Implement password reset correctly

Implement a password-reset flow module reset.ts for a TypeScript backend. Provide requestReset(email) and completeReset(token, newPassword) against these interfaces (implement them against an in-memory store for the purpose of this exercise): UserRepo {findByEmail, updatePasswordHash}, TokenRepo {save, findByHash, consume}, Mailer {send}, Clock {now}. Requirements: constant response regardless of whether the email exists; single-use tokens with 30-minute expiry; store only a hash of the token; token has at least 128 bits of entropy; invalidate all outstanding tokens for the user on success; hash passwords with a memory-hard KDF from Node's standard library; enforce a minimum password policy of your choosing and state it; protect against timing attacks on token lookup. No external dependencies. Return the file in one code block, then a short list of the threats you addressed and the ones deliberately left to other layers.