tml_lost_password_handler()

function tml_lost_password_handler() {
    // phpcs:disable WordPress.Security.NonceVerification.Recommended -- mirrors wp-login.php's own lostpassword-form processing, which is a public unauthenticated form with no nonce.

    if ( tml_is_post_request() ) {
        $errors = retrieve_password();
        if ( ! is_wp_error( $errors ) ) {
            if ( tml_is_ajax_request() ) {
                // phpcs:disable WordPress.WP.I18n.MissingArgDomain, WordPress.WP.I18n.MissingTranslatorsComment -- reusing WP core's translated wp-login.php string verbatim, not a TML-specific string; no translators comment since it never enters TML's own .pot.
                tml_add_error( 'confirm', sprintf( __( 'Check your email for the confirmation link, then visit the <a href="%s">login page</a>.' ), wp_login_url() ), 'message' );
                // phpcs:enable WordPress.WP.I18n.MissingArgDomain, WordPress.WP.I18n.MissingTranslatorsComment
                tml_send_ajax_success(
                    array(
                        'notice' => tml_get_form()->render_errors(),
                    )
                );
            } else {
                $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : site_url( 'wp-login.php?checkemail=confirm' );
                wp_safe_redirect( $redirect_to );
                exit;
            }
        } else {
            tml_set_errors( $errors );
            if ( tml_is_ajax_request() ) {
                tml_send_ajax_error(
                    array(
                        'errors' => tml_get_form()->render_errors(),
                    )
                );
            }
        }
    }

    if ( isset( $_REQUEST['error'] ) ) {
        // phpcs:disable WordPress.WP.I18n.MissingArgDomain -- reusing WP core's translated wp-login.php strings verbatim, not TML-specific strings.
        if ( 'invalidkey' === $_REQUEST['error'] ) {
            tml_add_error( 'invalidkey', __( '<strong>Error:</strong> Your password reset link appears to be invalid. Please request a new link below.' ) );
        } elseif ( 'expiredkey' === $_REQUEST['error'] ) {
            tml_add_error( 'expiredkey', __( '<strong>Error:</strong> Your password reset link has expired. Please request a new link below.' ) );
        }
        // phpcs:enable WordPress.WP.I18n.MissingArgDomain
    }

    /** This filter is documented in wp-login.php */
    do_action( 'lost_password', tml_get_errors() );
    // phpcs:enable WordPress.Security.NonceVerification.Recommended
}

View src/includes/actions.php, line 718 on GitHub