@carecard/validate 3.23.0 → 3.25.0

package/.agents/skills/pkg-validate-validation-library/SKILL.md

@@ -108,10 +108,12 @@ depend on those folders being present.
 
 ## Validation Behavior
 
-- Low-level validators should be deterministic predicate functions that return
-  `true` or `false`.
-- Password failure-message helpers should return `null` for valid input and a
-  user-readable string for invalid input.
+- General low-level validators should be deterministic predicate functions that
+  return `true` or `false`.
+- `validatePassword` is the sole password-policy function and sole direct
+  password export. It returns the NFC-normalized accepted value or a stable
+  failure reason; do not add password predicates, aliases, failure-message
+  helpers, or a nested password export.
 - `validateProperties` should return a new sanitized object and omit unknown or
   invalid fields without mutating the input.
 - `validateWhitelistProperties` should reject missing or invalid required fields
@@ -204,20 +206,20 @@ repository's agents-only Git workflow:
    and mark the pull request ready for review with `gh pr ready <number>`.
 5. Squash-merge with administrator privileges and delete the remote branch:
 
-    ```sh
-    gh pr merge <number> --squash --admin --delete-branch
-    ```
+   ```sh
+   gh pr merge <number> --squash --admin --delete-branch
+   ```
 
 6. After merge, update the local base branch and remove the local feature
    branch:
 
-    ```sh
-    git fetch origin <base> --prune
-    git switch <base>
-    git pull --ff-only origin <base>
-    git branch -d feature/codex
-    git ls-remote --heads origin feature/codex
-    ```
+   ```sh
+   git fetch origin <base> --prune
+   git switch <base>
+   git pull --ff-only origin <base>
+   git branch -d feature/codex
+   git ls-remote --heads origin feature/codex
+   ```
 
 Do not commit or push `.agents` guidance changes directly from `development`
 or `main`. Do not stage unrelated files, generated output, dependency folders,

package/.github/workflows/ci.yml

@@ -29,7 +29,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 24.18.0
+          node-version-file: '.nvmrc'
           cache: 'npm'
 
       - name: Install dependencies

package/.github/workflows/publish.yml

@@ -1,63 +1,63 @@
 name: Publish to npm
 
 on:
-    push:
-        branches:
-            - development
-            - main
+  push:
+    branches:
+      - development
+      - main
 
 permissions:
-    id-token: write
-    contents: read
+  id-token: write
+  contents: read
 
 jobs:
-    publish:
-        runs-on: ubuntu-latest
-        steps:
-            - name: Checkout code
-              uses: actions/checkout@v7
-
-            - name: Setup Node.js
-              uses: actions/setup-node@v6
-              with:
-                  node-version: '25'
-                  registry-url: 'https://registry.npmjs.org'
-                  package-manager-cache: false
-
-            - name: Remove unsupported npm auth config
-              run: |
-                  npm_config_file="${NPM_CONFIG_USERCONFIG:-$HOME/.npmrc}"
-                  if [ -f "$npm_config_file" ]; then
-                    sed -i '/^[[:space:]]*always-auth[[:space:]]*=.*/d' "$npm_config_file"
-                  fi
-
-            - name: Install dependencies
-              # Added HUSKY=0 to prevent the husky error in logs
-              run: npm ci
-              env:
-                  HUSKY: 0
-
-            - name: Check package version
-              id: package-version
-              run: |
-                  package_name="$(node -p "require('./package.json').name")"
-                  package_version="$(node -p "require('./package.json').version")"
-
-                  echo "package_name=${package_name}" >> "$GITHUB_OUTPUT"
-                  echo "package_version=${package_version}" >> "$GITHUB_OUTPUT"
-
-                  published_versions="$(npm view "${package_name}" versions --json)"
-                  if node -e 'const value=JSON.parse(process.argv[1]); const versions=Array.isArray(value) ? value : [value]; process.exit(versions.includes(process.argv[2]) ? 0 : 1);' "$published_versions" "$package_version"; then
-                    echo "${package_name}@${package_version} is already published."
-                    echo "should_publish=false" >> "$GITHUB_OUTPUT"
-                  else
-                    echo "${package_name}@${package_version} is not published yet."
-                    echo "should_publish=true" >> "$GITHUB_OUTPUT"
-                  fi
-
-            - name: Publish to npm
-              if: steps.package-version.outputs.should_publish == 'true'
-              run: npm publish --provenance --access public
-              env:
-                  HUSKY: 0
-                  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: '.nvmrc'
+          registry-url: 'https://registry.npmjs.org'
+          package-manager-cache: false
+
+      - name: Remove unsupported npm auth config
+        run: |
+          npm_config_file="${NPM_CONFIG_USERCONFIG:-$HOME/.npmrc}"
+          if [ -f "$npm_config_file" ]; then
+            sed -i '/^[[:space:]]*always-auth[[:space:]]*=.*/d' "$npm_config_file"
+          fi
+
+      - name: Install dependencies
+        # Added HUSKY=0 to prevent the husky error in logs
+        run: npm ci
+        env:
+          HUSKY: 0
+
+      - name: Check package version
+        id: package-version
+        run: |
+          package_name="$(node -p "require('./package.json').name")"
+          package_version="$(node -p "require('./package.json').version")"
+
+          echo "package_name=${package_name}" >> "$GITHUB_OUTPUT"
+          echo "package_version=${package_version}" >> "$GITHUB_OUTPUT"
+
+          published_versions="$(npm view "${package_name}" versions --json)"
+          if node -e 'const value=JSON.parse(process.argv[1]); const versions=Array.isArray(value) ? value : [value]; process.exit(versions.includes(process.argv[2]) ? 0 : 1);' "$published_versions" "$package_version"; then
+            echo "${package_name}@${package_version} is already published."
+            echo "should_publish=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "${package_name}@${package_version} is not published yet."
+            echo "should_publish=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Publish to npm
+        if: steps.package-version.outputs.should_publish == 'true'
+        run: npm publish --provenance --access public
+        env:
+          HUSKY: 0
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package/.nvmrc

@@ -0,0 +1 @@
+24.20.0

package/THIRD_PARTY_NOTICES

@@ -0,0 +1,31 @@
+SecLists 10k most common passwords
+===================================
+
+data/commonPasswords.json contains the 10,000 entries from
+Passwords/Common-Credentials/10k-most-common.txt in SecLists tag 2026.1,
+plus four CareCard-specific blocked phrases. The pinned upstream file has SHA-256
+4adb3f0afb4a10cf19ebe48d8c69a46f934bbc8d77c694c210564f9583e7f4ba.
+
+Source: https://github.com/danielmiessler/SecLists/blob/2026.1/Passwords/Common-Credentials/10k-most-common.txt
+
+MIT License
+
+Copyright (c) 2018 Daniel Miessler
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.