import type { Authenticatable, UserProvider } from './contracts.js';
export interface TokenRepository {
    create(email: string, token: string, expiresAt: Date): Promise<void>;
    find(email: string): Promise<{
        token: string;
        createdAt: Date;
    } | null>;
    delete(email: string): Promise<void>;
    deleteExpired(): Promise<void>;
}
export type PasswordResetStatus = 'RESET_LINK_SENT' | 'PASSWORD_RESET' | 'INVALID_USER' | 'INVALID_TOKEN' | 'TOKEN_EXPIRED' | 'THROTTLED';
export interface PasswordResetConfig {
    /** Minutes before a reset token expires (default: 60) */
    expire?: number;
    /** Seconds between reset requests for the same email (default: 60) */
    throttle?: number;
    /**
     * HMAC secret for hashing stored reset tokens. **Required in production**
     * — the broker throws on construction when `NODE_ENV === 'production'`
     * and this is unset. In dev/test, an unset secret falls back to a
     * hardcoded placeholder with a one-time boot notice, so apps boot
     * without configuration but the gap is visible.
     *
     * Set this from `AUTH_SECRET` (the scaffolder default — a random string
     * >= 32 chars) so stored token hashes are bound to your app instance.
     */
    secret?: string;
}
export declare class PasswordBroker {
    private readonly tokens;
    private readonly users;
    private readonly config;
    private readonly expire;
    private readonly throttle;
    private readonly secret;
    constructor(tokens: TokenRepository, users: UserProvider, config?: PasswordResetConfig);
    /**
     * Send a password reset link.
     * @param credentials - must include `email`
     * @param sendLink - callback to actually send the email/notification
     */
    sendResetLink(credentials: {
        email: string;
    }, sendLink: (user: Authenticatable, token: string) => Promise<void>): Promise<PasswordResetStatus>;
    /**
     * Reset the user's password.
     * @param credentials - must include `email`, `token`, `password`
     * @param callback - receives the user and new password to perform the actual update
     */
    reset(credentials: {
        email: string;
        token: string;
        password: string;
    }, callback: (user: Authenticatable, password: string) => Promise<void>): Promise<PasswordResetStatus>;
    private hashToken;
    private verifyToken;
}
/**
 * Process-local token store backed by a `Map`. **Not for production.**
 * Pending reset tokens are lost on every restart, and the store is invisible
 * to other processes (a multi-worker app would issue a token from one worker
 * and reject it from another). Use a database-backed `TokenRepository` —
 * `@rudderjs/orm` ships one — for any real deployment.
 */
export declare class MemoryTokenRepository implements TokenRepository {
    private store;
    create(email: string, token: string, expiresAt: Date): Promise<void>;
    find(email: string): Promise<{
        token: string;
        createdAt: Date;
    } | null>;
    delete(email: string): Promise<void>;
    deleteExpired(): Promise<void>;
}
//# sourceMappingURL=password-reset.d.ts.map