use-password-policy 2.0.0 → 3.0.0

package/dist/index.d.mts

@@ -1,43 +1,326 @@
-import React, { FC } from 'react';
+import * as React from 'react';
 
+interface CheckPwnedOptions {
+    /** Abort the request (e.g. when the user keeps typing). */
+    signal?: AbortSignal;
+    /** Custom fetch implementation. Defaults to the global `fetch`. */
+    fetch?: typeof fetch;
+    /** Range API base URL. Defaults to Have I Been Pwned. */
+    endpoint?: string;
+    /**
+     * Ask HIBP to pad the response so its size doesn't hint at the result.
+     * Sends an `Add-Padding` header. Default `false`.
+     */
+    padding?: boolean;
+}
+/**
+ * How many times this password appears in known data breaches, using the
+ * Have I Been Pwned range API (k-anonymity). Only the first 5 characters of
+ * the password's SHA-1 hash leave the device — never the password itself.
+ *
+ * Resolves to `0` when the password was not found.
+ */
+declare function checkPwnedPassword(password: string, options?: CheckPwnedOptions): Promise<number>;
+
+/** Built-in strength labels, weakest to strongest. */
+type StrengthLabel = 'Very Weak' | 'Weak' | 'Medium' | 'Strong' | 'Very Strong';
+/** Text for a rule: a plain string, or a function of the resolved options (handy for i18n). */
+type RuleMessage = string | ((options: ResolvedPolicyOptions) => string);
+/**
+ * A single validation rule. Used for both built-in and custom rules.
+ */
 interface PolicyRule {
+    /** Unique key. Appears in `policyState` and `requirements`. */
     name: string;
+    /** For built-in rules: the option that switches the rule on. */
     optionsKey?: keyof PasswordPolicyOptions;
-    test: (password: string, options: Required<PasswordPolicyOptions>) => boolean;
+    /** Return `true` when the password passes. */
+    test: (password: string, options: ResolvedPolicyOptions) => boolean;
+    /** Human-readable requirement, e.g. "No spaces". Falls back to a prettified `name`. */
+    message?: RuleMessage;
+}
+/**
+ * Result of a strength estimator such as zxcvbn.
+ * `score` uses the zxcvbn scale: 0 (too guessable) … 4 (very unguessable).
+ */
+interface StrengthEstimate {
+    score: 0 | 1 | 2 | 3 | 4;
+    /** Optional hint to show the user, e.g. "This is a very common password". */
+    feedback?: string;
 }
+type StrengthEstimator = (password: string) => StrengthEstimate;
+/** Every option is optional. Omitted options fall back to the defaults. */
 interface PasswordPolicyOptions {
+    /** The password to validate (hook only — `validatePassword` takes it as the first argument). */
     password?: string;
+    /** Minimum length. Default `8`. */
     minLength?: number;
+    /** Maximum length. Default `0` (no maximum). */
+    maxLength?: number;
+    /** Require a lowercase letter. Default `true`. */
     lowercaseCheck?: boolean;
+    /** Require an uppercase letter. Default `true`. */
     uppercaseCheck?: boolean;
+    /** Require a digit. Default `true`. */
     numberCheck?: boolean;
+    /** Require a special character. Default `true`. */
     specialCharCheck?: boolean;
+    /** Reject very common passwords ("password", "qwerty123", "Password1!" …). Default `false`. */
+    commonPasswordCheck?: boolean;
+    /** Replace the built-in common-password list. */
+    commonPasswords?: readonly string[];
+    /**
+     * When set (even to `''`), adds a `match` rule that passes only if
+     * `password === confirmPassword`.
+     */
+    confirmPassword?: string;
+    /**
+     * Plug in a real strength estimator (e.g. zxcvbn via `fromZxcvbn`).
+     * When set, `strengthLabel` and `strengthPercent` come from the estimator.
+     */
+    strengthEstimator?: StrengthEstimator;
+    /** With `strengthEstimator`: minimum score (0–4) required. Adds a `strength` rule. */
+    minStrength?: 0 | 1 | 2 | 3 | 4;
+    /** Your own rules, checked after the built-in ones. */
     customRules?: PolicyRule[];
+    /** Override requirement text per rule name, e.g. `{ minLength: 'Mindestens 8 Zeichen' }`. */
+    messages?: Partial<Record<string, RuleMessage>>;
     lowercaseRegex?: RegExp;
     uppercaseRegex?: RegExp;
     numberRegex?: RegExp;
     specialCharRegex?: RegExp;
 }
+/** Options after defaults are applied. Passed to every rule's `test`. */
+type ResolvedPolicyOptions = Required<Omit<PasswordPolicyOptions, 'password' | 'confirmPassword' | 'strengthEstimator' | 'minStrength'>> & Pick<PasswordPolicyOptions, 'confirmPassword' | 'strengthEstimator' | 'minStrength'>;
+/** @deprecated Use `ResolvedPolicyOptions`. */
+type PolicyDefaults = ResolvedPolicyOptions;
+/** Pass/fail for each active rule, keyed by rule name. */
 interface PasswordPolicyState {
     [key: string]: boolean;
 }
-interface HookReturnValue {
-    password?: string;
+/** One row of a requirements checklist. */
+interface Requirement {
+    name: string;
+    passed: boolean;
+    message: string;
+}
+/** Result of `validatePassword` (and the hook). */
+interface ValidationResult {
+    /** `true` only when every active rule passes. */
     isValid: boolean;
-    strengthScore: number;
-    strengthLabel: 'Very Weak' | 'Weak' | 'Medium' | 'Strong' | 'Very Strong';
+    /** Pass/fail per rule name. */
     policyState: PasswordPolicyState;
+    /** Ordered checklist with human-readable messages. */
+    requirements: Requirement[];
+    /** Messages of the rules that failed, in order. Handy for form errors. */
+    errors: string[];
+    /** Number of rules that passed. */
+    strengthScore: number;
+    /** 0–1. Share of rules passed, or the estimator score / 4 when an estimator is set. */
+    strengthPercent: number;
+    strengthLabel: StrengthLabel;
+    /** The estimator's result, if `strengthEstimator` is set. */
+    estimate?: StrengthEstimate;
+}
+/** What `usePasswordPolicy` returns. */
+interface HookReturnValue extends ValidationResult {
+    password?: string;
 }
 
+/**
+ * Validate a password as the user types.
+ *
+ * Tip: if you pass an expensive `strengthEstimator` (like zxcvbn), memoize
+ * your options object so it is only recomputed when the password changes.
+ */
 declare const usePasswordPolicy: (options?: PasswordPolicyOptions) => HookReturnValue;
+type PwnedStatus = 'idle' | 'checking' | 'safe' | 'pwned' | 'error';
+interface UsePwnedPasswordOptions extends Omit<CheckPwnedOptions, 'signal'> {
+    /** Turn the check on/off (e.g. only once the policy passes). Default `true`. */
+    enabled?: boolean;
+    /** Wait this long after the last keystroke before checking. Default `500` ms. */
+    debounceMs?: number;
+}
+interface UsePwnedPasswordResult {
+    status: PwnedStatus;
+    /** Times seen in breaches (0 when safe or unknown). */
+    count: number;
+    isPwned: boolean;
+    error?: Error;
+}
+/**
+ * Check the password against Have I Been Pwned while the user types
+ * (debounced, cancels stale requests). Only a 5-character hash prefix is sent.
+ */
+declare function usePwnedPassword(password: string, options?: UsePwnedPasswordOptions): UsePwnedPasswordResult;
 
-interface PasswordPolicyInputProps extends React.ComponentPropsWithoutRef<'input'> {
+interface PasswordPolicyInputProps extends Omit<React.ComponentPropsWithoutRef<'input'>, 'type' | 'value' | 'defaultValue'> {
+    /** Controlled value. Leave undefined to let the component manage its own state. */
+    value?: string;
+    /** Initial value when uncontrolled. */
+    defaultValue?: string;
+    /** Same options as `usePasswordPolicy`. */
     policyOptions?: PasswordPolicyOptions;
+    /** Fires on every change with the new password and its full validation result. */
     onPasswordChange?: (password: string, validation: HookReturnValue) => void;
+    /** Default `true`. */
     showStrengthMeter?: boolean;
+    /** Show the strength label ("Strong") under the meter. Default `false`. */
+    showStrengthLabel?: boolean;
+    /** Default `true`. */
     showRequirementsList?: boolean;
+    /** Default `true`. */
     showToggleButton?: boolean;
+    /** Accessible labels for the show/hide button. */
+    toggleLabels?: {
+        show: string;
+        hide: string;
+    };
+    /** Skip the built-in CSS (class names stay). Import `use-password-policy/styles.css` or bring your own. */
+    unstyled?: boolean;
+    /** Class for the outer wrapper. */
+    className?: string;
+    /** Extra class for the <input> itself. */
+    inputClassName?: string;
+}
+declare const PasswordPolicyInput: React.ForwardRefExoticComponent<PasswordPolicyInputProps & React.RefAttributes<HTMLInputElement>>;
+
+/**
+ * Styles for <PasswordPolicyInput />. Kept deliberately low-specificity:
+ * the theme variables sit on `:where(.rpp-root)` (zero specificity), so any
+ * class you pass via `className` wins; inner parts use a single class
+ * (e.g. `.rpp-toggle`), which still beats global element resets like
+ * `button { … }`. Override them with `.your-class .rpp-toggle { … }`.
+ *
+ * Also shipped as `use-password-policy/styles.css` for use with `unstyled`.
+ */
+declare const passwordPolicyInputCss: string;
+
+/**
+ * A small, bundled list of the most common passwords and password "base words".
+ * Matching is case-insensitive and also catches simple variations
+ * (trailing digits/symbols, a leading number, and common leet swaps),
+ * so "Password123!", "P@ssw0rd" and "qwerty2024" are all caught.
+ *
+ * It is intentionally small (a few KB) — for full coverage, pair it with
+ * `checkPwnedPassword` / `usePwnedPassword` (Have I Been Pwned).
+ */
+declare const COMMON_PASSWORDS: readonly string[];
+
+/**
+ * use-password-policy/core
+ *
+ * Framework-free password validation. No React import, so it runs anywhere:
+ * the browser, Node, Deno, Bun, edge functions — which lets you enforce the
+ * exact same policy on the client and the server.
+ */
+
+declare const DEFAULT_OPTIONS: ResolvedPolicyOptions;
+/**
+ * Ready-made policies. Spread one and override what you need:
+ * `usePasswordPolicy({ ...presets.nist, password })`
+ */
+declare const presets: {
+    /** The classic checklist (these are also the defaults): 8+ chars, upper, lower, number, symbol. */
+    classic: {
+        minLength: number;
+        lowercaseCheck: true;
+        uppercaseCheck: true;
+        numberCheck: true;
+        specialCharCheck: true;
+    };
+    /**
+     * NIST SP 800-63B-4 (Aug 2025) for passwords used on their own:
+     * at least 15 characters, allow up to 64, no composition rules, block common passwords.
+     */
+    nist: {
+        minLength: number;
+        maxLength: number;
+        lowercaseCheck: false;
+        uppercaseCheck: false;
+        numberCheck: false;
+        specialCharCheck: false;
+        commonPasswordCheck: true;
+    };
+    /** NIST SP 800-63B-4 when the password is one factor of MFA: at least 8 characters. */
+    nistMfa: {
+        minLength: number;
+        maxLength: number;
+        lowercaseCheck: false;
+        uppercaseCheck: false;
+        numberCheck: false;
+        specialCharCheck: false;
+        commonPasswordCheck: true;
+    };
+};
+declare const DEFAULT_MESSAGES: Record<string, RuleMessage>;
+/** Merge user options over the defaults, ignoring keys set to `undefined`. */
+declare function resolveOptions(options?: PasswordPolicyOptions): ResolvedPolicyOptions;
+/**
+ * `true` if the password is on the list, or is a list entry with simple
+ * decoration: trailing digits/symbols ("password123!"), a leading number
+ * ("123qwerty") or leet swaps ("p@ssw0rd").
+ */
+declare function isCommonPassword(password: string, list?: readonly string[]): boolean;
+/**
+ * Validate a password against a policy. Pure and synchronous.
+ *
+ * ```ts
+ * import { validatePassword, presets } from 'use-password-policy/core';
+ * const { isValid, errors } = validatePassword(req.body.password, presets.nist);
+ * ```
+ */
+declare function validatePassword(password: string, options?: PasswordPolicyOptions): ValidationResult;
+/** Anything shaped like the result of `zxcvbn(password)` or `@zxcvbn-ts/core`'s `zxcvbn(password)`. */
+interface ZxcvbnLikeResult {
+    score: number;
+    feedback?: {
+        warning?: string | null;
+        suggestions?: readonly string[];
+    };
+}
+type ZxcvbnFn = (password: string, userInputs?: (string | number)[]) => ZxcvbnLikeResult;
+/**
+ * Wrap zxcvbn as a `strengthEstimator`. Accepts either a function
+ * (`zxcvbn` package, @zxcvbn-ts v3) or an object with `check`
+ * (@zxcvbn-ts v4's `new ZxcvbnFactory(options)`).
+ *
+ * ```ts
+ * import { ZxcvbnFactory } from '@zxcvbn-ts/core';
+ * const zxcvbn = new ZxcvbnFactory(options);
+ * usePasswordPolicy({ password, strengthEstimator: fromZxcvbn(zxcvbn), minStrength: 3 });
+ * ```
+ */
+declare function fromZxcvbn(zxcvbn: ZxcvbnFn | {
+    check: ZxcvbnFn;
+}, userInputs?: (string | number)[]): StrengthEstimator;
+/** Minimal shape of Zod's refinement context (works with Zod 3 and 4). */
+interface ZodLikeRefinementCtx {
+    addIssue(issue: {
+        code: 'custom';
+        message: string;
+    }): void;
 }
-declare const PasswordPolicyInput: FC<PasswordPolicyInputProps>;
+/**
+ * Use your policy inside a Zod schema:
+ *
+ * ```ts
+ * const schema = z.object({ password: z.string().superRefine(zodPasswordRule(policy)) });
+ * ```
+ * Adds one issue per failed rule (or only the first with `{ allErrors: false }`).
+ */
+declare function zodPasswordRule(options?: PasswordPolicyOptions, { allErrors }?: {
+    allErrors?: boolean | undefined;
+}): (value: string, ctx: ZodLikeRefinementCtx) => void;
+/**
+ * A validate function that returns `true` or the first error message.
+ * Drops straight into react-hook-form's `validate`, and works with anything
+ * that uses the same convention.
+ *
+ * ```ts
+ * register('password', { validate: passwordValidator(policy) })
+ * ```
+ */
+declare function passwordValidator(options?: PasswordPolicyOptions): (value: string) => true | string;
 
-export { type HookReturnValue, PasswordPolicyInput, type PasswordPolicyInputProps, type PasswordPolicyOptions, type PasswordPolicyState, type PolicyRule, usePasswordPolicy };
+export { COMMON_PASSWORDS, type CheckPwnedOptions, DEFAULT_MESSAGES, DEFAULT_OPTIONS, type HookReturnValue, PasswordPolicyInput, type PasswordPolicyInputProps, type PasswordPolicyOptions, type PasswordPolicyState, type PolicyDefaults, type PolicyRule, type PwnedStatus, type Requirement, type ResolvedPolicyOptions, type RuleMessage, type StrengthEstimate, type StrengthEstimator, type StrengthLabel, type UsePwnedPasswordOptions, type UsePwnedPasswordResult, type ValidationResult, type ZodLikeRefinementCtx, type ZxcvbnLikeResult, checkPwnedPassword, fromZxcvbn, isCommonPassword, passwordPolicyInputCss, passwordValidator, presets, resolveOptions, usePasswordPolicy, usePwnedPassword, validatePassword, zodPasswordRule };

package/dist/index.d.ts

@@ -1,43 +1,326 @@
-import React, { FC } from 'react';
+import * as React from 'react';
 
+interface CheckPwnedOptions {
+    /** Abort the request (e.g. when the user keeps typing). */
+    signal?: AbortSignal;
+    /** Custom fetch implementation. Defaults to the global `fetch`. */
+    fetch?: typeof fetch;
+    /** Range API base URL. Defaults to Have I Been Pwned. */
+    endpoint?: string;
+    /**
+     * Ask HIBP to pad the response so its size doesn't hint at the result.
+     * Sends an `Add-Padding` header. Default `false`.
+     */
+    padding?: boolean;
+}
+/**
+ * How many times this password appears in known data breaches, using the
+ * Have I Been Pwned range API (k-anonymity). Only the first 5 characters of
+ * the password's SHA-1 hash leave the device — never the password itself.
+ *
+ * Resolves to `0` when the password was not found.
+ */
+declare function checkPwnedPassword(password: string, options?: CheckPwnedOptions): Promise<number>;
+
+/** Built-in strength labels, weakest to strongest. */
+type StrengthLabel = 'Very Weak' | 'Weak' | 'Medium' | 'Strong' | 'Very Strong';
+/** Text for a rule: a plain string, or a function of the resolved options (handy for i18n). */
+type RuleMessage = string | ((options: ResolvedPolicyOptions) => string);
+/**
+ * A single validation rule. Used for both built-in and custom rules.
+ */
 interface PolicyRule {
+    /** Unique key. Appears in `policyState` and `requirements`. */
     name: string;
+    /** For built-in rules: the option that switches the rule on. */
     optionsKey?: keyof PasswordPolicyOptions;
-    test: (password: string, options: Required<PasswordPolicyOptions>) => boolean;
+    /** Return `true` when the password passes. */
+    test: (password: string, options: ResolvedPolicyOptions) => boolean;
+    /** Human-readable requirement, e.g. "No spaces". Falls back to a prettified `name`. */
+    message?: RuleMessage;
+}
+/**
+ * Result of a strength estimator such as zxcvbn.
+ * `score` uses the zxcvbn scale: 0 (too guessable) … 4 (very unguessable).
+ */
+interface StrengthEstimate {
+    score: 0 | 1 | 2 | 3 | 4;
+    /** Optional hint to show the user, e.g. "This is a very common password". */
+    feedback?: string;
 }
+type StrengthEstimator = (password: string) => StrengthEstimate;
+/** Every option is optional. Omitted options fall back to the defaults. */
 interface PasswordPolicyOptions {
+    /** The password to validate (hook only — `validatePassword` takes it as the first argument). */
     password?: string;
+    /** Minimum length. Default `8`. */
     minLength?: number;
+    /** Maximum length. Default `0` (no maximum). */
+    maxLength?: number;
+    /** Require a lowercase letter. Default `true`. */
     lowercaseCheck?: boolean;
+    /** Require an uppercase letter. Default `true`. */
     uppercaseCheck?: boolean;
+    /** Require a digit. Default `true`. */
     numberCheck?: boolean;
+    /** Require a special character. Default `true`. */
     specialCharCheck?: boolean;
+    /** Reject very common passwords ("password", "qwerty123", "Password1!" …). Default `false`. */
+    commonPasswordCheck?: boolean;
+    /** Replace the built-in common-password list. */
+    commonPasswords?: readonly string[];
+    /**
+     * When set (even to `''`), adds a `match` rule that passes only if
+     * `password === confirmPassword`.
+     */
+    confirmPassword?: string;
+    /**
+     * Plug in a real strength estimator (e.g. zxcvbn via `fromZxcvbn`).
+     * When set, `strengthLabel` and `strengthPercent` come from the estimator.
+     */
+    strengthEstimator?: StrengthEstimator;
+    /** With `strengthEstimator`: minimum score (0–4) required. Adds a `strength` rule. */
+    minStrength?: 0 | 1 | 2 | 3 | 4;
+    /** Your own rules, checked after the built-in ones. */
     customRules?: PolicyRule[];
+    /** Override requirement text per rule name, e.g. `{ minLength: 'Mindestens 8 Zeichen' }`. */
+    messages?: Partial<Record<string, RuleMessage>>;
     lowercaseRegex?: RegExp;
     uppercaseRegex?: RegExp;
     numberRegex?: RegExp;
     specialCharRegex?: RegExp;
 }
+/** Options after defaults are applied. Passed to every rule's `test`. */
+type ResolvedPolicyOptions = Required<Omit<PasswordPolicyOptions, 'password' | 'confirmPassword' | 'strengthEstimator' | 'minStrength'>> & Pick<PasswordPolicyOptions, 'confirmPassword' | 'strengthEstimator' | 'minStrength'>;
+/** @deprecated Use `ResolvedPolicyOptions`. */
+type PolicyDefaults = ResolvedPolicyOptions;
+/** Pass/fail for each active rule, keyed by rule name. */
 interface PasswordPolicyState {
     [key: string]: boolean;
 }
-interface HookReturnValue {
-    password?: string;
+/** One row of a requirements checklist. */
+interface Requirement {
+    name: string;
+    passed: boolean;
+    message: string;
+}
+/** Result of `validatePassword` (and the hook). */
+interface ValidationResult {
+    /** `true` only when every active rule passes. */
     isValid: boolean;
-    strengthScore: number;
-    strengthLabel: 'Very Weak' | 'Weak' | 'Medium' | 'Strong' | 'Very Strong';
+    /** Pass/fail per rule name. */
     policyState: PasswordPolicyState;
+    /** Ordered checklist with human-readable messages. */
+    requirements: Requirement[];
+    /** Messages of the rules that failed, in order. Handy for form errors. */
+    errors: string[];
+    /** Number of rules that passed. */
+    strengthScore: number;
+    /** 0–1. Share of rules passed, or the estimator score / 4 when an estimator is set. */
+    strengthPercent: number;
+    strengthLabel: StrengthLabel;
+    /** The estimator's result, if `strengthEstimator` is set. */
+    estimate?: StrengthEstimate;
+}
+/** What `usePasswordPolicy` returns. */
+interface HookReturnValue extends ValidationResult {
+    password?: string;
 }
 
+/**
+ * Validate a password as the user types.
+ *
+ * Tip: if you pass an expensive `strengthEstimator` (like zxcvbn), memoize
+ * your options object so it is only recomputed when the password changes.
+ */
 declare const usePasswordPolicy: (options?: PasswordPolicyOptions) => HookReturnValue;
+type PwnedStatus = 'idle' | 'checking' | 'safe' | 'pwned' | 'error';
+interface UsePwnedPasswordOptions extends Omit<CheckPwnedOptions, 'signal'> {
+    /** Turn the check on/off (e.g. only once the policy passes). Default `true`. */
+    enabled?: boolean;
+    /** Wait this long after the last keystroke before checking. Default `500` ms. */
+    debounceMs?: number;
+}
+interface UsePwnedPasswordResult {
+    status: PwnedStatus;
+    /** Times seen in breaches (0 when safe or unknown). */
+    count: number;
+    isPwned: boolean;
+    error?: Error;
+}
+/**
+ * Check the password against Have I Been Pwned while the user types
+ * (debounced, cancels stale requests). Only a 5-character hash prefix is sent.
+ */
+declare function usePwnedPassword(password: string, options?: UsePwnedPasswordOptions): UsePwnedPasswordResult;
 
-interface PasswordPolicyInputProps extends React.ComponentPropsWithoutRef<'input'> {
+interface PasswordPolicyInputProps extends Omit<React.ComponentPropsWithoutRef<'input'>, 'type' | 'value' | 'defaultValue'> {
+    /** Controlled value. Leave undefined to let the component manage its own state. */
+    value?: string;
+    /** Initial value when uncontrolled. */
+    defaultValue?: string;
+    /** Same options as `usePasswordPolicy`. */
     policyOptions?: PasswordPolicyOptions;
+    /** Fires on every change with the new password and its full validation result. */
     onPasswordChange?: (password: string, validation: HookReturnValue) => void;
+    /** Default `true`. */
     showStrengthMeter?: boolean;
+    /** Show the strength label ("Strong") under the meter. Default `false`. */
+    showStrengthLabel?: boolean;
+    /** Default `true`. */
     showRequirementsList?: boolean;
+    /** Default `true`. */
     showToggleButton?: boolean;
+    /** Accessible labels for the show/hide button. */
+    toggleLabels?: {
+        show: string;
+        hide: string;
+    };
+    /** Skip the built-in CSS (class names stay). Import `use-password-policy/styles.css` or bring your own. */
+    unstyled?: boolean;
+    /** Class for the outer wrapper. */
+    className?: string;
+    /** Extra class for the <input> itself. */
+    inputClassName?: string;
+}
+declare const PasswordPolicyInput: React.ForwardRefExoticComponent<PasswordPolicyInputProps & React.RefAttributes<HTMLInputElement>>;
+
+/**
+ * Styles for <PasswordPolicyInput />. Kept deliberately low-specificity:
+ * the theme variables sit on `:where(.rpp-root)` (zero specificity), so any
+ * class you pass via `className` wins; inner parts use a single class
+ * (e.g. `.rpp-toggle`), which still beats global element resets like
+ * `button { … }`. Override them with `.your-class .rpp-toggle { … }`.
+ *
+ * Also shipped as `use-password-policy/styles.css` for use with `unstyled`.
+ */
+declare const passwordPolicyInputCss: string;
+
+/**
+ * A small, bundled list of the most common passwords and password "base words".
+ * Matching is case-insensitive and also catches simple variations
+ * (trailing digits/symbols, a leading number, and common leet swaps),
+ * so "Password123!", "P@ssw0rd" and "qwerty2024" are all caught.
+ *
+ * It is intentionally small (a few KB) — for full coverage, pair it with
+ * `checkPwnedPassword` / `usePwnedPassword` (Have I Been Pwned).
+ */
+declare const COMMON_PASSWORDS: readonly string[];
+
+/**
+ * use-password-policy/core
+ *
+ * Framework-free password validation. No React import, so it runs anywhere:
+ * the browser, Node, Deno, Bun, edge functions — which lets you enforce the
+ * exact same policy on the client and the server.
+ */
+
+declare const DEFAULT_OPTIONS: ResolvedPolicyOptions;
+/**
+ * Ready-made policies. Spread one and override what you need:
+ * `usePasswordPolicy({ ...presets.nist, password })`
+ */
+declare const presets: {
+    /** The classic checklist (these are also the defaults): 8+ chars, upper, lower, number, symbol. */
+    classic: {
+        minLength: number;
+        lowercaseCheck: true;
+        uppercaseCheck: true;
+        numberCheck: true;
+        specialCharCheck: true;
+    };
+    /**
+     * NIST SP 800-63B-4 (Aug 2025) for passwords used on their own:
+     * at least 15 characters, allow up to 64, no composition rules, block common passwords.
+     */
+    nist: {
+        minLength: number;
+        maxLength: number;
+        lowercaseCheck: false;
+        uppercaseCheck: false;
+        numberCheck: false;
+        specialCharCheck: false;
+        commonPasswordCheck: true;
+    };
+    /** NIST SP 800-63B-4 when the password is one factor of MFA: at least 8 characters. */
+    nistMfa: {
+        minLength: number;
+        maxLength: number;
+        lowercaseCheck: false;
+        uppercaseCheck: false;
+        numberCheck: false;
+        specialCharCheck: false;
+        commonPasswordCheck: true;
+    };
+};
+declare const DEFAULT_MESSAGES: Record<string, RuleMessage>;
+/** Merge user options over the defaults, ignoring keys set to `undefined`. */
+declare function resolveOptions(options?: PasswordPolicyOptions): ResolvedPolicyOptions;
+/**
+ * `true` if the password is on the list, or is a list entry with simple
+ * decoration: trailing digits/symbols ("password123!"), a leading number
+ * ("123qwerty") or leet swaps ("p@ssw0rd").
+ */
+declare function isCommonPassword(password: string, list?: readonly string[]): boolean;
+/**
+ * Validate a password against a policy. Pure and synchronous.
+ *
+ * ```ts
+ * import { validatePassword, presets } from 'use-password-policy/core';
+ * const { isValid, errors } = validatePassword(req.body.password, presets.nist);
+ * ```
+ */
+declare function validatePassword(password: string, options?: PasswordPolicyOptions): ValidationResult;
+/** Anything shaped like the result of `zxcvbn(password)` or `@zxcvbn-ts/core`'s `zxcvbn(password)`. */
+interface ZxcvbnLikeResult {
+    score: number;
+    feedback?: {
+        warning?: string | null;
+        suggestions?: readonly string[];
+    };
+}
+type ZxcvbnFn = (password: string, userInputs?: (string | number)[]) => ZxcvbnLikeResult;
+/**
+ * Wrap zxcvbn as a `strengthEstimator`. Accepts either a function
+ * (`zxcvbn` package, @zxcvbn-ts v3) or an object with `check`
+ * (@zxcvbn-ts v4's `new ZxcvbnFactory(options)`).
+ *
+ * ```ts
+ * import { ZxcvbnFactory } from '@zxcvbn-ts/core';
+ * const zxcvbn = new ZxcvbnFactory(options);
+ * usePasswordPolicy({ password, strengthEstimator: fromZxcvbn(zxcvbn), minStrength: 3 });
+ * ```
+ */
+declare function fromZxcvbn(zxcvbn: ZxcvbnFn | {
+    check: ZxcvbnFn;
+}, userInputs?: (string | number)[]): StrengthEstimator;
+/** Minimal shape of Zod's refinement context (works with Zod 3 and 4). */
+interface ZodLikeRefinementCtx {
+    addIssue(issue: {
+        code: 'custom';
+        message: string;
+    }): void;
 }
-declare const PasswordPolicyInput: FC<PasswordPolicyInputProps>;
+/**
+ * Use your policy inside a Zod schema:
+ *
+ * ```ts
+ * const schema = z.object({ password: z.string().superRefine(zodPasswordRule(policy)) });
+ * ```
+ * Adds one issue per failed rule (or only the first with `{ allErrors: false }`).
+ */
+declare function zodPasswordRule(options?: PasswordPolicyOptions, { allErrors }?: {
+    allErrors?: boolean | undefined;
+}): (value: string, ctx: ZodLikeRefinementCtx) => void;
+/**
+ * A validate function that returns `true` or the first error message.
+ * Drops straight into react-hook-form's `validate`, and works with anything
+ * that uses the same convention.
+ *
+ * ```ts
+ * register('password', { validate: passwordValidator(policy) })
+ * ```
+ */
+declare function passwordValidator(options?: PasswordPolicyOptions): (value: string) => true | string;
 
-export { type HookReturnValue, PasswordPolicyInput, type PasswordPolicyInputProps, type PasswordPolicyOptions, type PasswordPolicyState, type PolicyRule, usePasswordPolicy };
+export { COMMON_PASSWORDS, type CheckPwnedOptions, DEFAULT_MESSAGES, DEFAULT_OPTIONS, type HookReturnValue, PasswordPolicyInput, type PasswordPolicyInputProps, type PasswordPolicyOptions, type PasswordPolicyState, type PolicyDefaults, type PolicyRule, type PwnedStatus, type Requirement, type ResolvedPolicyOptions, type RuleMessage, type StrengthEstimate, type StrengthEstimator, type StrengthLabel, type UsePwnedPasswordOptions, type UsePwnedPasswordResult, type ValidationResult, type ZodLikeRefinementCtx, type ZxcvbnLikeResult, checkPwnedPassword, fromZxcvbn, isCommonPassword, passwordPolicyInputCss, passwordValidator, presets, resolveOptions, usePasswordPolicy, usePwnedPassword, validatePassword, zodPasswordRule };