import type { AuthConfig } from '../config/AuthConfig.js';
import type { Authenticatable } from '../contracts/Authenticatable.js';
import type { CanResetPassword } from '../contracts/CanResetPassword.js';
import type { UserProvider } from '../contracts/UserProvider.js';
import type { AuthEventDispatcher } from '../events/AuthEventDispatcher.js';
import { type DatabaseTokenRepository } from './DatabaseTokenRepository.js';
import { PasswordResetStatus } from './PasswordResetStatus.js';
type PasswordSlice = AuthConfig['passwords'][string];
/**
 * Orchestrates password reset token lifecycle and user notifications.
 */
export declare class PasswordBroker {
    private readonly tokens;
    private readonly provider;
    private readonly dispatch;
    /**
     * @param tokens - Token persistence.
     * @param provider - User lookup.
     * @param config - Named passwords config slice.
     * @param dispatch - Event dispatcher.
     */
    constructor(tokens: DatabaseTokenRepository, provider: UserProvider, _config: PasswordSlice, dispatch: AuthEventDispatcher);
    /**
     * Sends a reset link email when the user exists and is not throttled.
     */
    sendResetLink(credentials: Record<string, unknown>): Promise<typeof PasswordResetStatus.RESET_LINK_SENT | typeof PasswordResetStatus.INVALID_USER | typeof PasswordResetStatus.RESET_THROTTLED>;
    /**
     * Validates a token and lets the caller persist the new password.
     */
    reset(credentials: Record<string, unknown>, callback: (user: Authenticatable, password: string) => Promise<void>): Promise<typeof PasswordResetStatus.PASSWORD_RESET | typeof PasswordResetStatus.INVALID_USER | typeof PasswordResetStatus.INVALID_TOKEN>;
    /**
     * @returns Plaintext token for testing or custom mailers.
     */
    createToken(user: Authenticatable & CanResetPassword): Promise<string>;
    /**
     * Deletes any outstanding reset token rows for the user.
     */
    deleteToken(user: Authenticatable & CanResetPassword): Promise<void>;
    /**
     * @returns True when the plaintext token matches the stored hash.
     */
    tokenExists(user: Authenticatable & CanResetPassword, token: string): Promise<boolean>;
    /**
     * Resolves a user from credentials (typically `{ email }`).
     */
    getUser(credentials: Record<string, unknown>): Promise<Authenticatable | null>;
}
export {};
//# sourceMappingURL=PasswordBroker.d.ts.map