import { type ValidationError } from 'class-validator';
/**
 * Internal DTO validation marker used to avoid double-validation when adapters already validated inputs.
 *
 * @remarks
 * We use Symbol.for so multiple copies (or different build outputs) can still share the same marker key.
 * Framework adapters can mark DTOs as validated by setting this symbol on the DTO instance.
 *
 * @example
 * ```typescript
 * // In NestJS adapter after ValidationPipe runs:
 * import { markDtoAsValidated } from '@nauth-toolkit/core/utils';
 * markDtoAsValidated(dto);
 * ```
 */
export declare const NAUTH_DTO_VALIDATED_MARKER: unique symbol;
/**
 * Mark a DTO instance as already validated.
 *
 * This is useful for framework adapters (e.g., NestJS) that run validation via ValidationPipe
 * and want to prevent core services from re-validating the same DTO.
 *
 * @param dto - DTO instance to mark as validated
 *
 * @example
 * ```typescript
 * // In NestJS controller after ValidationPipe:
 * @Post('login')
 * async login(@Body() dto: LoginDTO) {
 *   markDtoAsValidated(dto); // Prevent AuthService from re-validating
 *   return this.authService.login(dto);
 * }
 * ```
 */
export declare function markDtoAsValidated(dto: object): void;
/**
 * Check if a DTO instance has been marked as validated.
 *
 * @param dto - DTO instance to check
 * @returns True if the DTO has been marked as validated
 */
export declare function isDtoValidated(dto: object): boolean;
/**
 * Convert class-validator errors into ValidationPipe-compatible format.
 *
 * Formats errors to match the structure that NestJS ValidationPipe produces,
 * making it compatible with all framework adapters (NestJS, Express, Fastify, etc.).
 *
 * @param errors - Raw class-validator errors
 * @returns Object mapping field names to arrays of constraint messages
 *          Format: { "fieldName": ["constraint message 1", "constraint message 2"] }
 *
 * @example
 * ```typescript
 * // Input: class-validator ValidationError[]
 * // Output:
 * {
 *   "email": ["email must be an email"],
 *   "password": [
 *     "password must be longer than or equal to 8 characters",
 *     "password must be a string"
 *   ],
 *   "deviceType": ["deviceType must be one of the following values: mobile, desktop, tablet"]
 * }
 * ```
 *
 * @internal
 */
export declare function formatDtoValidationErrors(errors: ValidationError[]): Record<string, string[]>;
/**
 * Ensure an input value is transformed into a DTO instance and validated.
 *
 * @remarks
 * This utility allows core services to be used safely outside frameworks that run DTO validation
 * (e.g. direct usage in scripts/tests or consumer apps without Nest ValidationPipe).
 *
 * Adapters may mark DTOs as validated by calling `markDtoAsValidated()`, which prevents
 * double-validation (useful when a ValidationPipe already ran).
 *
 * Security:
 * - Unknown properties are stripped via whitelist to avoid persisting/logging untrusted payload keys.
 * - Hard-fails on non-object values to prevent type confusion attacks.
 *
 * @param dtoClass - DTO class constructor
 * @param input - Potentially plain input object (or already a DTO instance)
 * @returns Validated DTO instance
 * @throws {NAuthException} When validation fails
 *
 * @example
 * ```typescript
 * // In a service method:
 * async login(input: unknown): Promise<AuthResponseDTO> {
 *   const dto = await ensureValidatedDto(LoginDTO, input);
 *   // dto is now guaranteed to be validated and transformed
 *   // ...
 * }
 * ```
 */
export declare function ensureValidatedDto<T extends object>(dtoClass: new () => T, input: unknown): Promise<T>;
/**
 * Synchronous variant of {@link ensureValidatedDto}.
 *
 * @remarks
 * Needed for sync methods that accept DTOs (e.g. `MFAService.hasProvider()`), so we can enforce
 * runtime validation without making those APIs async (breaking change).
 *
 * @param dtoClass - DTO class constructor
 * @param input - Potentially plain input object (or already a DTO instance)
 * @returns Validated DTO instance
 * @throws {NAuthException} When validation fails
 */
export declare function ensureValidatedDtoSync<T extends object>(dtoClass: new () => T, input: unknown): T;
//# sourceMappingURL=dto-validator.d.ts.map