrations should be applied during deployment)
   */
  migrate(): Promise<void>;
  /**
   * Provider-specific migration execution
   * MUST be implemented by each provider
   */
  protected abstract executeMigrations(migrationsFolder: string): Promise<void>;
  /**
   * For testing purposes, generate a unique schema name.
   *
   * Format: `test_alepha_{epoch_seconds}_{random8}`
   * Example: `test_alepha_1739871618_k3m9x2p1`
   */
  protected generateTestSchemaName(): string;
}
//#endregion
//#region ../../src/orm/core/services/QueryManager.d.ts
declare class QueryManager {
  protected readonly alepha: Alepha;
  /**
   * Convert a query object to a SQL query.
   */
  toSQL(query: PgQueryWhereOrSQL<TObject>, options: {
    schema: TObject;
    col: (key: string) => PgColumn;
    joins?: PgJoin[];
    dialect: "postgresql" | "sqlite";
  }): SQL | undefined;
  /**
   * Check if an object has any filter operator properties.
   */
  protected hasFilterOperatorProperties(obj: any): boolean;
  /**
   * Map a filter operator to a SQL query.
   */
  mapOperatorToSql(operator: FilterOperators<any> | any, column: PgColumn, columnSchema?: TObject, columnName?: string, dialect?: "postgresql" | "sqlite"): SQL | undefined;
  /**
   * Parse pagination sort string to orderBy format.
   * Format: "firstName,-lastName" -> [{ column: "firstName", direction: "asc" }, { column: "lastName", direction: "desc" }]
   * - Columns separated by comma
   * - Prefix with '-' for DESC direction
   *
   * @param sort Pagination sort string
   * @returns OrderBy array or single object
   */
  parsePaginationSort(sort: string): Array<{
    column: string;
    direction: "asc" | "desc";
  }> | {
    column: string;
    direction: "asc" | "desc";
  };
  /**
   * Normalize orderBy parameter to array format.
   * Supports 3 modes:
   * 1. String: "name" -> [{ column: "name", direction: "asc" }]
   * 2. Object: { column: "name", direction: "desc" } -> [{ column: "name", direction: "desc" }]
   * 3. Array: [{ column: "name" }, { column: "age", direction: "desc" }] -> normalized array
   *
   * @param orderBy The orderBy parameter
   * @returns Normalized array of order by clauses
   */
  normalizeOrderBy(orderBy: any): Array<{
    column: string;
    direction: "asc" | "desc";
  }>;
  /**
   * Create a pagination object.
   *
   * @deprecated Use `createPagination` from alepha instead.
   * This method now delegates to the framework-level helper.
   *
   * @param entities The entities to paginate.
   * @param limit The limit of the pagination.
   * @param offset The offset of the pagination.
   * @param sort Optional sort metadata to include in response.
   */
  createPagination<T>(entities: T[], limit?: number, offset?: number, sort?: Array<{
    column: string;
    direction: "asc" | "desc";
  }>): import("alepha").Page<T>;
}
interface PgJoin {
  table: string;
  schema: TObject;
  key: string;
  col: (key: string) => PgColumn;
  parent?: string;
}
//#endregion
//#region ../../src/orm/core/services/PgRelationManager.d.ts
declare class PgRelationManager {
  protected readonly schemaValidator: SchemaValidator;
  /**
   * Recursively build joins for the query builder based on the relations map
   */
  buildJoins(provider: DatabaseProvider, builder: PgSelectBase<any, any, any>, joins: Array<PgJoin>, withRelations: PgRelationMap<TObject>, table: PgTableWithColumns<any>, parentKey?: string): void;
  /**
   * Map a row with its joined relations based on the joins definition
   */
  mapRowWithJoins(record: Record<string, unknown>, row: Record<string, unknown>, schema: TObject, joins: PgJoin[], parentKey?: string): Record<string, unknown>;
  /**
   * Check if all values in an object are null (indicates a left join with no match)
   */
  protected isAllNull(obj: unknown): boolean;
  /**
   * Build a schema that includes all join properties recursively
   */
  buildSchemaWithJoins(baseSchema: TObject, joins: PgJoin[], parentPath?: string): TObject;
}
//#endregion
//#region ../../src/orm/core/services/Repository.d.ts
declare abstract class Repository$1<T extends TObject> {
  readonly entity: EntityPrimitive<T>;
  readonly provider: DatabaseProvider;
  protected readonly log: import("alepha/logger").Logger;
  protected readonly relationManager: PgRelationManager;
  protected readonly queryManager: QueryManager;
  protected readonly dateTimeProvider: DateTimeProvider;
  protected readonly dbCache: DbCacheProvider;
  protected readonly alepha: Alepha;
  static of<T extends TObject>(entity: EntityPrimitive<T>, provider?: typeof DatabaseProvider): new () => Repository$1<T>;
  constructor(entity: EntityPrimitive<T>, provider?: typeof DatabaseProvider);
  /**
   * Represents the primary key of the table.
   * - Key is the name of the primary key column.
   * - Type is the type (TypeBox) of the primary key column.
   *
   * ID is mandatory. If the table does not have a primary key, it will throw an error.
   */
  get id(): {
    type: TSchema;
    key: keyof T["properties"];
    col: PgColumn;
  };
  /**
   * Get Drizzle table object.
   */
  get table(): PgTableWithColumns<SchemaToTableConfig<T>>;
  /**
   * Get SQL table name. (from Drizzle table object)
   */
  get tableName(): string;
  /**
   * Getter for the database connection from the database provider.
   *
   * Automatically picks up a transaction from `alepha.store` if one was set
   * by `DatabaseProvider.transactional()`, so that all repository operations
   * inside a `transactional()` block participate in the same transaction.
   */
  protected get db(): PgDatabase<any>;
  /**
   * Execute a SQL query.
   *
   * This method allows executing raw SQL queries against the database.
   * This is by far the easiest way to run custom queries that are not covered by the repository's built-in methods!
   *
   * You must use the `sql` tagged template function from Drizzle ORM to create the query. https://orm.drizzle.team/docs/sql
   *
   * @example
   * ```ts
   * class App {
   *   repository = $repository({ ... });
   *   async getAdults() {
   *     const users = repository.table; // Drizzle table object
   *     await repository.query(sql`SELECT * FROM ${users} WHERE ${users.age} > ${18}`);
   *     // or better
   *     await repository.query((users) => sql`SELECT * FROM ${users} WHERE ${users.age} > ${18}`);
   *   }
   * }
   * ```
   */
  query<R extends TObject = T>(query: SQLLike | ((table: PgTableWithColumns<SchemaToTableConfig<T>>, db: PgDatabase<any>) => SQLLike), schema?: R): Promise<Static<R>[]>;
  protected columnNameMap?: Map<string, string>;
  /**
   * Map raw database fields to entity fields. (handles column name differences)
   */
  protected mapRawFieldsToEntity(row: Record<string, unknown>): any;
  /**
   * Get a Drizzle column from the table by his name.
   */
  protected col(name: keyof StaticEncode<T>): PgColumn;
  /**
   * Run a transaction.
   */
  transaction<T>(transaction: (tx: PgTransaction<any, Record<string, any>, any>) => Promise<T>, config?: PgTransactionConfig): Promise<T>;
  /**
   * Start a SELECT query on the table.
   */
  protected rawSelect(opts?: StatementOptions): import("drizzle-orm/pg-core").PgSelectBase<string, Record<string, PgColumn<import("drizzle-orm").ColumnBaseConfig<import("drizzle-orm").ColumnDataType, string>, {}, {}>>, "single", Record<string, "not-null">, false, never, {
    [x: string]: unknown;
  }[], {
    [x: string]: PgColumn<import("drizzle-orm").ColumnBaseConfig<import("drizzle-orm").ColumnDataType, string>, {}, {}>;
  }>;
  /**
   * Start a SELECT DISTINCT query on the table.
   */
  protected rawSelectDistinct(opts?: StatementOptions, columns?: (keyof Static<T>)[]): import("drizzle-orm/pg-core").PgSelectBase<string, Record<string, any>, "partial", Record<string, "not-null">, false, never, {
    [x: string]: any;
  }[], {
    [x: string]: any;
  }>;
  /**
   * Start an INSERT query on the table.
   */
  protected rawInsert(opts?: StatementOptions): import("drizzle-orm/pg-core").PgInsertBuilder<PgTableWithColumns<SchemaToTableConfig<T>>, any, false>;
  /**
   * Start an UPDATE query on the table.
   */
  protected rawUpdate(opts?: StatementOptions): import("drizzle-orm/pg-core").PgUpdateBuilder<PgTableWithColumns<SchemaToTableConfig<T>>, any>;
  /**
   * Start a DELETE query on the table.
   */
  protected rawDelete(opts?: StatementOptions): import("drizzle-orm/pg-core").PgDeleteBase<PgTableWithColumns<SchemaToTableConfig<T>>, any, undefined, undefined, false, never>;
  /**
   * Create a Drizzle `select` query based on a JSON query object.
   *
   * > This method is the base for `find`, `findOne`, `findById`, and `paginate`.
   */
  findMany<R extends PgRelationMap<T>>(query?: PgQueryRelations<T, R>, opts?: StatementOptions): Promise<PgStatic<T, R>[]>;
  /**
   * Find a single entity. Returns `undefined` if not found.
   */
  findOne<R extends PgRelationMap<T>>(query: Pick<PgQueryRelations<T, R>, "with" | "where">, opts?: StatementOptions): Promise<PgStatic<T, R> | undefined>;
  /**
   * Find a single entity. Throws `DbEntityNotFoundError` if not found.
   */
  getOne<R extends PgRelationMap<T>>(query: Pick<PgQueryRelations<T, R>, "with" | "where">, opts?: StatementOptions): Promise<PgStatic<T, R>>;
  /**
   * Find entities with pagination.
   *
   * It uses the same parameters as `find()`, but adds pagination metadata to the response.
   *
   * > Pagination CAN also do a count query to get the total number of elements.
   */
  paginate<R extends PgRelationMap<T>>(pagination?: PageQuery, query?: Omit<PgQueryRelations<T, R>, "where"> & {
    where?: PgQueryWhere<T>;
  }, opts?: StatementOptions & {
    count?: boolean;
  }): Promise<Page<PgStatic<T, R>>>;
  /**
   * Find an entity by ID. Returns `undefined` if not found.
   *
   * Pass `with` to eager-load relations on the result — same `with` map
   * shape as `findOne` / `paginate`. Without `with`, returns the plain
   * row.
   *
   * @example
   * ```ts
   * const session = await sessions.findById(id, {
   *   with: { user: { join: users, on: ["userId", users.cols.id] as const } },
   * });
   * session?.user?.email;
   * ```
   */
  findById<R extends PgRelationMap<T>>(id: string | number, opts?: StatementOptions & {
    with?: R;
  }): Promise<PgStatic<T, R> | undefined>;
  /**
   * Find an entity by ID. Throws `DbEntityNotFoundError` if not found.
   *
   * Pass `with` to eager-load relations — see {@link findById}.
   */
  getById<R extends PgRelationMap<T>>(id: string | number, opts?: StatementOptions & {
    with?: R;
  }): Promise<PgStatic<T, R>>;
  /**
   * Helper to create a type-safe query object.
   */
  createQuery(): PgQuery<T>;
  /**
   * Helper to create a type-safe where clause.
   */
  createQueryWhere(): PgQueryWhere<T>;
  /**
   * Create an entity.
   *
   * @param data The entity to create.
   * @param opts The options for creating the entity.
   * @returns The ID of the created entity.
   */
  create(data: Static<TObjectInsert<T>>, opts?: StatementOptions): Promise<Static<T>>;
  /**
   * Create many entities.
   *
   * Inserts are batched in chunks of 1000 to avoid hitting database limits.
   *
   * @param values The entities to create.
   * @param opts The statement options.
   * @returns The created entities.
   */
  createMany(values: Array<Static<TObjectInsert<T>>>, opts?: StatementOptions & {
    batchSize?: number;
  }): Promise<Static<T>[]>;
  /**
   * Insert or update an entity.
   *
   * If a row with the same conflict target already exists, it updates that row.
   * Otherwise, it inserts a new row.
   *
   * @param data The entity data to insert.
   * @param opts.target The column(s) to detect conflicts on. Defaults to the primary key.
   * @param opts.set The fields to update on conflict. Defaults to the insert data (minus conflict target columns).
   * @returns The created or updated entity.
   *
   * @example
   * ```ts
   * // Simple upsert on primary key
   * await repo.upsert({ id: "abc", name: "Alice", role: "admin" });
   *
   * // Upsert on a unique column
   * await repo.upsert(
   *   { email: "alice@example.com", name: "Alice" },
   *   { target: ["email"] },
   * );
   *
   * // Upsert with custom update fields
   * await repo.upsert(
   *   { id: "abc", name: "Alice", role: "admin" },
   *   { set: { role: "admin" } },
   * );
   * ```
   */
  upsert(data: Static<TObjectInsert<T>>, opts?: StatementOptions & {
    target?: Array<keyof Static<T>>;
    set?: WithSQL<Static<TObjectUpdate<T>>>;
  }): Promise<Static<T>>;
  /**
   * Find an entity and update it.
   */
  updateOne(where: PgQueryWhereOrSQL<T>, data: WithSQL<Static<TObjectUpdate<T>>>, opts?: StatementOptions): Promise<Static<T>>;
  /**
   * Save a given entity.
   *
   * @example
   * ```ts
   * const entity = await repository.findById(1);
   * entity.name = "New Name"; // update a field
   * delete entity.description; // delete a field
   * await repository.save(entity);
   * ```
   *
   * Difference with `updateById/updateOne`:
   *
   * - requires the entity to be fetched first (whole object is expected)
   * - check pg.version() if present -> optimistic locking
   * - validate entity against schema
   * - undefined values will be set to null, not ignored!
   *
   * @see {@link DbVersionMismatchError}
   */
  save(entity: Static<T>, opts?: StatementOptions): Promise<void>;
  /**
   * Find an entity by ID and update it.
   */
  updateById(id: string | number, data: WithSQL<Static<TObjectUpdate<T>>>, opts?: StatementOptions): Promise<Static<T>>;
  /**
   * Find many entities and update all of them.
   */
  updateMany(where: PgQueryWhereOrSQL<T>, data: WithSQL<Static<TObjectUpdate<T>>>, opts?: StatementOptions): Promise<Array<number | string>>;
  /**
   * Find many and delete all of them.
   * @returns Array of deleted entity IDs
   */
  deleteMany(where?: PgQueryWhereOrSQL<T>, opts?: StatementOptions): Promise<Array<number | string>>;
  /**
   * Delete all entities.
   * @returns Array of deleted entity IDs
   */
  clear(opts?: StatementOptions): Promise<Array<number | string>>;
  /**
   * Delete the given entity.
   *
   * You must fetch the entity first in order to delete it.
   * @returns Array containing the deleted entity ID
   */
  destroy(entity: Static<T>, opts?: StatementOptions): Promise<Array<number | string>>;
  /**
   * Find an entity and delete it.
   * @returns Array of deleted entity IDs (should contain at most one ID)
   */
  deleteOne(where?: PgQueryWhereOrSQL<T>, opts?: StatementOptions): Promise<Array<number | string>>;
  /**
   * Find an entity by ID and delete it.
   * @returns Array containing the deleted entity ID
   * @throws DbEntityNotFoundError if the entity is not found
   */
  deleteById(id: string | number, opts?: StatementOptions): Promise<Array<number | string>>;
  /**
   * Count entities.
   */
  count(where?: PgQueryWhereOrSQL<T>, opts?: StatementOptions): Promise<number>;
  /**
   * Execute an aggregate query with type-safe select, groupBy, and having.
   *
   * @example
   * ```ts
   * const result = await repo.aggregate({
   *   select: { category: true, amount: { sum: true, avg: true } },
   *   groupBy: ["category"],
   *   having: { amount: { sum: { gt: 100 } } },
   *   orderBy: { column: "amount.sum", direction: "desc" },
   * });
   * // result: Array<{ category: string; amount: { sum: number; avg: number } }>
   * ```
   */
  aggregate<S extends AggregateSelect<T>>(query: AggregateQuery<T, S>, opts?: StatementOptions): Promise<AggregateResult<T, S>[]>;
  protected errorPatterns: {
    conflict: string[];
    foreignKey: string[];
    notNull: string[];
    deadlock: string[];
    tableNotFound: string[];
    columnNotFound: string[];
  };
  protected handleError(error: unknown, message: string): DbError;
  protected withDeletedAt(where: PgQueryWhereOrSQL<T>, opts?: {
    force?: boolean;
  }): PgQueryWhereOrSQL<T>;
  protected deletedAt(): PgAttrField | undefined;
  protected withOrganization(where: PgQueryWhereOrSQL<T>): PgQueryWhereOrSQL<T>;
  protected stampOrganization(data: any): void;
  /**
   * Resolve the value used for `PG_ORGANIZATION` scoping.
   *
   * Priority:
   * 1. Request-bound tenant (`currentTenantAtom`) — set by an app-level
   *    middleware from the request `Host`. Lets cross-tenant users (admins,
   *    agency operators) be scoped to the tenant they are acting in rather
   *    than the one they belong to.
   * 2. Authenticated user's `organization` — the legacy single-tenant case.
   */
  protected resolveOrganizationValue(): string | undefined;
  protected organizationField(): PgAttrField | undefined;
  /**
   * Convert something to valid Pg Insert Value.
   */
  protected cast(data: any, insert: boolean): PgInsertValue<PgTableWithColumns<SchemaToTableConfig<T>>>;
  /**
   * Transform a row from the database into a clean entity.
   */
  protected clean<T extends TObject>(row: Record<string, unknown>, schema: T): Static<T>;
  /**
   * Clean a row with joins recursively
   */
  protected cleanWithJoins<T extends TObject>(row: Record<string, unknown>, schema: T, joins: PgJoin[], parentPath?: string): Static<T>;
  /**
   * Build a cache key from method name and query parameters.
   */
  protected buildCacheKey(method: string, query: any): string;
  /**
   * Convert a where clause to SQL.
   */
  protected toSQL(where: PgQueryWhereOrSQL<T>, joins?: PgJoin[]): SQL | undefined;
  /**
   * Get the where clause for an ID.
   *
   * @param id The ID to get the where clause for.
   * @returns The where clause for the ID.
   */
  protected getWhereId(id: string | number): PgQueryWhere<T>;
  /**
   * Find a primary key in the schema.
   */
  protected getPrimaryKey(schema: TObject): {
    key: string;
    col: PgColumn<import("drizzle-orm").ColumnBaseConfig<import("drizzle-orm").ColumnDataType, string>, {}, {}>;
    type: import("alepha").ZType;
  };
}
/**
 * The options for a statement.
 */
interface StatementOptions {
  /**
   * Transaction to use.
   *
   * - `undefined` — auto-detect from `alepha.store` (implicit transactional context)
   * - `PgTransaction` — use this specific transaction (explicit)
   * - `null` — force no transaction, bypass implicit context
   */
  tx?: PgTransaction<any, Record<string, any>> | null;
  /**
   * Lock strength.
   */
  for?: LockStrength | {
    config: LockConfig;
    strength: LockStrength;
  };
  /**
   * If true, ignore soft delete.
   */
  force?: boolean;
  /**
   * Force the current time.
   */
  now?: DateTime | string;
  /**
   * Cache configuration for query results.
   *
   * When set, results are stored in an in-memory cache keyed by query parameters.
   * Any write to this table automatically invalidates all cached queries.
   *
   * @example
   * ```ts
   * await repo.findMany(query, { cache: { ttl: 60_000 } });
   * ```
   */
  cache?: {
    /**
     * Time-to-live in milliseconds.
     */
    ttl?: number;
    /**
     * Custom cache key. If not provided, a key is derived from the query.
     */
    key?: string;
  };
}
type WithSQL<T> = { [P in keyof T]?: T[P] | SQL; };
//#endregion
//#region ../../src/orm/core/schemas/databaseEnvSchema.d.ts
/**
 * Base database environment schema.
 *
 * Defines the `DATABASE_URL` connection string used by all ORM providers
 * to determine the database driver and connection target.
 *
 * Supported URL formats:
 * - `sqlite://:memory:` or `sqlite://./path/to/db` — SQLite (Node.js or Bun)
 * - `postgres://user:password@host:port/database` — PostgreSQL (Node.js or Bun)
 * - `pglite://:memory:` or `pglite://./path` — PGlite (embedded Postgres)
 * - `d1://BINDING_NAME` — Cloudflare D1
 * - `hyperdrive://BINDING_NAME` — Cloudflare Hyperdrive
 */
declare const databaseEnvSchema: import("zod").ZodObject<{
  DATABASE_URL: import("zod").ZodOptional<import("zod").ZodString>;
  DATABASE_SYNC: import("zod").ZodOptional<import("zod").ZodBoolean>;
}, import("zod/v4/core").$strip>;
declare module "alepha" {
  interface Env extends Partial<Static<typeof databaseEnvSchema>> {}
}
//#endregion
//#region ../../src/api/users/entities/identities.d.ts
declare const identities: import("alepha/orm").EntityPrimitive<import("zod").ZodObject<{
  id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
  version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodInt, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
  createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
  updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
  userId: import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_REF>;
  password: import("zod").ZodOptional<import("zod").ZodString>;
  provider: import("zod").ZodString;
  providerUserId: import("zod").ZodOptional<import("zod").ZodString>;
  providerData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
}, import("zod/v4/core").$strip>>;
type IdentityEntity = Static<typeof identities.schema>;
//#endregion
//#region ../../src/api/users/entities/sessions.d.ts
declare const sessions: import("alepha/orm").EntityPrimitive<import("zod").ZodObject<{
  id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
  version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodInt, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
  createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
  updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
  refreshToken: import("zod").ZodString;
  userId: import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_REF>;
  clientId: import("zod").ZodOptional<import("zod").ZodString>;
  expiresAt: import("zod").ZodString;
  lastUsedAt: import("zod").ZodOptional<import("zod").ZodString>;
  ip: import("zod").ZodOptional<import("zod").ZodString>;
  country: import("zod").ZodOptional<import("zod").ZodString>;
  userAgent: import("zod").ZodOptional<import("zod").ZodObject<{
    os: import("zod").ZodString;
    browser: import("zod").ZodString;
    device: import("zod").ZodEnum<{
      DESKTOP: "DESKTOP";
      MOBILE: "MOBILE";
      TABLET: "TABLET";
    }>;
  }, import("zod/v4/core").$strip>>;
}, import("zod/v4/core").$strip>>;
type SessionEntity = Static<typeof sessions.schema>;
//#endregion
//#region ../../src/api/users/entities/users.d.ts
declare const DEFAULT_USER_REALM_NAME = "default";
declare const users: import("alepha/orm").EntityPrimitive<import("zod").ZodObject<{
  id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
  version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodInt, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
  createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
  updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
  realm: import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_DEFAULT>;
  username: import("zod").ZodOptional<import("zod").ZodString>;
  email: import("zod").ZodOptional<import("zod").ZodString>;
  phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
  roles: import("alepha/orm").PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof import("alepha/orm").PG_DEFAULT>;
  firstName: import("zod").ZodOptional<import("zod").ZodString>;
  lastName: import("zod").ZodOptional<import("zod").ZodString>;
  picture: import("zod").ZodOptional<import("zod").ZodString>;
  enabled: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
  emailVerified: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
  lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
  organizationId: import("alepha/orm").PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof import("alepha/orm").PG_ORGANIZATION>;
}, import("zod/v4/core").$strip>>;
type UserEntity = Static<typeof users.schema>;
//#endregion
//#region ../../src/api/users/primitives/$realm.d.ts
type RealmPrimitive = IssuerPrimitive & WithLinkFn & WithLoginFn;
/**
 * Already configured realm for user management.
 *
 * Realm contains two roles: `admin` and `user`.
 *
 * - `admin`: Has full access to all resources and permissions.
 * - `user`: Has access to their own resources and permissions, but cannot access admin-level resources.
 *
 * Realm uses session management for handling user sessions.
 *
 * Environment Variables:
 * - `APP_SECRET`: Secret key for signing tokens (if not provided in options).
 */
declare const $realm: (options?: RealmOptions) => RealmPrimitive;
interface RealmFeatures {
  /**
   * Will enable Job module.
   *
   * - Enable session purge functionality for cleaning up expired sessions.
   *
   * @default false
   */
  jobs?: boolean;
  /**
   * Enable notification system for password reset, verification emails, etc.
   *
   * @default false
   */
  notifications?: boolean;
  /**
   * Enable API key authentication for programmatic access.
   *
   * When enabled, users can create API keys to access protected endpoints
   * without using JWT tokens. API keys are useful for:
   * - Programmatic access (CLI tools, scripts)
   * - Long-lived authentication tokens
   * - Third-party integrations (MCP servers)
   *
   * API keys can be passed via:
   * - Query parameter: `?api_key=ak_xxx`
   * - Bearer header: `Authorization: Bearer ak_xxx`
   *
   * @default false
   */
  apiKeys?: boolean;
  /**
   * Enable the OAuth 2.1 authorization server.
   *
   * Exposes RFC 9728 / RFC 8414 metadata, RFC 7591 dynamic client
   * registration, and PKCE authorize/token endpoints so MCP clients
   * (e.g. Claude) can connect to a protected `/mcp` endpoint without an
   * API key in the query string.
   *
   * @default false
   */
  oauth?: boolean;
  /**
   * Enable runtime configuration management.
   *
   * Allows configuring realm settings at runtime with versioning and scheduled activation.
   *
   * @default false
   */
  parameters?: boolean;
  /**
   * Enable avatar uploads for user profiles.
   *
   * @default false
   */
  avatars?: boolean;
  /**
   * Enable audit trail for compliance and event logging.
   *
   * @default false
   */
  audits?: boolean;
}
interface RealmOptions {
  /**
   * Secret key for signing tokens.
   *
   * If not provided, the secret from the SecurityProvider will be used (usually from the APP_SECRET environment variable).
   */
  secret?: string;
  /**
   * Asymmetric signing config for this realm's tokens (OIDC provider mode).
   * When set, issued tokens are signed asymmetrically and the public keys are
   * JWKS-publishable. Default is HS256 via `secret`.
   */
  signing?: SigningConfig;
  /**
   * Issuer configuration options.
   *
   * It's already pre-configured for user management with admin and user roles.
   */
  issuer?: Partial<IssuerPrimitiveOptions>;
  /**
   * Override entities.
   */
  entities?: {
    users?: Repository<typeof users.schema>;
    identities?: Repository<typeof identities.schema>;
    sessions?: Repository<typeof sessions.schema>;
  };
  settings?: Partial<RealmAuthSettings>;
  identities?: {
    credentials?: true;
    google?: true;
    github?: true;
    apple?: true;
    facebook?: true;
    microsoft?: true;
    franceconnect?: true;
  };
  /**
   * Enable or disable realm features.
   *
   * Features control which modules are loaded with the realm.
   */
  features?: Partial<RealmFeatures>;
}
//#endregion
//#region ../../src/api/users/providers/RealmProvider.d.ts
interface RealmRepositories {
  identities: Repository<typeof identities.schema>;
  sessions: Repository<typeof sessions.schema>;
  users: Repository<typeof users.schema>;
}
interface Realm {
  name: string;
  repositories: RealmRepositories;
  settings: RealmAuthSettings;
  features: RealmFeatures;
  settingsParameter?: ParameterPrimitive<typeof realmAuthSettingsAtom.schema>;
  getSettings(): Promise<RealmAuthSettings>;
}
declare class RealmProvider {
  protected readonly alepha: Alepha;
  protected readonly defaultIdentities: Repository<import("zod").ZodObject<{
    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodInt, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
    userId: import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_REF>;
    password: import("zod").ZodOptional<import("zod").ZodString>;
    provider: import("zod").ZodString;
    providerUserId: import("zod").ZodOptional<import("zod").ZodString>;
    providerData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
  }, import("zod/v4/core").$strip>>;
  protected readonly defaultSessions: Repository<import("zod").ZodObject<{
    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodInt, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
    refreshToken: import("zod").ZodString;
    userId: import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_REF>;
    clientId: import("zod").ZodOptional<import("zod").ZodString>;
    expiresAt: import("zod").ZodString;
    lastUsedAt: import("zod").ZodOptional<import("zod").ZodString>;
    ip: import("zod").ZodOptional<import("zod").ZodString>;
    country: import("zod").ZodOptional<import("zod").ZodString>;
    userAgent: import("zod").ZodOptional<import("zod").ZodObject<{
      os: import("zod").ZodString;
      browser: import("zod").ZodString;
      device: import("zod").ZodEnum<{
        DESKTOP: "DESKTOP";
        MOBILE: "MOBILE";
        TABLET: "TABLET";
      }>;
    }, import("zod/v4/core").$strip>>;
  }, import("zod/v4/core").$strip>>;
  protected readonly defaultUsers: Repository<import("zod").ZodObject<{
    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodInt, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
    realm: import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_DEFAULT>;
    username: import("zod").ZodOptional<import("zod").ZodString>;
    email: import("zod").ZodOptional<import("zod").ZodString>;
    phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
    roles: import("alepha/orm").PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof import("alepha/orm").PG_DEFAULT>;
    firstName: import("zod").ZodOptional<import("zod").ZodString>;
    lastName: import("zod").ZodOptional<import("zod").ZodString>;
    picture: import("zod").ZodOptional<import("zod").ZodString>;
    enabled: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
    emailVerified: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
    lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
    organizationId: import("alepha/orm").PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof import("alepha/orm").PG_ORGANIZATION>;
  }, import("zod/v4/core").$strip>>;
  protected realms: Map<string, Realm>;
  register(realmName: string, realmOptions?: RealmOptions): Realm;
  /**
   * Gets a registered realm by name, auto-creating default if needed.
   */
  getRealm(realmName?: string): Realm;
  identityRepository(realmName?: string): Repository<typeof identities.schema>;
  sessionRepository(realmName?: string): Repository<typeof sessions.schema>;
  userRepository(realmName?: string): Repository<typeof users.schema>;
}
//#endregion
//#region ../../src/api/users/schemas/identityQuerySchema.d.ts
declare const identityQuerySchema: import("zod").ZodObject<{
  page: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
  size: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
  sort: import("zod").ZodOptional<import("zod").ZodString>;
  userId: import("zod").ZodOptional<import("zod").ZodString>;
  provider: import("zod").ZodOptional<import("zod").ZodString>;
}, import("zod/v4/core").$strip>;
type IdentityQuery = Static<typeof identityQuerySchema>;
//#endregion
//#region ../../src/api/users/services/IdentityService.d.ts
declare class IdentityService {
  protected readonly alepha: Alepha;
  protected readonly log: import("alepha/logger").Logger;
  protected readonly realmProvider: RealmProvider;
  protected userAudits(realmName?: string): UserAudits | undefined;
  identities(userRealmName?: string): import("alepha/orm").Repository<import("zod").ZodObject<{
    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodInt, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
    userId: import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_REF>;
    password: import("zod").ZodOptional<import("zod").ZodString>;
    provider: import("zod").ZodString;
    providerUserId: import("zod").ZodOptional<import("zod").ZodString>;
    providerData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
  }, import("zod/v4/core").$strip>>;
  /**
   * Find identities with pagination and filtering.
   */
  findIdentities(q?: IdentityQuery, userRealmName?: string): Promise<Page$1<IdentityEntity>>;
  /**
   * Get an identity by ID.
   */
  getIdentityById(id: string, userRealmName?: string): Promise<IdentityEntity>;
  /**
   * Delete an identity by ID.
   */
  deleteIdentity(id: string, userRealmName?: string): Promise<void>;
}
//#endregion
//#region ../../src/api/users/controllers/AdminIdentityController.d.ts
declare class AdminIdentityController {
  protected readonly url = "/identities";
  protected readonly group = "admin:identities";
  protected readonly identityService: IdentityService;
  protected readonly securityProvider: SecurityProvider;
  /**
   * Find identities with pagination and filtering.
   */
  readonly findIdentities: import("alepha/server").ActionPrimitiveFn<{
    query: import("zod").ZodObject<{
      page: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
      size: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
      sort: import("zod").ZodOptional<import("zod").ZodString>;
      userId: import("zod").ZodOptional<import("zod").ZodString>;
      provider: import("zod").ZodOptional<import("zod").ZodString>;
      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      content: import("zod").ZodArray<import("zod").ZodObject<{
        id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
        version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
        createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
        updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
        userId: PgAttr<import("zod").ZodString, typeof PG_REF>;
        provider: import("zod").ZodString;
        providerUserId: import("zod").ZodOptional<import("zod").ZodString>;
        providerData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
      }, import("zod/v4/core").$strip>>;
      page: import("zod").ZodObject<{
        number: import("zod").ZodInt;
        size: import("zod").ZodInt;
        offset: import("zod").ZodInt;
        numberOfElements: import("zod").ZodInt;
        totalElements: import("zod").ZodOptional<import("zod").ZodInt>;
        totalPages: import("zod").ZodOptional<import("zod").ZodInt>;
        isEmpty: import("zod").ZodBoolean;
        isFirst: import("zod").ZodBoolean;
        isLast: import("zod").ZodBoolean;
      }, import("zod/v4/core").$strip>;
    }, import("zod/v4/core").$strip>;
  }>;
  /**
   * Get an identity by ID.
   */
  readonly getIdentity: import("alepha/server").ActionPrimitiveFn<{
    params: import("zod").ZodObject<{
      id: import("zod").ZodString;
    }, import("zod/v4/core").$strip>;
    query: import("zod").ZodObject<{
      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
      version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
      createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
      updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
      userId: PgAttr<import("zod").ZodString, typeof PG_REF>;
      provider: import("zod").ZodString;
      providerUserId: import("zod").ZodOptional<import("zod").ZodString>;
      providerData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
    }, import("zod/v4/core").$strip>;
  }>;
  /**
   * Delete an identity.
   */
  readonly deleteIdentity: import("alepha/server").ActionPrimitiveFn<{
    params: import("zod").ZodObject<{
      id: import("zod").ZodString;
    }, import("zod/v4/core").$strip>;
    query: import("zod").ZodObject<{
      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      ok: import("zod").ZodBoolean;
      id: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodInt]>>;
      count: import("zod").ZodOptional<import("zod").ZodNumber>;
    }, import("zod/v4/core").$strip>;
  }>;
}
//#endregion
//#region ../../src/api/users/schemas/sessionQuerySchema.d.ts
declare const sessionQuerySchema: import("zod").ZodObject<{
  page: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
  size: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
  sort: import("zod").ZodOptional<import("zod").ZodString>;
  userId: import("zod").ZodOptional<import("zod").ZodString>;
}, import("zod/v4/core").$strip>;
type SessionQuery = Static<typeof sessionQuerySchema>;
//#endregion
//#region ../../src/api/users/services/SessionCrudService.d.ts
declare class SessionCrudService {
  protected readonly log: import("alepha/logger").Logger;
  protected readonly realmProvider: RealmProvider;
  sessions(userRealmName?: string): import("alepha/orm").Repository<import("zod").ZodObject<{
    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodInt, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
    refreshToken: import("zod").ZodString;
    userId: import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_REF>;
    clientId: import("zod").ZodOptional<import("zod").ZodString>;
    expiresAt: import("zod").ZodString;
    lastUsedAt: import("zod").ZodOptional<import("zod").ZodString>;
    ip: import("zod").ZodOptional<import("zod").ZodString>;
    country: import("zod").ZodOptional<import("zod").ZodString>;
    userAgent: import("zod").ZodOptional<import("zod").ZodObject<{
      os: import("zod").ZodString;
      browser: import("zod").ZodString;
      device: import("zod").ZodEnum<{
        DESKTOP: "DESKTOP";
        MOBILE: "MOBILE";
        TABLET: "TABLET";
      }>;
    }, import("zod/v4/core").$strip>>;
  }, import("zod/v4/core").$strip>>;
  /**
   * Find sessions with pagination and filtering.
   */
  findSessions(q?: SessionQuery, userRealmName?: string): Promise<Page$1<SessionEntity>>;
  /**
   * Get a session by ID.
   */
  getSessionById(id: string, userRealmName?: string): Promise<SessionEntity>;
  /**
   * Delete a session by ID.
   */
  deleteSession(id: string, userRealmName?: string): Promise<void>;
  /**
   * Delete many sessions by ID in one repository call.
   */
  deleteSessions(ids: string[], userRealmName?: string): Promise<string[]>;
}
//#endregion
//#region ../../src/api/users/controllers/AdminSessionController.d.ts
declare class AdminSessionController {
  protected readonly url = "/sessions";
  protected readonly group = "admin:sessions";
  protected readonly sessionService: SessionCrudService;
  protected readonly securityProvider: SecurityProvider;
  /**
   * Find sessions with pagination and filtering.
   */
  readonly findSessions: import("alepha/server").ActionPrimitiveFn<{
    query: import("zod").ZodObject<{
      page: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
      size: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
      sort: import("zod").ZodOptional<import("zod").ZodString>;
      userId: import("zod").ZodOptional<import("zod").ZodString>;
      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      content: import("zod").ZodArray<import("zod").ZodObject<{
        id: import("zod").ZodString;
        version: import("zod").ZodNumber;
        createdAt: import("zod").ZodString;
        updatedAt: import("zod").ZodString;
        refreshToken: import("zod").ZodString;
        userId: import("zod").ZodString;
        expiresAt: import("zod").ZodString;
        ip: import("zod").ZodOptional<import("zod").ZodString>;
        country: import("zod").ZodOptional<import("zod").ZodString>;
        userAgent: import("zod").ZodOptional<import("zod").ZodObject<{
          os: import("zod").ZodString;
          browser: import("zod").ZodString;
          device: import("zod").ZodEnum<{
            DESKTOP: "DESKTOP";
            MOBILE: "MOBILE";
            TABLET: "TABLET";
          }>;
        }, import("zod/v4/core").$strip>>;
        user: import("zod").ZodOptional<import("zod").ZodObject<{
          id: import("zod").ZodString;
          email: import("zod").ZodOptional<import("zod").ZodString>;
          username: import("zod").ZodOptional<import("zod").ZodString>;
          firstName: import("zod").ZodOptional<import("zod").ZodString>;
          lastName: import("zod").ZodOptional<import("zod").ZodString>;
        }, import("zod/v4/core").$strip>>;
      }, import("zod/v4/core").$strip>>;
      page: import("zod").ZodObject<{
        number: import("zod").ZodInt;
        size: import("zod").ZodInt;
        offset: import("zod").ZodInt;
        numberOfElements: import("zod").ZodInt;
        totalElements: import("zod").ZodOptional<import("zod").ZodInt>;
        totalPages: import("zod").ZodOptional<import("zod").ZodInt>;
        isEmpty: import("zod").ZodBoolean;
        isFirst: import("zod").ZodBoolean;
        isLast: import("zod").ZodBoolean;
      }, import("zod/v4/core").$strip>;
    }, import("zod/v4/core").$strip>;
  }>;
  /**
   * Get a session by ID.
   */
  readonly getSession: import("alepha/server").ActionPrimitiveFn<{
    params: import("zod").ZodObject<{
      id: import("zod").ZodString;
    }, import("zod/v4/core").$strip>;
    query: import("zod").ZodObject<{
      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      id: import("zod").ZodString;
      version: import("zod").ZodNumber;
      createdAt: import("zod").ZodString;
      updatedAt: import("zod").ZodString;
      refreshToken: import("zod").ZodString;
      userId: import("zod").ZodString;
      expiresAt: import("zod").ZodString;
      ip: import("zod").ZodOptional<import("zod").ZodString>;
      country: import("zod").ZodOptional<import("zod").ZodString>;
      userAgent: import("zod").ZodOptional<import("zod").ZodObject<{
        os: import("zod").ZodString;
        browser: import("zod").ZodString;
        device: import("zod").ZodEnum<{
          DESKTOP: "DESKTOP";
          MOBILE: "MOBILE";
          TABLET: "TABLET";
        }>;
      }, import("zod/v4/core").$strip>>;
      user: import("zod").ZodOptional<import("zod").ZodObject<{
        id: import("zod").ZodString;
        email: import("zod").ZodOptional<import("zod").ZodString>;
        username: import("zod").ZodOptional<import("zod").ZodString>;
        firstName: import("zod").ZodOptional<import("zod").ZodString>;
        lastName: import("zod").ZodOptional<import("zod").ZodString>;
      }, import("zod/v4/core").$strip>>;
    }, import("zod/v4/core").$strip>;
  }>;
  /**
   * Delete a session.
   */
  readonly deleteSession: import("alepha/server").ActionPrimitiveFn<{
    params: import("zod").ZodObject<{
      id: import("zod").ZodString;
    }, import("zod/v4/core").$strip>;
    query: import("zod").ZodObject<{
      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      ok: import("zod").ZodBoolean;
      id: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodInt]>>;
      count: import("zod").ZodOptional<import("zod").ZodNumber>;
    }, import("zod/v4/core").$strip>;
  }>;
  /**
   * Delete many sessions in one repository call.
   */
  readonly deleteSessions: import("alepha/server").ActionPrimitiveFn<{
    query: import("zod").ZodObject<{
      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    body: import("zod").ZodObject<{
      ids: import("zod").ZodArray<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      deleted: import("zod").ZodArray<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
  }>;
}
//#endregion
//#region ../../src/api/users/notifications/UserNotifications.d.ts
declare class UserNotifications {
  readonly passwordReset: import("alepha/api/notifications").NotificationPrimitive<import("zod").ZodObject<{
    email: import("zod").ZodString;
    code: import("zod").ZodString;
    expiresInMinutes: import("zod").ZodNumber;
  }, import("zod/v4/core").$strip>>;
  readonly emailVerification: import("alepha/api/notifications").NotificationPrimitive<import("zod").ZodObject<{
    email: import("zod").ZodString;
    code: import("zod").ZodString;
    expiresInMinutes: import("zod").ZodNumber;
  }, import("zod/v4/core").$strip>>;
  readonly phoneVerification: import("alepha/api/notifications").NotificationPrimitive<import("zod").ZodObject<{
    phoneNumber: import("zod").ZodString;
    code: import("zod").ZodString;
    expiresInMinutes: import("zod").ZodNumber;
  }, import("zod/v4/core").$strip>>;
  readonly passwordResetLink: import("alepha/api/notifications").NotificationPrimitive<import("zod").ZodObject<{
    email: import("zod").ZodString;
    resetUrl: import("zod").ZodString;
    expiresInMinutes: import("zod").ZodNumber;
  }, import("zod/v4/core").$strip>>;
  readonly accountLockout: import("alepha/api/notifications").NotificationPrimitive<import("zod").ZodObject<{
    email: import("zod").ZodString;
    lockoutMinutes: import("zod").ZodNumber;
  }, import("zod/v4/core").$strip>>;
  readonly emailVerificationLink: import("alepha/api/notifications").NotificationPrimitive<import("zod").ZodObject<{
    email: import("zod").ZodString;
    verifyUrl: import("zod").ZodString;
    expiresInMinutes: import("zod").ZodNumber;
  }, import("zod/v4/core").$strip>>;
}
//#endregion
//#region ../../src/api/users/schemas/createUserSchema.d.ts
declare const createUserSchema: import("zod").ZodObject<{
  id: import("alepha").TOptional<PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>>;
  version: import("alepha").TOptional<PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>>;
  createdAt: import("alepha").TOptional<PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>>;
  updatedAt: import("alepha").TOptional<PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>>;
  username: import("zod").ZodOptional<import("zod").ZodString>;
  email: import("zod").ZodOptional<import("zod").ZodString>;
  phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
  roles: import("alepha").TOptional<PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>>;
  firstName: import("zod").ZodOptional<import("zod").ZodString>;
  lastName: import("zod").ZodOptional<import("zod").ZodString>;
  picture: import("zod").ZodOptional<import("zod").ZodString>;
  enabled: import("alepha").TOptional<PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>>;
  emailVerified: import("alepha").TOptional<PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>>;
  lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
  organizationId: import("alepha").TOptional<PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>>;
}, import("zod/v4/core").$strip>;
type CreateUser = Static<typeof createUserSchema>;
//#endregion
//#region ../../src/api/users/schemas/updateUserSchema.d.ts
declare const updateUserSchema: import("zod").ZodObject<{
  realm: import("zod").ZodOptional<import("alepha").TOptional<PgAttr<import("zod").ZodString, typeof PG_DEFAULT>>>;
  username: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
  email: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
  phoneNumber: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
  roles: import("zod").ZodOptional<import("alepha").TOptional<PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>>>;
  firstName: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
  lastName: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
  picture: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
  enabled: import("zod").ZodOptional<import("alepha").TOptional<PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>>>;
  emailVerified: import("zod").ZodOptional<import("alepha").TOptional<PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>>>;
  lastLoginAt: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
  organizationId: import("zod").ZodOptional<import("alepha").TOptional<PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>>>;
}, import("zod/v4/core").$strip>;
type UpdateUser = Static<typeof updateUserSchema>;
//#endregion
//#region ../../src/api/users/schemas/userQuerySchema.d.ts
declare const userQuerySchema: import("zod").ZodObject<{
  page: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
  size: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
  sort: import("zod").ZodOptional<import("zod").ZodString>;
  search: import("zod").ZodOptional<import("zod").ZodString>;
  email: import("zod").ZodOptional<import("zod").ZodString>;
  enabled: import("zod").ZodOptional<import("zod").ZodBoolean>;
  emailVerified: import("zod").ZodOptional<import("zod").ZodBoolean>;
  roles: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
}, import("zod/v4/core").$strip>;
type UserQuery = Static<typeof userQuerySchema>;
//#endregion
//#region ../../src/api/users/services/UserService.d.ts
declare class UserService {
  protected readonly alepha: Alepha;
  protected readonly log: import("alepha/logger").Logger;
  protected readonly verificationController: import("alepha/server/links").HttpVirtualClient<VerificationController>;
  protected readonly verificationService: VerificationService;
  protected readonly realmProvider: RealmProvider;
  protected readonly cryptoProvider: CryptoProvider;
  protected userAudits(realmName?: string): UserAudits | undefined;
  protected userNotifications(realmName?: string): UserNotifications | undefined;
  users(userRealmName?: string): import("alepha/orm").Repository<import("zod").ZodObject<{
    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodInt, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
    realm: import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_DEFAULT>;
    username: import("zod").ZodOptional<import("zod").ZodString>;
    email: import("zod").ZodOptional<import("zod").ZodString>;
    phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
    roles: import("alepha/orm").PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof import("alepha/orm").PG_DEFAULT>;
    firstName: import("zod").ZodOptional<import("zod").ZodString>;
    lastName: import("zod").ZodOptional<import("zod").ZodString>;
    picture: import("zod").ZodOptional<import("zod").ZodString>;
    enabled: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
    emailVerified: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
    lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
    organizationId: import("alepha/orm").PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof import("alepha/orm").PG_ORGANIZATION>;
  }, import("zod/v4/core").$strip>>;
  /**
   * Request email verification for a user.
   * @param email - The email address to verify.
   * @param userRealmName - Optional realm name.
   * @param method - The verification method: "code" (default) or "link".
   * @param verifyUrl - Base URL for verification link (required when method is "link").
   */
  requestEmailVerification(email: string, userRealmName?: string, method?: "code" | "link"): Promise<boolean>;
  /**
   * Verify a user's email using a valid verification token.
   * Supports both code (6-digit) and link (UUID) verification tokens.
   */
  verifyEmail(email: string, token: string, userRealmName?: string): Promise<void>;
  /**
   * Check if an email is verified.
   */
  isEmailVerified(email: string, userRealmName?: string): Promise<boolean>;
  /**
   * Find users with pagination and filtering.
   */
  findUsers(q?: UserQuery, userRealmName?: string): Promise<Page$1<UserEntity>>;
  /**
   * Get a user by ID.
   */
  getUserById(id: string, userRealmName?: string): Promise<UserEntity>;
  /**
   * Create a new user.
   */
  createUser(data: CreateUser, userRealmName?: string): Promise<UserEntity>;
  /**
   * Update an existing user.
   */
  updateUser(id: string, data: UpdateUser, userRealmName?: string): Promise<UserEntity>;
  /**
   * Set (or reset) a user's password. Upserts a "credentials" identity
   * with the new hash. Used by admin password-set flows; does NOT
   * verify any old password or token — the caller is responsible for
   * authorization.
   */
  setPassword(id: string, newPassword: string, userRealmName?: string): Promise<void>;
  /**
   * Delete a user by ID.
   */
  deleteUser(id: string, userRealmName?: string): Promise<void>;
}
//#endregion
//#region ../../src/api/users/controllers/AdminUserController.d.ts
declare class AdminUserController {
  protected readonly url = "/users";
  protected readonly group = "admin:users";
  protected readonly userService: UserService;
  protected readonly securityProvider: SecurityProvider;
  /**
   * List roles available in a realm. Used by the admin UI to render the
   * role picker and grey out defaults (which cannot be removed).
   */
  readonly findRoles: import("alepha/server").ActionPrimitiveFn<{
    query: import("zod").ZodObject<{
      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodArray<import("zod").ZodObject<{
      name: import("zod").ZodString;
      default: import("zod").ZodOptional<import("zod").ZodBoolean>;
      description: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>>;
  }>;
  /**
   * Find users with pagination and filtering.
   */
  readonly findUsers: import("alepha/server").ActionPrimitiveFn<{
    query: import("zod").ZodObject<{
      page: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
      size: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
      sort: import("zod").ZodOptional<import("zod").ZodString>;
      search: import("zod").ZodOptional<import("zod").ZodString>;
      email: import("zod").ZodOptional<import("zod").ZodString>;
      enabled: import("zod").ZodOptional<import("zod").ZodBoolean>;
      emailVerified: import("zod").ZodOptional<import("zod").ZodBoolean>;
      roles: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      content: import("zod").ZodArray<import("zod").ZodObject<{
        id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
        version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
        createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
        updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
        realm: PgAttr<import("zod").ZodString, typeof PG_DEFAULT>;
        username: import("zod").ZodOptional<import("zod").ZodString>;
        email: import("zod").ZodOptional<import("zod").ZodString>;
        phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
        roles: PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>;
        firstName: import("zod").ZodOptional<import("zod").ZodString>;
        lastName: import("zod").ZodOptional<import("zod").ZodString>;
        picture: import("zod").ZodOptional<import("zod").ZodString>;
        enabled: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
        emailVerified: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
        lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
        organizationId: PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>;
      }, import("zod/v4/core").$strip>>;
      page: import("zod").ZodObject<{
        number: import("zod").ZodInt;
        size: import("zod").ZodInt;
        offset: import("zod").ZodInt;
        numberOfElements: import("zod").ZodInt;
        totalElements: import("zod").ZodOptional<import("zod").ZodInt>;
        totalPages: import("zod").ZodOptional<import("zod").ZodInt>;
        isEmpty: import("zod").ZodBoolean;
        isFirst: import("zod").ZodBoolean;
        isLast: import("zod").ZodBoolean;
      }, import("zod/v4/core").$strip>;
    }, import("zod/v4/core").$strip>;
  }>;
  /**
   * Get a user by ID.
   */
  readonly getUser: import("alepha/server").ActionPrimitiveFn<{
    params: import("zod").ZodObject<{
      id: import("zod").ZodString;
    }, import("zod/v4/core").$strip>;
    query: import("zod").ZodObject<{
      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
      version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
      createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
      updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
      realm: PgAttr<import("zod").ZodString, typeof PG_DEFAULT>;
      username: import("zod").ZodOptional<import("zod").ZodString>;
      email: import("zod").ZodOptional<import("zod").ZodString>;
      phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
      roles: PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>;
      firstName: import("zod").ZodOptional<import("zod").ZodString>;
      lastName: import("zod").ZodOptional<import("zod").ZodString>;
      picture: import("zod").ZodOptional<import("zod").ZodString>;
      enabled: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
      emailVerified: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
      lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
      organizationId: PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>;
    }, import("zod/v4/core").$strip>;
  }>;
  /**
   * Create a new user.
   */
  readonly createUser: import("alepha/server").ActionPrimitiveFn<{
    query: import("zod").ZodObject<{
      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    body: import("zod").ZodObject<{
      id: import("alepha").TOptional<PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>>;
      version: import("alepha").TOptional<PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>>;
      createdAt: import("alepha").TOptional<PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>>;
      updatedAt: import("alepha").TOptional<PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>>;
      username: import("zod").ZodOptional<import("zod").ZodString>;
      email: import("zod").ZodOptional<import("zod").ZodString>;
      phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
      roles: import("alepha").TOptional<PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>>;
      firstName: import("zod").ZodOptional<import("zod").ZodString>;
      lastName: import("zod").ZodOptional<import("zod").ZodString>;
      picture: import("zod").ZodOptional<import("zod").ZodString>;
      enabled: import("alepha").TOptional<PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>>;
      emailVerified: import("alepha").TOptional<PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>>;
      lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
      organizationId: import("alepha").TOptional<PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>>;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
      version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
      createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
      updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
      realm: PgAttr<import("zod").ZodString, typeof PG_DEFAULT>;
      username: import("zod").ZodOptional<import("zod").ZodString>;
      email: import("zod").ZodOptional<import("zod").ZodString>;
      phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
      roles: PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>;
      firstName: import("zod").ZodOptional<import("zod").ZodString>;
      lastName: import("zod").ZodOptional<import("zod").ZodString>;
      picture: import("zod").ZodOptional<import("zod").ZodString>;
      enabled: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
      emailVerified: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
      lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
      organizationId: PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>;
    }, import("zod/v4/core").$strip>;
  }>;
  /**
   * Update a user.
   */
  readonly updateUser: import("alepha/server").ActionPrimitiveFn<{
    params: import("zod").ZodObject<{
      id: import("zod").ZodString;
    }, import("zod/v4/core").$strip>;
    query: import("zod").ZodObject<{
      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    body: import("zod").ZodObject<{
      realm: import("zod").ZodOptional<import("alepha").TOptional<PgAttr<import("zod").ZodString, typeof PG_DEFAULT>>>;
      username: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
      email: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
      phoneNumber: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
      roles: import("zod").ZodOptional<import("alepha").TOptional<PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>>>;
      firstName: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
      lastName: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
      picture: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
      enabled: import("zod").ZodOptional<import("alepha").TOptional<PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>>>;
      emailVerified: import("zod").ZodOptional<import("alepha").TOptional<PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>>>;
      lastLoginAt: import("zod").ZodOptional<import("zod").ZodOptional<import("zod").ZodString>>;
      organizationId: import("zod").ZodOptional<import("alepha").TOptional<PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>>>;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
      version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
      createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
      updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
      realm: PgAttr<import("zod").ZodString, typeof PG_DEFAULT>;
      username: import("zod").ZodOptional<import("zod").ZodString>;
      email: import("zod").ZodOptional<import("zod").ZodString>;
      phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
      roles: PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>;
      firstName: import("zod").ZodOptional<import("zod").ZodString>;
      lastName: import("zod").ZodOptional<import("zod").ZodString>;
      picture: import("zod").ZodOptional<import("zod").ZodString>;
      enabled: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
      emailVerified: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
      lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
      organizationId: PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>;
    }, import("zod/v4/core").$strip>;
  }>;
  /**
   * Set (or reset) a user's password. Admin-only flow — does NOT
   * require knowing the previous password. Hash is stored as a
   * "credentials" identity for the user (upsert).
   */
  readonly setUserPassword: import("alepha/server").ActionPrimitiveFn<{
    params: import("zod").ZodObject<{
      id: import("zod").ZodString;
    }, import("zod/v4/core").$strip>;
    query: import("zod").ZodObject<{
      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    body: import("zod").ZodObject<{
      password: import("zod").ZodString;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      ok: import("zod").ZodBoolean;
      id: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodInt]>>;
      count: import("zod").ZodOptional<import("zod").ZodNumber>;
    }, import("zod/v4/core").$strip>;
  }>;
  /**
   * Delete a user.
   */
  readonly deleteUser: import("alepha/server").ActionPrimitiveFn<{
    params: import("zod").ZodObject<{
      id: import("zod").ZodString;
    }, import("zod/v4/core").$strip>;
    query: import("zod").ZodObject<{
      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      ok: import("zod").ZodBoolean;
      id: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodInt]>>;
      count: import("zod").ZodOptional<import("zod").ZodNumber>;
    }, import("zod/v4/core").$strip>;
  }>;
  /**
   * Delete many users in one request. Each id is processed sequentially so
   * cascades and side-effects run as if called one-by-one. Errors on a single
   * id surface with that id in the response.
   */
  readonly deleteUsers: import("alepha/server").ActionPrimitiveFn<{
    query: import("zod").ZodObject<{
      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    body: import("zod").ZodObject<{
      ids: import("zod").ZodArray<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      deleted: import("zod").ZodArray<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
  }>;
}
//#endregion
//#region ../../src/api/users/controllers/MySessionController.d.ts
/**
 * A session as exposed to ITS OWNER — `refreshToken` is deliberately
 * omitted (returning it would let any XSS exfiltrate a long-lived
 * credential); `current` flags the session backing the calling request.
 */
declare const mySessionSchema: import("zod").ZodObject<{
  id: import("zod").ZodString;
  createdAt: import("zod").ZodString;
  expiresAt: import("zod").ZodString;
  lastUsedAt: import("zod").ZodOptional<import("zod").ZodString>;
  ip: import("zod").ZodOptional<import("zod").ZodString>;
  country: import("zod").ZodOptional<import("zod").ZodString>;
  userAgent: import("zod").ZodOptional<import("zod").ZodObject<{
    os: import("zod").ZodString;
    browser: import("zod").ZodString;
    device: import("zod").ZodEnum<{
      DESKTOP: "DESKTOP";
      MOBILE: "MOBILE";
      TABLET: "TABLET";
    }>;
  }, import("zod/v4/core").$strip>>;
  current: import("zod").ZodBoolean;
}, import("zod/v4/core").$strip>;
type MySession = Static<typeof mySessionSchema>;
/**
 * Self-service session management — the "where am I signed in?" page of an
 * account area. Counterpart of {@link AdminSessionController}, scoped to the
 * CALLER's own sessions: list them, revoke one (a stolen laptop), or revoke
 * everything except the current one.
 */
declare class MySessionController {
  protected readonly realmProvider: RealmProvider;
  protected sessions(realm?: string): Repository$1<import("zod").ZodObject<{
    id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
    version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
    createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
    updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
    refreshToken: import("zod").ZodString;
    userId: PgAttr<import("zod").ZodString, typeof PG_REF>;
    clientId: import("zod").ZodOptional<import("zod").ZodString>;
    expiresAt: import("zod").ZodString;
    lastUsedAt: import("zod").ZodOptional<import("zod").ZodString>;
    ip: import("zod").ZodOptional<import("zod").ZodString>;
    country: import("zod").ZodOptional<import("zod").ZodString>;
    userAgent: import("zod").ZodOptional<import("zod").ZodObject<{
      os: import("zod").ZodString;
      browser: import("zod").ZodString;
      device: import("zod").ZodEnum<{
        DESKTOP: "DESKTOP";
        MOBILE: "MOBILE";
        TABLET: "TABLET";
      }>;
    }, import("zod/v4/core").$strip>>;
  }, import("zod/v4/core").$strip>>;
  protected toMySession(session: {
    id: string;
    createdAt: string;
    expiresAt: string;
    lastUsedAt?: string;
    ip?: string;
    country?: string;
    userAgent?: {
      os: string;
      browser: string;
      device: string;
    };
  }, currentSessionId: string | undefined): MySession;
  listMySessions: import("alepha/server").ActionPrimitiveFn<{
    response: import("zod").ZodArray<import("zod").ZodObject<{
      id: import("zod").ZodString;
      createdAt: import("zod").ZodString;
      expiresAt: import("zod").ZodString;
      lastUsedAt: import("zod").ZodOptional<import("zod").ZodString>;
      ip: import("zod").ZodOptional<import("zod").ZodString>;
      country: import("zod").ZodOptional<import("zod").ZodString>;
      userAgent: import("zod").ZodOptional<import("zod").ZodObject<{
        os: import("zod").ZodString;
        browser: import("zod").ZodString;
        device: import("zod").ZodEnum<{
          DESKTOP: "DESKTOP";
          MOBILE: "MOBILE";
          TABLET: "TABLET";
        }>;
      }, import("zod/v4/core").$strip>>;
      current: import("zod").ZodBoolean;
    }, import("zod/v4/core").$strip>>;
  }>;
  deleteMySession: import("alepha/server").ActionPrimitiveFn<{
    params: import("zod").ZodObject<{
      id: import("zod").ZodString;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      ok: import("zod").ZodBoolean;
    }, import("zod/v4/core").$strip>;
  }>;
  deleteMyOtherSessions: import("alepha/server").ActionPrimitiveFn<{
    response: import("zod").ZodObject<{
      revoked: import("zod").ZodInt;
    }, import("zod/v4/core").$strip>;
  }>;
}
//#endregion
//#region ../../src/api/users/controllers/RealmController.d.ts
/**
 * Controller for exposing realm configuration.
 * Uses $route instead of $action to keep endpoints hidden from API documentation.
 */
declare class RealmController {
  protected readonly url = "/realms";
  protected readonly group = "realms";
  protected readonly realmProvider: RealmProvider;
  protected readonly serverAuthProvider: ServerAuthProvider;
  protected readonly captchaProvider: CaptchaProvider;
  /**
   * Get realm configuration settings.
   * This endpoint is not exposed in the API documentation.
   */
  readonly getRealmConfig: import("alepha/server").ActionPrimitiveFn<{
    query: import("zod").ZodObject<{
      realmName: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      settings: import("zod").ZodObject<{
        displayName: import("zod").ZodOptional<import("zod").ZodString>;
        description: import("zod").ZodOptional<import("zod").ZodString>;
        logoUrl: import("zod").ZodOptional<import("zod").ZodString>;
        registrationAllowed: import("zod").ZodBoolean;
        email: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"none">, import("zod").ZodLiteral<"optional">, import("zod").ZodLiteral<"required">]>;
        username: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"none">, import("zod").ZodLiteral<"optional">, import("zod").ZodLiteral<"required">, import("zod").ZodLiteral<"email">]>;
        usernameRegExp: import("zod").ZodString;
        usernameBlocklist: import("zod").ZodArray<import("zod").ZodString>;
        phoneNumber: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"none">, import("zod").ZodLiteral<"optional">, import("zod").ZodLiteral<"required">]>;
        verifyEmailRequired: import("zod").ZodBoolean;
        verifyPhoneRequired: import("zod").ZodBoolean;
        firstNameLastName: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"none">, import("zod").ZodLiteral<"optional">, import("zod").ZodLiteral<"required">]>;
        resetPasswordAllowed: import("zod").ZodBoolean;
        captchaRequired: import("zod").ZodBoolean;
        adminEmails: import("zod").ZodArray<import("zod").ZodString>;
        adminUsernames: import("zod").ZodArray<import("zod").ZodString>;
        defaultRoles: import("zod").ZodArray<import("zod").ZodString>;
        verifyEmailUrl: import("zod").ZodOptional<import("zod").ZodString>;
        passwordPolicy: import("zod").ZodObject<{
          minLength: import("zod").ZodDefault<import("zod").ZodInt>;
          requireUppercase: import("zod").ZodBoolean;
          requireLowercase: import("zod").ZodBoolean;
          requireNumbers: import("zod").ZodBoolean;
          requireSpecialCharacters: import("zod").ZodBoolean;
        }, import("zod/v4/core").$strip>;
        loginRateLimit: import("zod").ZodObject<{
          ipMaxAttempts: import("zod").ZodDefault<import("zod").ZodInt>;
          accountMaxAttempts: import("zod").ZodDefault<import("zod").ZodInt>;
          windowMs: import("zod").ZodDefault<import("zod").ZodInt>;
        }, import("zod/v4/core").$strip>;
        registrationIpMaxAttempts: import("zod").ZodDefault<import("zod").ZodInt>;
        refreshToken: import("zod").ZodObject<{
          expirationIdle: import("zod").ZodOptional<import("zod").ZodInt>;
        }, import("zod/v4/core").$strip>;
      }, import("zod/v4/core").$strip>;
      realmName: import("zod").ZodString;
      authenticationMethods: import("zod").ZodArray<import("zod").ZodObject<{
        name: import("zod").ZodString;
        type: import("zod").ZodEnum<{
          CREDENTIALS: "CREDENTIALS";
          OAUTH2: "OAUTH2";
          OIDC: "OIDC";
        }>;
      }, import("zod/v4/core").$strip>>;
      captchaSiteKey: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
  }>;
  readonly checkUsernameAvailability: import("alepha/server").ActionPrimitiveFn<{
    query: import("zod").ZodObject<{
      realmName: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    body: import("zod").ZodObject<{
      username: import("zod").ZodString;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      available: import("zod").ZodBoolean;
    }, import("zod/v4/core").$strip>;
  }>;
}
//#endregion
//#region ../../src/api/users/schemas/completePasswordResetRequestSchema.d.ts
/**
 * Request schema for completing a password reset.
 *
 * Requires the intent ID from Phase 1, the verification code,
 * and the new password.
 */
declare const completePasswordResetRequestSchema: import("zod").ZodObject<{
  intentId: import("zod").ZodString;
  code: import("zod").ZodString;
  newPassword: import("zod").ZodString;
}, import("zod/v4/core").$strip>;
type CompletePasswordResetRequest = Static<typeof completePasswordResetRequestSchema>;
//#endregion
//#region ../../src/api/users/schemas/passwordResetIntentResponseSchema.d.ts
/**
 * Response schema for password reset intent creation.
 *
 * Contains the intent ID needed for Phase 2 completion,
 * along with expiration time.
 */
declare const passwordResetIntentResponseSchema: import("zod").ZodObject<{
  intentId: import("zod").ZodString;
  expiresAt: import("zod").ZodString;
}, import("zod/v4/core").$strip>;
type PasswordResetIntentResponse = Static<typeof passwordResetIntentResponseSchema>;
//#endregion
//#region ../../src/api/users/services/CredentialService.d.ts
/**
 * Intent stored in cache during the password reset flow.
 */
interface PasswordResetIntent {
  email: string;
  userId: string;
  identityId: string;
  realmName?: string;
  expiresAt: string;
}
declare class CredentialService {
  protected readonly alepha: Alepha;
  protected readonly log: import("alepha/logger").Logger;
  protected readonly cryptoProvider: CryptoProvider;
  protected readonly dateTimeProvider: DateTimeProvider;
  protected readonly verificationService: VerificationService;
  protected readonly realmProvider: RealmProvider;
  protected userAudits(realmName?: string): UserAudits | undefined;
  protected sessionAudits(realmName?: string): SessionAudits | undefined;
  protected userNotifications(realmName?: string): UserNotifications | undefined;
  protected readonly intentCache: import("alepha/cache").CacheMiddlewareFn<PasswordResetIntent>;
  users(userRealmName?: string): Repository$1<import("zod").ZodObject<{
    id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
    version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
    createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
    updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
    realm: PgAttr<import("zod").ZodString, typeof PG_DEFAULT>;
    username: import("zod").ZodOptional<import("zod").ZodString>;
    email: import("zod").ZodOptional<import("zod").ZodString>;
    phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
    roles: PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>;
    firstName: import("zod").ZodOptional<import("zod").ZodString>;
    lastName: import("zod").ZodOptional<import("zod").ZodString>;
    picture: import("zod").ZodOptional<import("zod").ZodString>;
    enabled: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
    emailVerified: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
    lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
    organizationId: PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>;
  }, import("zod/v4/core").$strip>>;
  sessions(userRealmName?: string): Repository$1<import("zod").ZodObject<{
    id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
    version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
    createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
    updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
    refreshToken: import("zod").ZodString;
    userId: PgAttr<import("zod").ZodString, typeof PG_REF>;
    clientId: import("zod").ZodOptional<import("zod").ZodString>;
    expiresAt: import("zod").ZodString;
    lastUsedAt: import("zod").ZodOptional<import("zod").ZodString>;
    ip: import("zod").ZodOptional<import("zod").ZodString>;
    country: import("zod").ZodOptional<import("zod").ZodString>;
    userAgent: import("zod").ZodOptional<import("zod").ZodObject<{
      os: import("zod").ZodString;
      browser: import("zod").ZodString;
      device: import("zod").ZodEnum<{
        DESKTOP: "DESKTOP";
        MOBILE: "MOBILE";
        TABLET: "TABLET";
      }>;
    }, import("zod/v4/core").$strip>>;
  }, import("zod/v4/core").$strip>>;
  identities(userRealmName?: string): Repository$1<import("zod").ZodObject<{
    id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
    version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
    createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
    updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
    userId: PgAttr<import("zod").ZodString, typeof PG_REF>;
    password: import("zod").ZodOptional<import("zod").ZodString>;
    provider: import("zod").ZodString;
    providerUserId: import("zod").ZodOptional<import("zod").ZodString>;
    providerData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
  }, import("zod/v4/core").$strip>>;
  /**
   * Validate a password against the realm's password policy.
   */
  validatePasswordPolicy(password: string, policy: RealmAuthSettings["passwordPolicy"]): void;
  /**
   * Phase 1: Create a password reset intent.
   *
   * Validates the email, checks for existing user with credentials,
   * sends verification code, and stores the intent in cache.
   *
   * @param email - User's email address
   * @param userRealmName - Optional realm name
   * @returns Intent response with intentId and expiration (always returns for security)
   */
  createPasswordResetIntent(email: string, userRealmName?: string): Promise<PasswordResetIntentResponse>;
  /**
   * Phase 2: Complete password reset using an intent.
   *
   * Validates the verification code, updates the password,
   * and invalidates all existing sessions.
   *
   * @param body - Request body with intentId, code, and newPassword
   */
  completePasswordReset(body: CompletePasswordResetRequest): Promise<void>;
  /**
   * @deprecated Use createPasswordResetIntent instead
   */
  requestPasswordReset(email: string, userRealmName?: string): Promise<boolean>;
  /**
   * @deprecated Use completePasswordReset instead
   */
  validateResetToken(email: string, token: string, _userRealmName?: string): Promise<string>;
  /**
   * @deprecated Use completePasswordReset instead
   */
  resetPassword(email: string, token: string, newPassword: string, userRealmName?: string): Promise<void>;
}
//#endregion
//#region ../../src/api/users/schemas/completeRegistrationRequestSchema.d.ts
declare const completeRegistrationRequestSchema: import("zod").ZodObject<{
  intentId: import("zod").ZodString;
  emailCode: import("zod").ZodOptional<import("zod").ZodString>;
  phoneCode: import("zod").ZodOptional<import("zod").ZodString>;
  captchaToken: import("zod").ZodOptional<import("zod").ZodString>;
}, import("zod/v4/core").$strip>;
type CompleteRegistrationRequest = Static<typeof completeRegistrationRequestSchema>;
//#endregion
//#region ../../src/api/users/schemas/registerRequestSchema.d.ts
/**
 * Schema for user registration request body.
 * Password is always required, other fields depend on realm settings.
 */
declare const registerRequestSchema: import("zod").ZodObject<{
  password: import("zod").ZodString;
  username: import("zod").ZodOptional<import("zod").ZodString>;
  email: import("zod").ZodOptional<import("zod").ZodString>;
  phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
  firstName: import("zod").ZodOptional<import("zod").ZodString>;
  lastName: import("zod").ZodOptional<import("zod").ZodString>;
  picture: import("zod").ZodOptional<import("zod").ZodString>;
  captchaToken: import("zod").ZodOptional<import("zod").ZodString>;
}, import("zod/v4/core").$strip>;
type RegisterRequest = Static<typeof registerRequestSchema>;
//#endregion
//#region ../../src/api/users/schemas/registrationIntentResponseSchema.d.ts
declare const registrationIntentResponseSchema: import("zod").ZodObject<{
  intentId: import("zod").ZodString;
  expectCaptcha: import("zod").ZodBoolean;
  captchaSiteKey: import("zod").ZodOptional<import("zod").ZodString>;
  expectEmailVerification: import("zod").ZodBoolean;
  expectPhoneVerification: import("zod").ZodBoolean;
  expiresAt: import("zod").ZodString;
}, import("zod/v4/core").$strip>;
type RegistrationIntentResponse = Static<typeof registrationIntentResponseSchema>;
//#endregion
//#region ../../src/api/users/services/UsernameSlugger.d.ts
/**
 * Derive stable, URL-safe usernames from email addresses.
 *
 * Used by the registration flow when `realm.settings.username === "email"`,
 * and reusable from any custom user-creation site (e.g. an OAuth-only flow
 * that wants the same handle convention).
 *
 * **Slug rule** — the local-part of the email is kept as-is (gmail
 * `+suffix` retained for predictability). Everything outside `[a-z0-9]` is
 * replaced with `-`, runs of `-` are collapsed, leading/trailing `-` are
 * trimmed, lowercased. If the result is shorter than {@link MIN_LENGTH} it
 * is padded with random alphanumerics. Result is clamped to
 * {@link MAX_LENGTH}.
 *
 * **Collision retry** — `pickAvailable()` checks the realm's `users` table
 * and the realm's `usernameBlocklist`. On hit, it appends `-<4 random>` and
 * retries up to {@link MAX_RETRIES} times. Best-effort against concurrent
 * registrations: the unique index on `(realm, lower(username))` is the
 * authoritative race guard, callers that hit a unique-violation should
 * call `pickAvailable` again with a fresh suffix.
 *
 * @see RegistrationService.createRegistrationIntent
 */
declare class UsernameSlugger {
  protected readonly realmProvider: RealmProvider;
  protected readonly log: import("alepha/logger").Logger;
  /**
   * Floor for derived usernames. Shorter slugs are padded with random
   * alphanumerics. Matches the lower bound of the default `usernameRegExp`.
   */
  static readonly MIN_LENGTH = 3;
  /**
   * Ceiling for derived usernames. Matches the upper bound of the default
   * `usernameRegExp` and gives enough headroom for the random suffix added
   * on collisions.
   */
  static readonly MAX_LENGTH = 30;
  /**
   * Length of the random suffix appended on collision (e.g. `-3dp6`).
   * 36⁴ ≈ 1.6M variants per base — plenty for a tiny number of retries.
   */
  static readonly SUFFIX_LENGTH = 4;
  /**
   * How many times `pickAvailable` retries before giving up.
   */
  static readonly MAX_RETRIES = 5;
  /**
   * Alphabet used for the random suffix and for padding short slugs.
   */
  static readonly ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
  /**
   * Default replacement when the email's local-part contains no
   * `[a-z0-9]` characters at all (rare but possible: `é@example.com`).
   */
  static readonly EMPTY_LOCAL_FALLBACK = "user";
  /**
   * Sanitize an email into a base username slug.
   *
   * Pure function — no DB access. Always returns a string that satisfies
   * `^[a-z0-9-]{MIN_LENGTH,MAX_LENGTH}$`.
   *
   * @example
   * slug("ni.foures+testkv@gmail.com") // "ni-foures-testkv"
   * slug("john.doe@example.com")       // "john-doe"
   * slug("é@example.com")              // "user-XXX" (padded)
   */
  slug(email: string | null | undefined): string;
  /**
   * Find an available username for the realm, starting from `base`.
   *
   * Returns `base` when nothing collides. On a hit (existing row OR
   * blocklisted name) appends `-<4 random>` and tries again, up to
   * {@link MAX_RETRIES} times.
   *
   * The check is best-effort: a concurrent registration may still claim
   * the same value before the caller's INSERT runs, in which case the DB
   * unique index throws and the caller should retry.
   */
  pickAvailable(realmName: string | undefined, base: string): Promise<string>;
  /**
   * Check a name against the realm's `usernameBlocklist`. Case-insensitive.
   */
  isBlocked(realmName: string | undefined, name: string): Promise<boolean>;
  protected getBlocklist(realmName: string | undefined): Promise<Set<string>>;
  protected isBlockedAgainst(name: string, blocklist: Set<string>): boolean;
  protected clamp(s: string): string;
  protected randomSuffix(length: number): string;
}
//#endregion
//#region ../../src/api/users/services/RegistrationService.d.ts
/**
 * Intent stored in cache during the registration flow.
 */
interface RegistrationIntent {
  data: {
    username?: string;
    email?: string;
    phoneNumber?: string;
    firstName?: string;
    lastName?: string;
    picture?: string;
    passwordHash: string;
  };
  requirements: {
    email: boolean;
    phone: boolean;
    captcha: boolean;
  };
  realmName?: string;
  expiresAt: string;
}
declare class RegistrationService {
  protected readonly alepha: Alepha;
  protected readonly log: import("alepha/logger").Logger;
  protected readonly dateTimeProvider: DateTimeProvider;
  protected readonly cryptoProvider: CryptoProvider;
  protected readonly verificationController: import("alepha/server/links").HttpVirtualClient<VerificationController>;
  protected readonly verificationService: VerificationService;
  protected readonly realmProvider: RealmProvider;
  protected readonly credentialService: CredentialService;
  protected readonly captchaProvider: CaptchaProvider;
  protected readonly usernameSlugger: UsernameSlugger;
  protected readonly intentCache: import("alepha/cache").CacheMiddlewareFn<RegistrationIntent>;
  protected readonly rateLimitCache: import("alepha/cache").CacheMiddlewareFn<number>;
  protected userAudits(realmName?: string): UserAudits | undefined;
  protected userNotifications(realmName?: string): UserNotifications;
  /**
   * Phase 1: Create a registration intent.
   *
   * Validates the registration data, checks for existing users,
   * creates verification sessions, and stores the intent in cache.
   */
  createRegistrationIntent(body: RegisterRequest, userRealmName?: string): Promise<RegistrationIntentResponse>;
  /**
   * Phase 2: Complete registration using an intent.
   *
   * Validates all requirements (verification codes, captcha),
   * creates the user and credentials, and returns the user.
   */
  completeRegistration(body: CompleteRegistrationRequest): Promise<UserEntity>;
  /**
   * Check if username, email, and phone are available.
   */
  protected checkUserAvailability(body: Pick<RegisterRequest, "username" | "email" | "phoneNumber">, userRealmName?: string): Promise<void>;
  /**
   * Send email verification code.
   */
  protected sendEmailVerification(email: string, realmName?: string): Promise<void>;
  /**
   * Send phone verification code.
   */
  protected sendPhoneVerification(phoneNumber: string, realmName?: string): Promise<void>;
  /**
   * Verify email code using verification service.
   */
  protected verifyEmailCode(email: string, code: string): Promise<void>;
  /**
   * Verify phone code using verification service.
   */
  protected verifyPhoneCode(phoneNumber: string, code: string): Promise<void>;
}
//#endregion
//#region ../../src/api/users/controllers/UserController.d.ts
declare class UserController {
  protected readonly url = "/users";
  protected readonly group = "users";
  protected readonly credentialService: CredentialService;
  protected readonly userService: UserService;
  protected readonly registrationService: RegistrationService;
  /**
   * Phase 1: Create a registration intent.
   * Validates data, creates verification sessions, and stores intent in cache.
   */
  readonly createRegistrationIntent: import("alepha/server").ActionPrimitiveFn<{
    body: import("zod").ZodObject<{
      password: import("zod").ZodString;
      username: import("zod").ZodOptional<import("zod").ZodString>;
      email: import("zod").ZodOptional<import("zod").ZodString>;
      phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
      firstName: import("zod").ZodOptional<import("zod").ZodString>;
      lastName: import("zod").ZodOptional<import("zod").ZodString>;
      picture: import("zod").ZodOptional<import("zod").ZodString>;
      captchaToken: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    query: import("zod").ZodObject<{
      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      intentId: import("zod").ZodString;
      expectCaptcha: import("zod").ZodBoolean;
      captchaSiteKey: import("zod").ZodOptional<import("zod").ZodString>;
      expectEmailVerification: import("zod").ZodBoolean;
      expectPhoneVerification: import("zod").ZodBoolean;
      expiresAt: import("zod").ZodString;
    }, import("zod/v4/core").$strip>;
  }>;
  /**
   * Phase 2: Complete registration using an intent.
   * Validates verification codes and creates the user.
   */
  readonly createUserFromIntent: import("alepha/server").ActionPrimitiveFn<{
    body: import("zod").ZodObject<{
      intentId: import("zod").ZodString;
      emailCode: import("zod").ZodOptional<import("zod").ZodString>;
      phoneCode: import("zod").ZodOptional<import("zod").ZodString>;
      captchaToken: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
      version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
      createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
      updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
      realm: PgAttr<import("zod").ZodString, typeof PG_DEFAULT>;
      username: import("zod").ZodOptional<import("zod").ZodString>;
      email: import("zod").ZodOptional<import("zod").ZodString>;
      phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
      roles: PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>;
      firstName: import("zod").ZodOptional<import("zod").ZodString>;
      lastName: import("zod").ZodOptional<import("zod").ZodString>;
      picture: import("zod").ZodOptional<import("zod").ZodString>;
      enabled: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
      emailVerified: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
      lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
      organizationId: PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>;
    }, import("zod/v4/core").$strip>;
  }>;
  /**
   * Phase 1: Create a password reset intent.
   * Validates email, sends verification code, and stores intent in cache.
   */
  readonly createPasswordResetIntent: import("alepha/server").ActionPrimitiveFn<{
    query: import("zod").ZodObject<{
      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    body: import("zod").ZodObject<{
      email: import("zod").ZodString;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      intentId: import("zod").ZodString;
      expiresAt: import("zod").ZodString;
    }, import("zod/v4/core").$strip>;
  }>;
  /**
   * Phase 2: Complete password reset using an intent.
   * Validates verification code, updates password, and invalidates sessions.
   */
  readonly completePasswordReset: import("alepha/server").ActionPrimitiveFn<{
    body: import("zod").ZodObject<{
      intentId: import("zod").ZodString;
      code: import("zod").ZodString;
      newPassword: import("zod").ZodString;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      ok: import("zod").ZodBoolean;
      id: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodInt]>>;
      count: import("zod").ZodOptional<import("zod").ZodNumber>;
    }, import("zod/v4/core").$strip>;
  }>;
  /**
   * @deprecated Use createPasswordResetIntent instead
   */
  requestPasswordReset: import("alepha/server").ActionPrimitiveFn<{
    query: import("zod").ZodObject<{
      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    body: import("zod").ZodObject<{
      email: import("zod").ZodString;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      success: import("zod").ZodBoolean;
      message: import("zod").ZodString;
    }, import("zod/v4/core").$strip>;
  }>;
  /**
   * @deprecated Use completePasswordReset instead
   */
  validateResetToken: import("alepha/server").ActionPrimitiveFn<{
    query: import("zod").ZodObject<{
      email: import("zod").ZodString;
      token: import("zod").ZodString;
      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      valid: import("zod").ZodBoolean;
      email: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
  }>;
  /**
   * @deprecated Use completePasswordReset instead
   */
  resetPassword: import("alepha/server").ActionPrimitiveFn<{
    query: import("zod").ZodObject<{
      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    body: import("zod").ZodObject<{
      email: import("zod").ZodString;
      token: import("zod").ZodString;
      newPassword: import("zod").ZodString;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      success: import("zod").ZodBoolean;
      message: import("zod").ZodString;
    }, import("zod/v4/core").$strip>;
  }>;
  /**
   * Request email verification.
   * Generates a verification token using verification service and sends an email to the user.
   * @param method - The verification method: "code" (default) sends a 6-digit code, "link" sends a clickable verification link.
   * @param verifyUrl - Required when method is "link". The base URL for the verification link. Token and email will be appended as query params.
   */
  requestEmailVerification: import("alepha/server").ActionPrimitiveFn<{
    query: import("zod").ZodObject<{
      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
      method: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodEnum<{
        code: "code";
        link: "link";
      }>>>;
    }, import("zod/v4/core").$strip>;
    body: import("zod").ZodObject<{
      email: import("zod").ZodString;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      success: import("zod").ZodBoolean;
      message: import("zod").ZodString;
    }, import("zod/v4/core").$strip>;
  }>;
  /**
   * Verify email with a valid token.
   * Updates the user's emailVerified status.
   */
  verifyEmail: import("alepha/server").ActionPrimitiveFn<{
    query: import("zod").ZodObject<{
      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    body: import("zod").ZodObject<{
      email: import("zod").ZodString;
      token: import("zod").ZodString;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      success: import("zod").ZodBoolean;
      message: import("zod").ZodString;
    }, import("zod/v4/core").$strip>;
  }>;
  /**
   * Check if an email is verified.
   */
  checkEmailVerification: import("alepha/server").ActionPrimitiveFn<{
    query: import("zod").ZodObject<{
      email: import("zod").ZodString;
      userRealmName: import("zod").ZodOptional<import("zod").ZodString>;
    }, import("zod/v4/core").$strip>;
    response: import("zod").ZodObject<{
      verified: import("zod").ZodBoolean;
    }, import("zod/v4/core").$strip>;
  }>;
}
//#endregion
//#region ../../src/api/users/jobs/UserJobs.d.ts
/**
 * User-specific jobs wrapper service.
 *
 * This service handles user-related scheduled jobs such as:
 * - Session purge (cleaning up expired sessions)
 * - Verification code cleanup
 * - Inactive user notifications
 *
 * Declared as a module variant — not auto-injected. It is instantiated
 * lazily the first time something calls `alepha.inject(UserJobs)`.
 */
declare class UserJobs {
  protected readonly log: import("alepha/logger").Logger;
  protected readonly dateTimeProvider: DateTimeProvider;
  protected readonly sessionRepository: import("alepha/orm").Repository<import("zod").ZodObject<{
    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
    version: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodInt, typeof import("alepha/orm").PG_VERSION>, typeof import("alepha/orm").PG_DEFAULT>;
    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
    refreshToken: import("zod").ZodString;
    userId: import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_REF>;
    clientId: import("zod").ZodOptional<import("zod").ZodString>;
    expiresAt: import("zod").ZodString;
    lastUsedAt: import("zod").ZodOptional<import("zod").ZodString>;
    ip: import("zod").ZodOptional<import("zod").ZodString>;
    country: import("zod").ZodOptional<import("zod").ZodString>;
    userAgent: import("zod").ZodOptional<import("zod").ZodObject<{
      os: import("zod").ZodString;
      browser: import("zod").ZodString;
      device: import("zod").ZodEnum<{
        DESKTOP: "DESKTOP";
        MOBILE: "MOBILE";
        TABLET: "TABLET";
      }>;
    }, import("zod/v4/core").$strip>>;
  }, import("zod/v4/core").$strip>>;
  protected readonly realmProvider: RealmProvider;
  /**
   * Purge expired sessions from the database.
   *
   * Runs hourly (at :00) and deletes:
   * - sessions whose absolute `expiresAt` has passed
   * - sessions whose `lastUsedAt` exceeds the realm's `refreshToken.expirationIdle`
   *   (when configured). Falls back to `createdAt` for sessions without a
   *   recorded `lastUsedAt`.
   *
   * The idle sweep is best-effort cleanup — runtime enforcement happens in
   * `SessionService.refreshSession()`.
   */
  readonly purgeExpiredSessions: import("alepha/api/jobs").JobPrimitive<import("alepha").ZType>;
}
//#endregion
//#region ../../src/api/users/schemas/identityResourceSchema.d.ts
declare const identityResourceSchema: import("zod").ZodObject<{
  id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
  version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
  createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
  updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
  userId: PgAttr<import("zod").ZodString, typeof PG_REF>;
  provider: import("zod").ZodString;
  providerUserId: import("zod").ZodOptional<import("zod").ZodString>;
  providerData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
}, import("zod/v4/core").$strip>;
type IdentityResource = Static<typeof identityResourceSchema>;
//#endregion
//#region ../../src/api/users/schemas/loginSchema.d.ts
declare const loginSchema: import("zod").ZodObject<{
  username: import("zod").ZodString;
  password: import("zod").ZodString;
}, import("zod/v4/core").$strip>;
type LoginInput = Static<typeof loginSchema>;
//#endregion
//#region ../../src/api/users/schemas/realmConfigSchema.d.ts
declare const realmConfigSchema: import("zod").ZodObject<{
  settings: import("zod").ZodObject<{
    displayName: import("zod").ZodOptional<import("zod").ZodString>;
    description: import("zod").ZodOptional<import("zod").ZodString>;
    logoUrl: import("zod").ZodOptional<import("zod").ZodString>;
    registrationAllowed: import("zod").ZodBoolean;
    email: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"none">, import("zod").ZodLiteral<"optional">, import("zod").ZodLiteral<"required">]>;
    username: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"none">, import("zod").ZodLiteral<"optional">, import("zod").ZodLiteral<"required">, import("zod").ZodLiteral<"email">]>;
    usernameRegExp: import("zod").ZodString;
    usernameBlocklist: import("zod").ZodArray<import("zod").ZodString>;
    phoneNumber: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"none">, import("zod").ZodLiteral<"optional">, import("zod").ZodLiteral<"required">]>;
    verifyEmailRequired: import("zod").ZodBoolean;
    verifyPhoneRequired: import("zod").ZodBoolean;
    firstNameLastName: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"none">, import("zod").ZodLiteral<"optional">, import("zod").ZodLiteral<"required">]>;
    resetPasswordAllowed: import("zod").ZodBoolean;
    captchaRequired: import("zod").ZodBoolean;
    adminEmails: import("zod").ZodArray<import("zod").ZodString>;
    adminUsernames: import("zod").ZodArray<import("zod").ZodString>;
    defaultRoles: import("zod").ZodArray<import("zod").ZodString>;
    verifyEmailUrl: import("zod").ZodOptional<import("zod").ZodString>;
    passwordPolicy: import("zod").ZodObject<{
      minLength: import("zod").ZodDefault<import("zod").ZodInt>;
      requireUppercase: import("zod").ZodBoolean;
      requireLowercase: import("zod").ZodBoolean;
      requireNumbers: import("zod").ZodBoolean;
      requireSpecialCharacters: import("zod").ZodBoolean;
    }, import("zod/v4/core").$strip>;
    loginRateLimit: import("zod").ZodObject<{
      ipMaxAttempts: import("zod").ZodDefault<import("zod").ZodInt>;
      accountMaxAttempts: import("zod").ZodDefault<import("zod").ZodInt>;
      windowMs: import("zod").ZodDefault<import("zod").ZodInt>;
    }, import("zod/v4/core").$strip>;
    registrationIpMaxAttempts: import("zod").ZodDefault<import("zod").ZodInt>;
    refreshToken: import("zod").ZodObject<{
      expirationIdle: import("zod").ZodOptional<import("zod").ZodInt>;
    }, import("zod/v4/core").$strip>;
  }, import("zod/v4/core").$strip>;
  realmName: import("zod").ZodString;
  authenticationMethods: import("zod").ZodArray<import("zod").ZodObject<{
    name: import("zod").ZodString;
    type: import("zod").ZodEnum<{
      CREDENTIALS: "CREDENTIALS";
      OAUTH2: "OAUTH2";
      OIDC: "OIDC";
    }>;
  }, import("zod/v4/core").$strip>>;
  captchaSiteKey: import("zod").ZodOptional<import("zod").ZodString>;
}, import("zod/v4/core").$strip>;
type RealmConfig = Static<typeof realmConfigSchema>;
//#endregion
//#region ../../src/api/users/schemas/registerSchema.d.ts
declare const registerSchema: import("zod").ZodObject<{
  username: import("zod").ZodString;
  email: import("zod").ZodString;
  password: import("zod").ZodString;
  confirmPassword: import("zod").ZodString;
  firstName: import("zod").ZodOptional<import("zod").ZodString>;
  lastName: import("zod").ZodOptional<import("zod").ZodString>;
}, import("zod/v4/core").$strip>;
type RegisterInput = Static<typeof registerSchema>;
//#endregion
//#region ../../src/api/users/schemas/resetPasswordSchema.d.ts
declare const resetPasswordRequestSchema: import("zod").ZodObject<{
  email: import("zod").ZodString;
}, import("zod/v4/core").$strip>;
declare const resetPasswordSchema: import("zod").ZodObject<{
  token: import("zod").ZodString;
  password: import("zod").ZodString;
  confirmPassword: import("zod").ZodString;
}, import("zod/v4/core").$strip>;
type ResetPasswordRequest = Static<typeof resetPasswordRequestSchema>;
type ResetPasswordInput = Static<typeof resetPasswordSchema>;
//#endregion
//#region ../../src/api/users/schemas/sessionResourceSchema.d.ts
/**
 * Slim view of the session's owner — embedded by the admin listing so the
 * UI can render a human-readable identifier instead of just a UUID. Comes
 * back via a left join, so it's optional (a session whose user was deleted
 * still returns; `user` is undefined).
 */
declare const sessionUserSummarySchema: import("zod").ZodObject<{
  id: import("zod").ZodString;
  email: import("zod").ZodOptional<import("zod").ZodString>;
  username: import("zod").ZodOptional<import("zod").ZodString>;
  firstName: import("zod").ZodOptional<import("zod").ZodString>;
  lastName: import("zod").ZodOptional<import("zod").ZodString>;
}, import("zod/v4/core").$strip>;
declare const sessionResourceSchema: import("zod").ZodObject<{
  id: import("zod").ZodString;
  version: import("zod").ZodNumber;
  createdAt: import("zod").ZodString;
  updatedAt: import("zod").ZodString;
  refreshToken: import("zod").ZodString;
  userId: import("zod").ZodString;
  expiresAt: import("zod").ZodString;
  ip: import("zod").ZodOptional<import("zod").ZodString>;
  country: import("zod").ZodOptional<import("zod").ZodString>;
  userAgent: import("zod").ZodOptional<import("zod").ZodObject<{
    os: import("zod").ZodString;
    browser: import("zod").ZodString;
    device: import("zod").ZodEnum<{
      DESKTOP: "DESKTOP";
      MOBILE: "MOBILE";
      TABLET: "TABLET";
    }>;
  }, import("zod/v4/core").$strip>>;
  user: import("zod").ZodOptional<import("zod").ZodObject<{
    id: import("zod").ZodString;
    email: import("zod").ZodOptional<import("zod").ZodString>;
    username: import("zod").ZodOptional<import("zod").ZodString>;
    firstName: import("zod").ZodOptional<import("zod").ZodString>;
    lastName: import("zod").ZodOptional<import("zod").ZodString>;
  }, import("zod/v4/core").$strip>>;
}, import("zod/v4/core").$strip>;
type SessionResource = Static<typeof sessionResourceSchema>;
//#endregion
//#region ../../src/api/users/schemas/userResourceSchema.d.ts
declare const userResourceSchema: import("zod").ZodObject<{
  id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
  version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
  createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
  updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
  realm: PgAttr<import("zod").ZodString, typeof PG_DEFAULT>;
  username: import("zod").ZodOptional<import("zod").ZodString>;
  email: import("zod").ZodOptional<import("zod").ZodString>;
  phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
  roles: PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>;
  firstName: import("zod").ZodOptional<import("zod").ZodString>;
  lastName: import("zod").ZodOptional<import("zod").ZodString>;
  picture: import("zod").ZodOptional<import("zod").ZodString>;
  enabled: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
  emailVerified: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
  lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
  organizationId: PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>;
}, import("zod/v4/core").$strip>;
type UserResource = Static<typeof userResourceSchema>;
//#endregion
//#region ../../src/api/users/services/SessionService.d.ts
declare class SessionService {
  protected readonly alepha: Alepha;
  protected readonly fsp: FileSystemProvider;
  protected readonly dateTimeProvider: DateTimeProvider;
  protected readonly cryptoProvider: CryptoProvider;
  protected readonly log: import("alepha/logger").Logger;
  protected readonly realmProvider: RealmProvider;
  protected readonly fileController: import("alepha/server/links").HttpVirtualClient<FileController>;
  protected readonly cacheProvider: CacheProvider;
  protected readonly usernameSlugger: UsernameSlugger;
  protected userAudits(realmName?: string): UserAudits | undefined;
  protected sessionAudits(realmName?: string): SessionAudits | undefined;
  protected userNotifications(realmName?: string): UserNotifications | undefined;
  users(userRealmName?: string): Repository$1<import("zod").ZodObject<{
    id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
    version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
    createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
    updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
    realm: PgAttr<import("zod").ZodString, typeof PG_DEFAULT>;
    username: import("zod").ZodOptional<import("zod").ZodString>;
    email: import("zod").ZodOptional<import("zod").ZodString>;
    phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
    roles: PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>;
    firstName: import("zod").ZodOptional<import("zod").ZodString>;
    lastName: import("zod").ZodOptional<import("zod").ZodString>;
    picture: import("zod").ZodOptional<import("zod").ZodString>;
    enabled: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
    emailVerified: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
    lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
    organizationId: PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>;
  }, import("zod/v4/core").$strip>>;
  sessions(userRealmName?: string): Repository$1<import("zod").ZodObject<{
    id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
    version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
    createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
    updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
    refreshToken: import("zod").ZodString;
    userId: PgAttr<import("zod").ZodString, typeof PG_REF>;
    clientId: import("zod").ZodOptional<import("zod").ZodString>;
    expiresAt: import("zod").ZodString;
    lastUsedAt: import("zod").ZodOptional<import("zod").ZodString>;
    ip: import("zod").ZodOptional<import("zod").ZodString>;
    country: import("zod").ZodOptional<import("zod").ZodString>;
    userAgent: import("zod").ZodOptional<import("zod").ZodObject<{
      os: import("zod").ZodString;
      browser: import("zod").ZodString;
      device: import("zod").ZodEnum<{
        DESKTOP: "DESKTOP";
        MOBILE: "MOBILE";
        TABLET: "TABLET";
      }>;
    }, import("zod/v4/core").$strip>>;
  }, import("zod/v4/core").$strip>>;
  identities(userRealmName?: string): Repository$1<import("zod").ZodObject<{
    id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
    version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
    createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
    updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
    userId: PgAttr<import("zod").ZodString, typeof PG_REF>;
    password: import("zod").ZodOptional<import("zod").ZodString>;
    provider: import("zod").ZodString;
    providerUserId: import("zod").ZodOptional<import("zod").ZodString>;
    providerData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
  }, import("zod/v4/core").$strip>>;
  /**
   * Check if user should be auto-promoted to admin based on adminEmails/adminUsernames settings.
   * If user matches and doesn't have admin role, promote them.
   */
  protected ensureAdminRole(user: {
    id: string;
    email?: string | null;
    username?: string | null;
    roles: string[];
  }, userRealmName?: string): Promise<boolean>;
  /**
   * Generate a unique username from an OAuth profile.
   *
   * Routes through {@link UsernameSlugger}, which is the same code path as
   * `username: "email"` registration. The OAuth profile's email is the
   * primary signal; if absent (rare — most IDPs return one), we fall back
   * to `profile.name`, then to a random handle. The slugger applies the
   * realm's `usernameBlocklist` and retries on collision.
   */
  protected generateUniqueUsername(profile: OAuth2Profile, _realmSettings: any, _users: any, realmName?: string): Promise<string>;
  /**
   * Random delay to prevent timing attacks (50-200ms)
   * Uses cryptographically secure random number generation
   */
  protected randomDelay(): Promise<void>;
  protected static readonly LOGIN_CACHE_NAME = "login-rate-limit";
  /**
   * Check if a login key is currently locked out.
   * Read-only — does not increment the counter.
   */
  protected isLoginLocked(key: string, max: number): Promise<boolean>;
  /**
   * Record a failed login attempt. Uses getTyped + setTyped (not incr) so that
   * each write refreshes the TTL — implementing sliding-window behavior.
   *
   * Returns `true` if this failure just crossed the lockout threshold.
   */
  protected recordFailedLogin(key: string, max: number, windowMs: number): Promise<boolean>;
  /**
   * Validate user credentials and return the user if valid.
   */
  login(provider: string, username: string, password: string, userRealmName?: string): Promise<UserEntity>;
  createSession(user: UserAccount, expiresIn: number, userRealmName?: string, clientId?: string): Promise<{
    refreshToken: string;
    sessionId: string;
  }>;
  refreshSession(refreshToken: string, userRealmName?: string): Promise<{
    user: PgStatic<import("zod").ZodObject<{
      id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
      version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
      createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
      updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
      realm: PgAttr<import("zod").ZodString, typeof PG_DEFAULT>;
      username: import("zod").ZodOptional<import("zod").ZodString>;
      email: import("zod").ZodOptional<import("zod").ZodString>;
      phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
      roles: PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>;
      firstName: import("zod").ZodOptional<import("zod").ZodString>;
      lastName: import("zod").ZodOptional<import("zod").ZodString>;
      picture: import("zod").ZodOptional<import("zod").ZodString>;
      enabled: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
      emailVerified: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
      lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
      organizationId: PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>;
    }, import("zod/v4/core").$strip>, PgRelationMap<import("zod").ZodObject<{
      id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
      version: PgAttr<PgAttr<import("zod").ZodInt, typeof PG_VERSION>, typeof PG_DEFAULT>;
      createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
      updatedAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_UPDATED_AT>, typeof PG_DEFAULT>;
      realm: PgAttr<import("zod").ZodString, typeof PG_DEFAULT>;
      username: import("zod").ZodOptional<import("zod").ZodString>;
      email: import("zod").ZodOptional<import("zod").ZodString>;
      phoneNumber: import("zod").ZodOptional<import("zod").ZodString>;
      roles: PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof PG_DEFAULT>;
      firstName: import("zod").ZodOptional<import("zod").ZodString>;
      lastName: import("zod").ZodOptional<import("zod").ZodString>;
      picture: import("zod").ZodOptional<import("zod").ZodString>;
      enabled: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
      emailVerified: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
      lastLoginAt: import("zod").ZodOptional<import("zod").ZodString>;
      organizationId: PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>;
    }, import("zod/v4/core").$strip>>>;
    expiresIn: number;
    sessionId: string;
  }>;
  deleteSession(refreshToken: string, userRealmName?: string): Promise<void>;
  link(provider: string, profile: OAuth2Profile, userRealmName?: string): Promise<{
    id: string;
    version: number;
    createdAt: string;
    updatedAt: string;
    realm: string;
    username?: string | undefined;
    email?: string | undefined;
    phoneNumber?: string | undefined;
    roles: string[];
    firstName?: string | undefined;
    lastName?: string | undefined;
    picture?: string | undefined;
    enabled: boolean;
    emailVerified: boolean;
    lastLoginAt?: string | undefined;
    organizationId: string | undefined;
  } | {
    sub: string;
    email?: string;
    name?: string;
    given_name?: string;
    family_name?: string;
    middle_name?: string;
    nickname?: string;
    preferred_username?: string;
    profile?: string;
    picture?: string;
    website?: string;
    email_verified?: boolean;
    gender?: string;
    birthdate?: string;
    zoneinfo?: string;
    locale?: string;
    phone_number?: string;
    phone_number_verified?: boolean;
    address?: {
      formatted?: string;
      street_address?: string;
      locality?: string;
      region?: string;
      postal_code?: string;
      country?: string;
    };
    updated_at?: number;
    id: string;
  }>;
}
//#endregion
//#region ../../src/api/users/index.d.ts
/**
 * Complete user management with multi-realm support for multi-tenant applications.
 *
 * **Features:**
 * - User registration, login, and profile management
 * - Password reset workflows
 * - Email verification
 * - Session management with multiple devices
 * - Identity management (social logins, SSO)
 * - Multi-realm support for tenant isolation
 * - Credential management
 * - Entities: `users`, `identities`, `sessions`
 *
 * @module alepha.api.users
 */
declare const AlephaApiUsers: import("alepha").Service<import("alepha").Module>;
//#endregion
export { $realm, AdminIdentityController, AdminSessionController, AdminUserController, AlephaApiUsers, CompletePasswordResetRequest, CompleteRegistrationRequest, CreateUser, CredentialService, DEFAULT_USER_REALM_NAME, FieldRequirement, IdentityEntity, IdentityQuery, IdentityResource, IdentityService, LoginInput, MySession, MySessionController, PasswordResetIntentResponse, Realm, RealmAuthSettings, RealmConfig, RealmController, RealmFeatures, RealmOptions, RealmPrimitive, RealmProvider, RealmRepositories, RegisterInput, RegistrationIntentResponse, RegistrationService, ResetPasswordInput, ResetPasswordRequest, SessionAudits, SessionCrudService, SessionEntity, SessionQuery, SessionResource, SessionService, UpdateUser, UserAudits, UserBuckets, UserController, UserEntity, UserJobs, UserNotifications, UserQuery, UserResource, UserService, UsernameFieldRequirement, UsernameSlugger, completePasswordResetRequestSchema, completeRegistrationRequestSchema, createUserSchema, identities, identityQuerySchema, identityResourceSchema, loginSchema, mySessionSchema, passwordResetIntentResponseSchema, realmAuthSettingsAtom, realmConfigSchema, registerSchema, registrationIntentResponseSchema, resetPasswordRequestSchema, resetPasswordSchema, sessionQuerySchema, sessionResourceSchema, sessionUserSummarySchema, sessions, updateUserSchema, userQuerySchema, userResourceSchema, users };
//# sourceMappingURL=index.d.ts.map