/**
 * Unified Challenge Response DTO with Comprehensive Validation
 *
 * Provides class-validator validation for challenge responses.
 * This is the single source of truth for challenge response validation,
 * used by both NestJS and Express adapters.
 *
 * Security Features:
 * - All string inputs have max length (prevents DoS attacks)
 * - Phone numbers validated against E.164 format
 * - Password strength enforced (8-128 chars)
 * - Conditional validation based on challenge type
 * - Enum validation prevents invalid challenge types
 *
 * @module RespondChallengeDTO
 */
/**
 * Challenge type enum for validation
 */
export declare enum ChallengeType {
    VERIFY_EMAIL = "VERIFY_EMAIL",
    VERIFY_PHONE = "VERIFY_PHONE",
    MFA_REQUIRED = "MFA_REQUIRED",
    FORCE_CHANGE_PASSWORD = "FORCE_CHANGE_PASSWORD",
    MFA_SETUP_REQUIRED = "MFA_SETUP_REQUIRED"
}
/**
 * MFA method enum for validation
 */
export declare enum MFAMethodType {
    SMS = "sms",
    EMAIL = "email",
    TOTP = "totp",
    PASSKEY = "passkey",
    BACKUP = "backup"
}
/**
 * Unified DTO for responding to authentication challenges
 *
 * Uses conditional validation (@ValidateIf) to validate fields based on challenge type.
 * This ensures proper validation while maintaining a single endpoint for all challenge types.
 *
 * Security:
 * - All strings have max length constraints matching DB limits
 * - Phone numbers validated against E.164 format (prevents SQL injection)
 * - Verification codes validated for length (4-10 chars)
 * - Passwords validated for strength requirements
 * - Session tokens validated as UUID v4 format (prevents injection)
 *
 * @example
 * ```typescript
 * @Controller('auth')
 * export class AuthController {
 *   @Post('respond-challenge')
 *   async respondToChallenge(@Body() dto: RespondChallengeDTO) {
 *     return await this.authService.respondToChallenge(dto);
 *   }
 * }
 * ```
 */
export declare class RespondChallengeDTO {
    /**
     * Challenge session token (UUID v4)
     * Always required
     *
     * Validation:
     * - Must be a valid UUID v4 format
     * - Generated using randomUUID() in challenge service
     * - Matches DB constraint: varchar(255) but UUID format enforced
     *
     * Sanitization:
     * - Trimmed
     * - Lowercased for consistency
     *
     * @example "a21b654c-2746-4168-acee-c175083a65cd"
     */
    session: string;
    /**
     * Challenge type being responded to
     * Always required
     */
    type: ChallengeType;
    /**
     * Verification code
     * Required for:
     * - VERIFY_EMAIL
     * - VERIFY_PHONE (when verifying code)
     * - MFA_REQUIRED (for SMS/Email/TOTP/Backup methods)
     *
     * Validation:
     * - Must be a string
     * - Length 4-10 characters (covers all code types)
     * - Alphanumeric only
     *
     * Note: NOT trimmed (codes should be exact)
     */
    code?: string;
    /**
     * Phone number in E.164 format
     * Required for VERIFY_PHONE when collecting phone number (first step)
     *
     * Validation:
     * - Must be a string
     * - Must match E.164 format: +[country code][number]
     * - Example: +14155552671
     * - Max 20 characters (matches DB limit)
     *
     * Sanitization:
     * - Trimmed
     * - Only digits and leading + allowed
     */
    phone?: string;
    /**
     * New password
     * Required for FORCE_CHANGE_PASSWORD challenge
     *
     * Validation:
     * - Must be a string
     * - Min 8 characters (security requirement)
     * - Max 128 characters (prevents DoS via Argon2 hashing)
     *
     * Note: NOT trimmed (passwords can have leading/trailing spaces)
     */
    newPassword?: string;
    /**
     * MFA method being used or set up
     * Required for:
     * - MFA_REQUIRED challenge (method being used for verification)
     * - MFA_SETUP_REQUIRED challenge (method being set up)
     *
     * Validation:
     * - Must be one of: sms, email, totp, passkey, backup
     */
    method?: MFAMethodType;
    /**
     * Passkey credential
     * Required for MFA_REQUIRED when method is 'passkey'
     *
     * Validation:
     * - Must be an object
     * - Contains WebAuthn credential from navigator.credentials.get()
     */
    credential?: Record<string, unknown>;
    /**
     * Optional device ID for MFA_REQUIRED when method supports multiple devices (TOTP, Passkey)
     *
     * Validation:
     * - Must be a positive integer if provided
     * - Optional field (maintains backward compatibility)
     */
    deviceId?: number;
    /**
     * MFA setup data (method-specific)
     * Required for MFA_SETUP_REQUIRED challenge
     *
     * Expected structure by method:
     * - SMS: { phone: string, code: string }
     * - Email: { code: string }
     * - TOTP: { code: string }
     * - Passkey: { credential: Record<string, unknown> }
     *
     * Validation:
     * - Must be an object
     * - Structure validated by MFA provider services
     */
    setupData?: Record<string, unknown>;
}
/**
 * Helper type guards for challenge response
 *
 * Use these to narrow TypeScript types in your application logic.
 *
 * @example
 * ```typescript
 * if (RespondChallengeValidation.isEmailVerification(dto)) {
 *   // TypeScript knows dto.code is available
 * }
 * ```
 */
export declare namespace RespondChallengeValidation {
    function isEmailVerification(dto: RespondChallengeDTO): boolean;
    function isPhoneCollection(dto: RespondChallengeDTO): boolean;
    function isPhoneVerification(dto: RespondChallengeDTO): boolean;
    function isPasswordChange(dto: RespondChallengeDTO): boolean;
    function isMFAVerification(dto: RespondChallengeDTO): boolean;
    function isMFASetup(dto: RespondChallengeDTO): boolean;
}
//# sourceMappingURL=respond-challenge.dto.d.ts.map