/**
 * Admin User Operations
 *
 * Shared utilities and orchestration for admin-initiated user management
 * (user creation via REST API, password reset via admin panel).
 *
 * Hook resolution order:
 * 1. Collection-level hook (`auth.onCreateUser` on the collection) — closest to the data
 * 2. Backend-level hook (`AuthHooks.onAdminCreateUser`) — global override
 * 3. Built-in default — framework fallback
 */
import type { AuthRepository } from "./interfaces";
import type { EmailService, EmailConfig } from "../email";
import type { ResolvedAuthHooks } from "./auth-hooks";
import type { AuthCollectionConfig } from "@rebasepro/types";
/**
 * Generate a cryptographically secure random password that meets strength requirements.
 *
 * 16 characters, guaranteed at least one uppercase, one lowercase, one digit.
 * Ambiguous characters (0, O, 1, l, I) are excluded.
 */
export declare function generateSecurePassword(): string;
/**
 * Generate a cryptographically secure random token (80 hex characters).
 */
export declare function generateSecureToken(): string;
/**
 * Hash a token for database storage using SHA-256.
 */
export declare function hashToken(token: string): string;
/**
 * Context needed by admin user creation / password reset operations.
 */
export interface AdminUserContext {
    authRepo: AuthRepository;
    emailService?: EmailService;
    emailConfig?: EmailConfig;
    resolvedHooks: ResolvedAuthHooks;
    /** The parsed auth config from the collection (if `auth` is an object, not just `true`). */
    collectionAuthConfig?: AuthCollectionConfig;
}
/**
 * Result of preparing user values for admin-initiated creation.
 */
export interface AdminUserPrepareResult {
    /** Values ready for `driver.save()`. */
    values: Record<string, unknown>;
    /** The cleartext password (for returning to admin or sending via email). */
    clearPassword?: string;
    /** Whether the hook already handled the invitation email. */
    hookHandledEmail: boolean;
    /** Whether an invitation was sent (only relevant when hookHandledEmail is true). */
    invitationSent: boolean;
}
/**
 * Prepare user values for an admin-initiated user creation.
 *
 * Resolution order:
 * 1. Collection-level `auth.onCreateUser` — closest to the data
 * 2. Backend-level `AuthHooks.onAdminCreateUser` — global override
 * 3. Built-in default — generate password → hash → normalize email
 *
 * The caller is responsible for persisting (via `driver.save()`).
 */
export declare function prepareAdminUserValues(body: Record<string, unknown>, ctx: AdminUserContext): Promise<AdminUserPrepareResult>;
/**
 * Handle post-creation work for admin-created users.
 *
 * Sends an invitation email (password-reset link) if email is configured
 * and no explicit password was provided. Falls back to returning the
 * temporary password if email fails or is not configured.
 */
export declare function finalizeAdminUserCreation(entity: {
    id: string;
    values: Record<string, unknown>;
}, clearPassword: string | undefined, ctx: AdminUserContext): Promise<{
    temporaryPassword?: string;
    invitationSent: boolean;
}>;