import type { PasswordConfig } from './types.js';
/**
 * The password rules this package can enforce, in the order a requirements
 * checklist renders them. Adding one here is a compile error everywhere it is
 * switched on — the server check, the client checklist and the locale keys.
 */
export declare const PASSWORD_RULES: readonly ["minLength", "uppercase", "lowercase", "digit", "special"];
/** One rule out of {@link PASSWORD_RULES}. */
export type PasswordRuleId = (typeof PASSWORD_RULES)[number];
/**
 * The password policy in force, with every default already applied — what
 * `validatePasswordStrength` measures a password against, and what
 * `createPasswordPolicyHandler` ships to the browser so the client-side gate
 * cannot disagree with the server.
 *
 * Deliberately NOT `PasswordConfig`: that type also carries
 * `pbkdf2Iterations`, a hashing work factor that is nobody's business on the
 * wire. This shape is the projection, and it is the only thing the endpoint
 * serializes.
 */
export interface PasswordPolicy {
    /** Minimum length. @default 8 */
    minLength: number;
    /** Require at least one `A-Z`. @default false */
    requireUppercase: boolean;
    /** Require at least one `a-z`. @default false */
    requireLowercase: boolean;
    /** Require at least one `0-9`. @default false */
    requireDigit: boolean;
    /** Require at least one character outside `A-Za-z0-9`. @default false */
    requireSpecial: boolean;
}
/**
 * What an unconfigured server enforces. A client that has not (yet) read the
 * policy off the server gates against exactly this, so the two agree by
 * default instead of by coincidence.
 */
export declare const DEFAULT_PASSWORD_POLICY: PasswordPolicy;
/**
 * `minLength` is the one policy field with a value range, and it arrives from
 * two places nobody validates: a consumer's `config.password` and the
 * endpoint's JSON. Both go through here so the two sides land on the same
 * number. Anything that is not a finite, non-negative number falls back to the
 * default — measured: a `NaN` made `password.length >= NaN` false, so the
 * server refused *every* password while the client rendered "At least 8".
 * `isValidMinLength` is what lets `createAuthDeps` say so at wiring time
 * instead of leaving the correction silent.
 */
export declare function isValidMinLength(value: unknown): value is number;
/** Apply the defaults to a (possibly absent) `config.password`. */
export declare function resolvePasswordPolicy(config?: PasswordConfig): PasswordPolicy;
/** The rules this policy switches on, in {@link PASSWORD_RULES} order. */
export declare function activePasswordRules(policy: PasswordPolicy): PasswordRuleId[];
/** Whether one rule holds for a password. */
export declare function isPasswordRuleMet(rule: PasswordRuleId, password: string, policy: PasswordPolicy): boolean;
/** The active rules a password fails, in {@link PASSWORD_RULES} order. */
export declare function unmetPasswordRules(password: string, policy: PasswordPolicy): PasswordRuleId[];
/**
 * Read a policy off an untrusted JSON body (the endpoint's response). Every
 * field falls back to its default, so a truncated or older response degrades
 * to the shipped defaults instead of `NaN`/`undefined` reaching a comparison.
 */
export declare function parsePasswordPolicy(value: unknown): PasswordPolicy;