/**
 * Have-I-Been-Pwned password lookup using `k`-anonymity.
 *
 * Sends only the first five hex characters of the SHA-1 hash to the HIBP
 * API. The full hash and plaintext never leave the device. Designed to be
 * called from a debounced password-input change handler — see `debounce`
 * below.
 */
export interface PwnedPasswordResult {
    /** `true` = breached, `false` = safe, `null` = check failed (unknown). */
    isPwned: boolean | null;
    count: number;
    error?: string;
}
export declare function checkPasswordPwned(password: string): Promise<PwnedPasswordResult>;
export interface PwnedMessage {
    title: string;
    message: string;
    severity: "error" | "warning" | "info";
}
/**
 * Build a user-friendly message for a HIBP result. The policy comes from
 * the shared cache populated by the consumer (see `hibp-cache.ts`). If no
 * policy is cached, falls back to a non-enforcing default.
 */
export declare function getPwnedMessage(result: PwnedPasswordResult): PwnedMessage;
export { debounce } from "../utils/debounce";
//# sourceMappingURL=hibp.d.ts.map