import type { QueryBuilder } from '@atlex/orm';
import type { CanResetPassword } from '../contracts/CanResetPassword.js';
/**
 * Persists hashed password-reset tokens in SQL.
 */
export declare class DatabaseTokenRepository {
    private readonly query;
    private readonly table;
    private readonly hashKey;
    private readonly expiresMinutes;
    private readonly throttleSeconds;
    /**
     * @param query - Query builder factory.
     * @param table - `password_resets` table.
     * @param hashKey - HMAC secret for token hashing at rest.
     * @param expiresMinutes - Row lifetime.
     * @param throttleSeconds - Minimum spacing between emails per user.
     */
    constructor(query: () => QueryBuilder, table: string, hashKey: string, expiresMinutes: number, throttleSeconds: number);
    /**
     * Creates a fresh token row and returns the plaintext token for emailing.
     */
    create(user: CanResetPassword): Promise<string>;
    /**
     * @returns True when the plaintext token matches a non-expired row.
     */
    exists(user: CanResetPassword, token: string): Promise<boolean>;
    /**
     * @returns True when a token was created within the throttle window.
     */
    recentlyCreatedToken(user: CanResetPassword): Promise<boolean>;
    /**
     * Deletes stored tokens for the user email.
     */
    delete(user: CanResetPassword): Promise<void>;
    /**
     * Deletes expired rows (best-effort cleanup).
     */
    deleteExpired(): Promise<void>;
}
//# sourceMappingURL=DatabaseTokenRepository.d.ts.map