export declare const PASSWORD_COMPROMISED_ERROR_CODE = "PASSWORD_COMPROMISED";
/**
 * Return whether Better Auth's `haveIBeenPwned` plugin rejected a password
 * because it appears in a known breach corpus.
 *
 * Hosts use this to render the rejection against the password field rather
 * than as a toast, since it is something the user can act on right there.
 */
export declare function isPasswordCompromisedError(error: unknown): boolean;
/** Coarse buckets a password falls into. `empty` renders no meter at all. */
export type PasswordStrengthLevel = "empty" | "weak" | "fair" | "good" | "strong";
export type PasswordStrength = {
    /** 0 for an empty box, then 1 (weak) through 4 (strong). */
    score: 0 | 1 | 2 | 3 | 4;
    level: PasswordStrengthLevel;
};
export type EvaluatePasswordStrengthOptions = {
    /** The minimum the form itself enforces. Anything shorter can't beat `weak`. */
    minLength?: number;
};
/**
 * Score a password for the strength meter shown while someone types.
 *
 * This is a hint, not a security control: it never leaves the browser and
 * never gates submission. The server's own rules, and the `haveIBeenPwned`
 * plugin if you run it, remain the thing that decides what is acceptable.
 *
 * @param password - The password as typed.
 * @param options - Length policy the surrounding form enforces.
 */
export declare function evaluatePasswordStrength(password: string, options?: EvaluatePasswordStrengthOptions): PasswordStrength;