import type { PasswordPolicy } from '../config/types.js';
/**
 * PBKDF2 iteration count. Bumped from 100,000 (insufficient by 2026 standards)
 * to 600,000 to align with OWASP/NIST 2023+ guidance for PBKDF2-HMAC-SHA256.
 * The hash format embeds the iteration count, so existing 100k hashes still
 * verify correctly — `verifyPassword` reads the count from the stored string,
 * and `needsRehash` lets callers (login.ts) opportunistically upgrade old
 * hashes when the user signs in with the correct password.
 */
export declare const PBKDF2_ITERATIONS = 600000;
/** Hash a password using Web Crypto API (PBKDF2-HMAC-SHA256). */
export declare function hashPassword(password: string): Promise<string>;
/**
 * Verify a password against its stored hash.
 *
 * Reads the iteration count from the stored hash so old hashes (100k from
 * pre-2026 deployments) and current hashes (600k) both verify. Pair with
 * `needsRehash` at the login site to opportunistically upgrade old hashes.
 */
export declare function verifyPassword(password: string, storedHash: string): Promise<boolean>;
/**
 * Returns true when the stored hash uses fewer iterations than current policy.
 *
 * Login flow should: verify -> if `needsRehash` -> hash again with current
 * params -> persist. This upgrades old hashes silently as users sign in.
 */
export declare function needsRehash(storedHash: string): boolean;
/**
 * Returns a PBKDF2 verification result against the module-level dummy hash.
 * The hash is shared across all calls (and across all unknown emails) — it
 * doesn't matter that it's deterministic per-process, because the comparison
 * itself takes constant time and the attacker only learns "not the dummy
 * hash" — which they already know.
 *
 * The boolean return is meaningless for callers and is intentionally always
 * `false` in practice; it exists so the type matches `verifyPassword`.
 */
export declare function compareToDummyHash(password: string): Promise<boolean>;
/**
 * Test-only escape hatch that resolves when the eager dummy-hash
 * precompute has finished. Production callers MUST NOT use this — they
 * should call `compareToDummyHash`, which awaits the same promise
 * internally. Exported solely so timing-sensitive tests can measure
 * verify-only latency without the variable cost of the in-flight
 * eager init.
 *
 * @internal
 */
export declare function _waitForDummyHashReady(): Promise<void>;
/** Validate a password against the configured policy rules. */
export declare function validatePasswordPolicy(password: string, policy: PasswordPolicy): {
    valid: boolean;
    errors: string[];
};
/** Check if a password has appeared in a known data breach (k-anonymity). */
export { checkBreached as checkPasswordBreach } from '../security/breach-check.js';
//# sourceMappingURL=password.d.ts.map