import type { DatabaseConnection } from '@pondoknusa/database';
import type { PasswordBrokerConfig } from './types.js';
import type { UserProvider } from './user-provider.js';
/**
 * Password reset broker.
 *
 * Issue-rate limiting uses an in-memory Map (process-local). It resets on
 * restart and does not share across workers or instances — put a reverse-proxy
 * or shared rate limiter in front for multi-node deployments.
 */
export declare class PasswordResetBroker {
    private readonly connection;
    private readonly config;
    private readonly provider;
    private readonly hasher;
    constructor(connection: DatabaseConnection, config: PasswordBrokerConfig, provider: UserProvider);
    sendResetLink(email: string): Promise<string>;
    reset(input: {
        email: string;
        token: string;
        password: string;
    }): Promise<void>;
    private canIssueReset;
    private recordResetIssue;
    private tokenValid;
    private hashToken;
    private issueDummyToken;
}
//# sourceMappingURL=password-reset-broker.d.ts.map