import type { ActuateDB } from '../db/client-types.js';
export interface ResetToken {
    raw: string;
    hash: string;
}
/** Generate a cryptographically random reset token and its SHA-256 hash. */
export declare function generateResetToken(): ResetToken;
/** Hash a raw token for lookup (same algorithm used during generation). */
export declare function hashToken(raw: string): string;
/**
 * Create a password reset request. Generates a token, stores the hash,
 * and sends the reset email. Always succeeds from the caller's perspective
 * to prevent user enumeration.
 */
export declare function createPasswordReset(db: ActuateDB, email: string, config: {
    siteUrl: string;
    /**
     * Admin mount path (e.g. `/admin`, `/securelogin`). The reset link points at
     * `<siteUrl><adminPath>/reset-password`, so this must match where the admin
     * is actually served or the link 404s. Defaults to `/admin`.
     */
    adminPath?: string;
    platform?: {
        email?: {
            send: (opts: {
                to: string;
                subject: string;
                html: string;
                text?: string;
            }) => Promise<void>;
        };
    };
}): Promise<void>;
/**
 * Execute a password reset: validate the token, update the password,
 * mark the token as used, and revoke all existing sessions.
 */
export declare function executePasswordReset(db: ActuateDB, rawToken: string, newPassword: string): Promise<{
    success: boolean;
    error?: string;
}>;
//# sourceMappingURL=reset.d.ts.map