@adonis-agora/authkit-server 0.34.0

package/build/src/observability/telescope/data_providers.js

@@ -0,0 +1,235 @@
+/** The Telescope entry `type` the generic diagnostics watcher records under. */
+const DIAGNOSTIC_TYPE = "diagnostic";
+/** The tag the diagnostics watcher stamps for authkit-emitted events. */
+const AUTHKIT_TAG = "lib:authkit";
+/** Default rolling window for the entry-backed providers (24h). */
+const DEFAULT_WINDOW_MS = 24 * 60 * 60 * 1000;
+/** Fetch captured `agora:authkit:*` audit entries from Telescope (newest-first). */
+async function fetchEntries(ctx, limit = 5_000) {
+    return ctx.store.list({
+        type: DIAGNOSTIC_TYPE,
+        tag: AUTHKIT_TAG,
+        limit,
+    });
+}
+/** The `AuditEventType` an entry carries (under `content.event`), or `''`. */
+function eventOf(e) {
+    return e.content?.event ?? "";
+}
+/** Epoch millis the entry was recorded at, or `0` when absent/unparsable. */
+function timeOf(e) {
+    return e.createdAt ? +new Date(e.createdAt) : 0;
+}
+/** Count entries whose `content.event` is one of `types`. */
+function countByType(entries, types) {
+    const set = new Set(types);
+    let n = 0;
+    for (const e of entries)
+        if (set.has(eventOf(e)))
+            n += 1;
+    return n;
+}
+/** Split entries into the current `(now-window, now]` and previous window. */
+function splitWindows(entries, windowMs, now) {
+    const start = now - windowMs;
+    const prevStart = start - windowMs;
+    return {
+        current: entries.filter((e) => timeOf(e) > start && timeOf(e) <= now),
+        previous: entries.filter((e) => timeOf(e) > prevStart && timeOf(e) <= start),
+    };
+}
+// The audit event groupings the dashboard rolls up.
+const LOGIN_SUCCESS = ["login.success"];
+const LOGIN_FAILURE = [
+    "login.failure",
+    "bot_protection.rejected",
+];
+const MFA_ENROLLMENTS = [
+    "mfa.enabled",
+    "passkey.registered",
+];
+const LOCKOUTS = ["account.locked", "otp.locked"];
+const PAT_EVENTS = [
+    "pat.issued",
+    "pat.revoked",
+    "pat.used",
+];
+const IMPERSONATION_EVENTS = [
+    "impersonation",
+    "impersonation.started",
+];
+/**
+ * A stat (`{ value, delta?, spark? }`) over a window for a set of event types.
+ * `query.metric` chooses the grouping; `query.windowMs` the window (default 24h).
+ */
+export function authkitEventCountProvider() {
+    return {
+        name: "authkit.eventCount",
+        async resolve(query, ctx) {
+            const entries = await fetchEntries(ctx);
+            const windowMs = Number(query?.windowMs ?? DEFAULT_WINDOW_MS);
+            const now = Date.now();
+            const types = typesForMetric(query?.metric);
+            const { current, previous } = splitWindows(entries, windowMs, now);
+            const value = countByType(current, types);
+            const delta = previous.length > 0 ? value - countByType(previous, types) : undefined;
+            const sparkBuckets = 8;
+            const bucketSize = windowMs / sparkBuckets;
+            const sparkStart = now - windowMs;
+            const spark = Array.from({ length: sparkBuckets }, (_, i) => {
+                const bStart = sparkStart + i * bucketSize;
+                const bEntries = current.filter((e) => {
+                    const t = timeOf(e);
+                    return t > bStart && t <= bStart + bucketSize;
+                });
+                return countByType(bEntries, types);
+            });
+            return delta === undefined ? { value, spark } : { value, delta, spark };
+        },
+    };
+}
+/** Map a panel `metric` to the set of `AuditEventType`s it aggregates. */
+function typesForMetric(metric) {
+    switch (metric) {
+        case "loginFailure":
+            return LOGIN_FAILURE;
+        case "mfaEnrollments":
+            return MFA_ENROLLMENTS;
+        case "lockouts":
+            return LOCKOUTS;
+        case "pat":
+            return PAT_EVENTS;
+        case "impersonation":
+            return IMPERSONATION_EVENTS;
+        case "loginSuccess":
+        default:
+            return LOGIN_SUCCESS;
+    }
+}
+/**
+ * Login success rate as a gauge (`{ value, min, max }`), over `query.windowMs`
+ * (default 24h). `1` when there were no logins in the window.
+ */
+export function authkitLoginSuccessRateProvider() {
+    return {
+        name: "authkit.loginSuccessRate",
+        async resolve(query, ctx) {
+            const entries = await fetchEntries(ctx);
+            const windowMs = Number(query?.windowMs ?? DEFAULT_WINDOW_MS);
+            const { current } = splitWindows(entries, windowMs, Date.now());
+            const ok = countByType(current, LOGIN_SUCCESS);
+            const bad = countByType(current, LOGIN_FAILURE);
+            const total = ok + bad;
+            return { value: total === 0 ? 1 : ok / total, min: 0, max: 1 };
+        },
+    };
+}
+/**
+ * Logins over time as `timeseries` rows (`{ rows: [{ label, success, failure }] }`),
+ * bucketed into `query.buckets ?? 24` equal time buckets across the captured span.
+ */
+export function authkitLoginsOverTimeProvider() {
+    return {
+        name: "authkit.loginsOverTime",
+        async resolve(query, ctx) {
+            const entries = await fetchEntries(ctx);
+            const n = Math.max(1, Number(query?.buckets ?? 24));
+            const now = Date.now();
+            let minT = now;
+            for (const e of entries) {
+                const t = timeOf(e);
+                if (t > 0)
+                    minT = Math.min(minT, t);
+            }
+            const span = Math.max(now - minT, 1);
+            const bucketSize = span / n;
+            const rows = Array.from({ length: n }, (_, i) => ({
+                label: new Date(minT + i * bucketSize).toISOString().slice(11, 16),
+                success: 0,
+                failure: 0,
+            }));
+            const successSet = new Set(LOGIN_SUCCESS);
+            const failureSet = new Set(LOGIN_FAILURE);
+            for (const e of entries) {
+                const event = eventOf(e);
+                const isSuccess = successSet.has(event);
+                const isFailure = failureSet.has(event);
+                if (!isSuccess && !isFailure)
+                    continue;
+                const row = rows[Math.min(n - 1, Math.floor((timeOf(e) - minT) / bucketSize))];
+                if (row) {
+                    if (isSuccess)
+                        row.success += 1;
+                    else
+                        row.failure += 1;
+                }
+            }
+            return { rows };
+        },
+    };
+}
+/** Donut/bar `breakdown` segments — a count per top-level audit event family. */
+const BREAKDOWN_GROUPS = [
+    { label: "Login OK", types: LOGIN_SUCCESS, color: "#34d399" },
+    { label: "Login fail", types: LOGIN_FAILURE, color: "#f87171" },
+    { label: "MFA", types: MFA_ENROLLMENTS, color: "#38bdf8" },
+    { label: "Lockouts", types: LOCKOUTS, color: "#fbbf24" },
+    { label: "PAT", types: PAT_EVENTS, color: "#a78bfa" },
+    { label: "Impersonation", types: IMPERSONATION_EVENTS, color: "#fb923c" },
+];
+export function authkitEventBreakdownProvider() {
+    return {
+        name: "authkit.eventBreakdown",
+        async resolve(query, ctx) {
+            const entries = await fetchEntries(ctx);
+            const windowMs = Number(query?.windowMs ?? DEFAULT_WINDOW_MS);
+            const { current } = splitWindows(entries, windowMs, Date.now());
+            const segments = BREAKDOWN_GROUPS.map((g) => ({
+                label: g.label,
+                value: countByType(current, g.types),
+                color: g.color,
+            }));
+            return { segments };
+        },
+    };
+}
+/**
+ * Recent PAT + impersonation activity as `table` rows (newest-first), bounded by
+ * `query.limit` (default 50). Each row exposes the event, subject and actor.
+ */
+export function authkitTokenActivityProvider() {
+    return {
+        name: "authkit.tokenActivity",
+        async resolve(query, ctx) {
+            const entries = await fetchEntries(ctx);
+            const limit = Math.min(200, Math.max(10, Number(query?.limit ?? 50)));
+            const watched = new Set([...PAT_EVENTS, ...IMPERSONATION_EVENTS]);
+            const rows = entries
+                .filter((e) => watched.has(eventOf(e)))
+                .slice(0, limit)
+                .map((e) => {
+                const p = e.content?.payload;
+                return {
+                    at: e.createdAt
+                        ? `${new Date(e.createdAt).toISOString().replace("T", " ").slice(0, 16)}Z`
+                        : "",
+                    event: eventOf(e),
+                    subject: p?.accountId ?? "",
+                    actor: p?.actorId ?? "",
+                    ip: p?.ip ?? "",
+                };
+            });
+            return { rows };
+        },
+    };
+}
+/** Every authkit data provider, in registration order. */
+export function authkitDataProviders() {
+    return [
+        authkitEventCountProvider(),
+        authkitLoginSuccessRateProvider(),
+        authkitLoginsOverTimeProvider(),
+        authkitEventBreakdownProvider(),
+        authkitTokenActivityProvider(),
+    ];
+}

package/build/src/observability/telescope/extension.d.ts

@@ -0,0 +1,29 @@
+import type { TelescopeExtension } from "@adonis-agora/telescope";
+/** Options for {@link defineAuthkitTelescopeExtension}. */
+export interface AuthkitTelescopeOptions {
+    /**
+     * Rolling window (ms) the "Security" stat/gauge/breakdown panels aggregate
+     * over. Default 24h.
+     */
+    windowMs?: number;
+}
+/**
+ * The first-class `@adonis-agora/telescope` extension for `@adonis-agora/authkit-server`:
+ * a "Security" auth dashboard (login health, MFA, lockouts, PAT / impersonation)
+ * plus the data providers it binds to. Wire it into `config/telescope.ts`:
+ *
+ * ```ts
+ * import { defineConfig } from "@adonis-agora/telescope"
+ * import { defineAuthkitTelescopeExtension } from "@adonis-agora/authkit-server/telescope"
+ *
+ * export default defineConfig({ extensions: [defineAuthkitTelescopeExtension()] })
+ * ```
+ *
+ * No watcher is contributed — the authkit provider already bridges every audit
+ * event onto the diagnostics bus (`agora:authkit:<AuditEventType>`), and
+ * Telescope's generic diagnostics watcher records them as `diagnostic` entries
+ * tagged `lib:authkit`. The providers aggregate those captured entries; the
+ * baseline (events on the bus) works without this extension — registering it
+ * just adds the dedicated dashboard.
+ */
+export declare function defineAuthkitTelescopeExtension(opts?: AuthkitTelescopeOptions): TelescopeExtension;

package/build/src/observability/telescope/extension.js

@@ -0,0 +1,167 @@
+import { authkitDataProviders } from "./data_providers.js";
+/**
+ * The navigable entry type the extension contributes: it scopes Telescope's
+ * entry-type nav to authkit's audit events (recorded as `diagnostic` entries
+ * tagged `lib:authkit`).
+ */
+function authkitEntryType() {
+    return { id: "authkit", label: "Auth", dot: "bg-emerald-400" };
+}
+/**
+ * The authkit "Security" dashboard — a golden-signals layout for auth: login
+ * health up top, then what-needs-attention (lockouts, failed logins, PAT /
+ * impersonation activity), then trends. Pure data: panels bind to the
+ * `authkit.*` data providers by name.
+ */
+function authkitSecurityDashboard(opts) {
+    const windowMs = opts.windowMs ?? 24 * 60 * 60 * 1000;
+    return {
+        id: "authkit.security",
+        label: "Security",
+        navGroup: "Auth",
+        panels: [],
+        sections: [
+            {
+                title: "Logins",
+                cols: 4,
+                panels: [
+                    {
+                        kind: "gauge",
+                        title: "Login success rate",
+                        data: { provider: "authkit.loginSuccessRate", query: { windowMs } },
+                        max: 1,
+                        format: "percent",
+                        thresholds: { warn: 0.9, bad: 0.75, direction: "down-bad" },
+                    },
+                    {
+                        kind: "stat",
+                        title: "Successful logins",
+                        data: {
+                            provider: "authkit.eventCount",
+                            query: { metric: "loginSuccess", windowMs },
+                        },
+                        spark: true,
+                    },
+                    {
+                        kind: "stat",
+                        title: "Failed logins",
+                        data: {
+                            provider: "authkit.eventCount",
+                            query: { metric: "loginFailure", windowMs },
+                        },
+                        spark: true,
+                        thresholds: { warn: 25, bad: 100, direction: "up-bad" },
+                    },
+                    {
+                        kind: "stat",
+                        title: "Account lockouts",
+                        data: {
+                            provider: "authkit.eventCount",
+                            query: { metric: "lockouts", windowMs },
+                        },
+                        spark: true,
+                        thresholds: { warn: 5, bad: 25, direction: "up-bad" },
+                    },
+                ],
+            },
+            {
+                title: "MFA & tokens",
+                cols: 3,
+                panels: [
+                    {
+                        kind: "stat",
+                        title: "MFA / passkey enrollments",
+                        data: {
+                            provider: "authkit.eventCount",
+                            query: { metric: "mfaEnrollments", windowMs },
+                        },
+                        spark: true,
+                    },
+                    {
+                        kind: "stat",
+                        title: "Impersonation events",
+                        data: {
+                            provider: "authkit.eventCount",
+                            query: { metric: "impersonation", windowMs },
+                        },
+                        spark: true,
+                        thresholds: { warn: 1, bad: 10, direction: "up-bad" },
+                    },
+                    {
+                        kind: "stat",
+                        title: "PAT activity",
+                        data: {
+                            provider: "authkit.eventCount",
+                            query: { metric: "pat", windowMs },
+                        },
+                        spark: true,
+                    },
+                ],
+            },
+            {
+                title: "Trends",
+                cols: 2,
+                panels: [
+                    {
+                        kind: "timeseries",
+                        title: "Logins over time",
+                        data: { provider: "authkit.loginsOverTime" },
+                        series: ["success", "failure"],
+                        style: "stacked",
+                    },
+                    {
+                        kind: "breakdown",
+                        title: "Events by family",
+                        data: { provider: "authkit.eventBreakdown", query: { windowMs } },
+                        style: "donut",
+                    },
+                ],
+            },
+            {
+                title: "PAT & impersonation activity",
+                cols: 2,
+                panels: [
+                    {
+                        kind: "table",
+                        title: "Recent token & impersonation events",
+                        data: { provider: "authkit.tokenActivity" },
+                        columns: [
+                            { key: "at", label: "When" },
+                            { key: "event", label: "Event" },
+                            { key: "subject", label: "Subject" },
+                            { key: "actor", label: "Actor" },
+                            { key: "ip", label: "IP" },
+                        ],
+                    },
+                ],
+            },
+        ],
+    };
+}
+/**
+ * The first-class `@adonis-agora/telescope` extension for `@adonis-agora/authkit-server`:
+ * a "Security" auth dashboard (login health, MFA, lockouts, PAT / impersonation)
+ * plus the data providers it binds to. Wire it into `config/telescope.ts`:
+ *
+ * ```ts
+ * import { defineConfig } from "@adonis-agora/telescope"
+ * import { defineAuthkitTelescopeExtension } from "@adonis-agora/authkit-server/telescope"
+ *
+ * export default defineConfig({ extensions: [defineAuthkitTelescopeExtension()] })
+ * ```
+ *
+ * No watcher is contributed — the authkit provider already bridges every audit
+ * event onto the diagnostics bus (`agora:authkit:<AuditEventType>`), and
+ * Telescope's generic diagnostics watcher records them as `diagnostic` entries
+ * tagged `lib:authkit`. The providers aggregate those captured entries; the
+ * baseline (events on the bus) works without this extension — registering it
+ * just adds the dedicated dashboard.
+ */
+export function defineAuthkitTelescopeExtension(opts = {}) {
+    return {
+        name: "authkit",
+        entryTypes: () => [authkitEntryType()],
+        dashboards: () => [authkitSecurityDashboard(opts)],
+        dataProviders: () => authkitDataProviders(),
+    };
+}

package/build/src/observability/telescope/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The optional `@adonis-agora/telescope` integration for authkit, isolated to this
+ * subpath (`@adonis-agora/authkit-server/telescope`) so the main barrel never
+ * pulls in telescope. Import it ONLY from `config/telescope.ts`, where both
+ * `@adonis-agora/telescope` and `@adonis-agora/authkit-server` are installed.
+ */
+export { defineAuthkitTelescopeExtension, type AuthkitTelescopeOptions, } from "./extension.js";
+export { authkitDataProviders, authkitEventCountProvider, authkitLoginSuccessRateProvider, authkitLoginsOverTimeProvider, authkitEventBreakdownProvider, authkitTokenActivityProvider, } from "./data_providers.js";

package/build/src/observability/telescope/index.js

@@ -0,0 +1,8 @@
+/**
+ * The optional `@adonis-agora/telescope` integration for authkit, isolated to this
+ * subpath (`@adonis-agora/authkit-server/telescope`) so the main barrel never
+ * pulls in telescope. Import it ONLY from `config/telescope.ts`, where both
+ * `@adonis-agora/telescope` and `@adonis-agora/authkit-server` are installed.
+ */
+export { defineAuthkitTelescopeExtension, } from "./extension.js";
+export { authkitDataProviders, authkitEventCountProvider, authkitLoginSuccessRateProvider, authkitLoginsOverTimeProvider, authkitEventBreakdownProvider, authkitTokenActivityProvider, } from "./data_providers.js";

package/build/src/observability/wire_provider_events.d.ts

@@ -0,0 +1,12 @@
+import { type MetricsRecorder } from "@adonis-agora/authkit-core";
+/**
+ * Liga eventos do oidc-provider aos counters do recorder. Usa só eventos reais
+ * do v9 (verificados em node_modules/oidc-provider/lib):
+ * - `grant.success`        (actions/token.js)              -> loginSuccess
+ * - `server_error`         (shared/error_handler.js)        -> loginFailure
+ * - `access_token.saved`   (models/base_model.js: <kind>.saved)   -> tokenIssued
+ * - `access_token.issued`  (models/base_model.js: <kind>.issued)  -> tokenIssued
+ * - `refresh_token.saved`  (models/base_model.js: <kind>.saved)   -> refreshRotated
+ * - `grant.revoked`        (helpers/revoke.js)              -> grantRevoked
+ */
+export declare function wireProviderEvents(provider: any, recorder: MetricsRecorder): void;

package/build/src/observability/wire_provider_events.js

@@ -0,0 +1,30 @@
+import { AUTHKIT_METRICS, } from "@adonis-agora/authkit-core";
+import { emitDiagnostic } from "./diagnostics_bridge.js";
+/**
+ * Liga eventos do oidc-provider aos counters do recorder. Usa só eventos reais
+ * do v9 (verificados em node_modules/oidc-provider/lib):
+ * - `grant.success`        (actions/token.js)              -> loginSuccess
+ * - `server_error`         (shared/error_handler.js)        -> loginFailure
+ * - `access_token.saved`   (models/base_model.js: <kind>.saved)   -> tokenIssued
+ * - `access_token.issued`  (models/base_model.js: <kind>.issued)  -> tokenIssued
+ * - `refresh_token.saved`  (models/base_model.js: <kind>.saved)   -> refreshRotated
+ * - `grant.revoked`        (helpers/revoke.js)              -> grantRevoked
+ */
+export function wireProviderEvents(provider, recorder) {
+    provider.on("grant.success", () => recorder.increment(AUTHKIT_METRICS.loginSuccess));
+    provider.on("server_error", () => recorder.increment(AUTHKIT_METRICS.loginFailure));
+    provider.on("access_token.saved", () => {
+        recorder.increment(AUTHKIT_METRICS.tokenIssued);
+        // Emit estrutural irmão (best-effort, no-op sem o slot de diagnostics).
+        emitDiagnostic("token.issued", { kind: "access_token" });
+    });
+    provider.on("access_token.issued", () => {
+        recorder.increment(AUTHKIT_METRICS.tokenIssued);
+        emitDiagnostic("token.issued", { kind: "access_token" });
+    });
+    provider.on("refresh_token.saved", () => {
+        recorder.increment(AUTHKIT_METRICS.refreshRotated);
+        emitDiagnostic("token.refreshed", { kind: "refresh_token" });
+    });
+    provider.on("grant.revoked", () => recorder.increment(AUTHKIT_METRICS.grantRevoked));
+}

package/build/src/password/common_passwords.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Verificação offline de senhas comuns (common-password block).
+ *
+ * Carrega um arquivo embutido com as ~10 000 senhas mais comuns (derivado de
+ * datasets públicos: rockyou, SecLists Common-Credentials, NIST SP 800-63B).
+ * A checagem é case-insensitive e roda ANTES do HIBP em `assertAcceptable`.
+ *
+ * Armazenamento: Set<string> em memória, carregado UMA vez via lazy init.
+ * Custo: ~50–80 KB de strings; carregamento é síncrono após a primeira chamada.
+ *
+ * Fonte dos dados: compilação de senhas comuns de domínio público.
+ * Licença do arquivo de dados: CC0 / Public Domain.
+ */
+/**
+ * Verifica se a senha fornecida consta na lista offline de senhas comuns.
+ *
+ * A checagem é case-insensitive: "Password123" é tratado como "password123"
+ * para fins de comparação. O carregamento da lista ocorre na primeira chamada.
+ *
+ * @returns `true` se a senha for considerada comum (deve ser rejeitada).
+ */
+export declare function isCommonPassword(plain: string): boolean;
+/**
+ * Número de entradas na lista de senhas comuns. Útil para testes e diagnóstico.
+ */
+export declare function commonPasswordsCount(): number;
+/**
+ * Permite substituir o Set de senhas comuns (usado em testes).
+ * @internal
+ */
+export declare function __setCommonPasswordsForTests(passwords: Set<string> | null): void;

package/build/src/password/common_passwords.js

@@ -0,0 +1,73 @@
+/**
+ * Verificação offline de senhas comuns (common-password block).
+ *
+ * Carrega um arquivo embutido com as ~10 000 senhas mais comuns (derivado de
+ * datasets públicos: rockyou, SecLists Common-Credentials, NIST SP 800-63B).
+ * A checagem é case-insensitive e roda ANTES do HIBP em `assertAcceptable`.
+ *
+ * Armazenamento: Set<string> em memória, carregado UMA vez via lazy init.
+ * Custo: ~50–80 KB de strings; carregamento é síncrono após a primeira chamada.
+ *
+ * Fonte dos dados: compilação de senhas comuns de domínio público.
+ * Licença do arquivo de dados: CC0 / Public Domain.
+ */
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { join, dirname } from 'node:path';
+/**
+ * Set em memória das senhas comuns (minúsculas). Inicializado na primeira
+ * chamada a `isCommonPassword`. O módulo garante que o carregamento ocorre
+ * apenas uma vez (lazy singleton).
+ */
+let _commonPasswordsSet = null;
+/**
+ * Carrega o arquivo de senhas comuns uma única vez (lazy).
+ *
+ * FAIL-SAFE: se o arquivo não existir ou não puder ser lido (ex.: bundle sem
+ * assets), retorna um Set vazio — a checagem vira no-op sem quebrar o fluxo.
+ */
+function loadCommonPasswords() {
+    if (_commonPasswordsSet !== null)
+        return _commonPasswordsSet;
+    try {
+        const __filename = fileURLToPath(import.meta.url);
+        const __dir = dirname(__filename);
+        const filePath = join(__dir, 'common_passwords.txt');
+        const content = readFileSync(filePath, 'utf-8');
+        const entries = content
+            .split('\n')
+            .map((l) => l.trim().toLowerCase())
+            .filter((l) => l.length > 0 && !l.startsWith('#'));
+        _commonPasswordsSet = new Set(entries);
+    }
+    catch {
+        // Fail-safe: arquivo ausente → Set vazio (no-op check).
+        _commonPasswordsSet = new Set();
+    }
+    return _commonPasswordsSet;
+}
+/**
+ * Verifica se a senha fornecida consta na lista offline de senhas comuns.
+ *
+ * A checagem é case-insensitive: "Password123" é tratado como "password123"
+ * para fins de comparação. O carregamento da lista ocorre na primeira chamada.
+ *
+ * @returns `true` se a senha for considerada comum (deve ser rejeitada).
+ */
+export function isCommonPassword(plain) {
+    const set = loadCommonPasswords();
+    return set.has(plain.toLowerCase());
+}
+/**
+ * Número de entradas na lista de senhas comuns. Útil para testes e diagnóstico.
+ */
+export function commonPasswordsCount() {
+    return loadCommonPasswords().size;
+}
+/**
+ * Permite substituir o Set de senhas comuns (usado em testes).
+ * @internal
+ */
+export function __setCommonPasswordsForTests(passwords) {
+    _commonPasswordsSet = passwords;
+}