/** A user as the admin API returns it, reduced to what this command needs. */
export interface ResolvedUser {
    id: string;
    email: string;
}
/**
 * Pick the user with exactly this email out of a search response.
 *
 * `/api/admin/users?search=` is an `ILIKE '%…%'` over email **or display
 * name**, ordered by role count descending. This used to take row `[0]` and
 * reset it, then print the email it had been *given* as confirmation — so two
 * ordinary situations ended in a successful-looking reset of somebody else's
 * account:
 *
 *   - a substring collision: `bob@example.com` also matches
 *     `robert.bob@example.com`;
 *   - a display name, which is user-controlled and accepted up to 255
 *     characters with no constraint on its content, containing an address
 *     belonging to someone else.
 *
 * The ordering makes it worse rather than better — `array_length(roles) DESC
 * NULLS LAST` puts the most privileged match first, so the account most likely
 * to be reset by mistake is an admin's.
 *
 * Returns `undefined` when nothing matched exactly, which the caller reports
 * rather than falling through to a guess. The direct-database fallback below
 * has always matched with `eq(usersTable.email, email)`; this is the same
 * definition, so the command no longer resets different accounts depending on
 * whether the backend happened to be running.
 */
export declare function selectUserForEmail(payload: unknown, email: string): ResolvedUser | undefined;
export declare function authCommand(subcommand: string | undefined, rawArgs: string[]): Promise<void>;
/**
 * The flags `rebase auth reset-password` takes.
 *
 * `-p` was advertised in this command's own help and never declared here, so
 * `arg` — running permissively — pushed it into the positionals and the value
 * *after* it shifted out of reach: anyone following the help set the account's
 * password to the two-character string `-p`. Declared now, and `auth.test.ts`
 * asserts that the help and this spec list the same aliases.
 */
export declare const RESET_PASSWORD_FLAGS: {
    readonly "--email": StringConstructor;
    readonly "--password": StringConstructor;
    readonly "-e": "--email";
    readonly "-p": "--password";
};
/**
 * Which account, and which password, this invocation names.
 *
 * Both may still be absent — the caller reports a missing email — but neither
 * can be a flag. `parseCommandArgs` parses the whole line strictly, so an
 * undeclared flag is an error rather than a positional. That is what stops
 * `rebase auth reset-password bob@example.com --debug` from setting Bob's
 * password to `--debug`, which is the flag the CLI itself prints after every
 * failure as the thing to re-run with.
 *
 * Exported so its tests can drive the real parser rather than a copy of it.
 */
export declare function resolveResetPasswordArgs(rawArgs: string[]): {
    email?: string;
    password?: string;
};