@connextar/house 0.12.0 → 0.13.1

package/dist/password/common.js

@@ -0,0 +1,58 @@
+/**
+ * The words people build passwords out of, most guessed first.
+ *
+ * The head is the top of the leaked-password lists every attacker starts with;
+ * the tail is the words those passwords are made of — pets, teams, seasons,
+ * months, feelings, keyboard rows — so "Sunshine2024!" is read as a common word
+ * dressed up rather than as twelve unknown characters. Kept to a few kilobytes
+ * on purpose: a full frequency list is what makes zxcvbn several hundred
+ * kilobytes, and the patterns (sequences, repeats, keyboard walks, dates) do
+ * most of the work a list would.
+ *
+ * A word's rank is its position, and its rank is roughly how many guesses an
+ * attacker spends before trying it. Lower case, three letters or more.
+ */
+const WORDS = `
+password 123456 123456789 12345678 12345 qwerty 1234567 111111 1234567890 123123
+abc123 1234 password1 iloveyou 000000 qwerty123 dragon monkey letmein 654321
+football baseball welcome admin login master sunshine princess shadow superman
+starwars trustno1 passw0rd whatever qazwsx michael charlie freedom hello secret
+ashley bailey jordan jennifer hunter thomas batman soccer hockey killer george
+andrew michelle jessica pepper daniel access mustang ginger joshua cheese amanda
+summer love buster tigger robert matthew yankees dallas austin thunder taylor
+harley hannah heather maggie orange computer internet flower silver golden
+cookie chelsea arsenal liverpool manchester united london england google
+apple banana chocolate coffee purple yellow blue green black white red pink
+winter spring autumn january february march april june july august september
+october november december monday tuesday wednesday thursday friday saturday
+sunday family friends forever angel angels baby babygirl lovely loveme lover
+pass pass123 password123 admin123 root toor test test123 guest user default
+changeme temp temporary qwertyuiop asdfgh asdfghjkl zxcvbn zxcvbnm azerty
+qwertz 1q2w3e4r 1qaz2wsx zaq12wsx q1w2e3r4 abcdef abcd1234 aaaaaa 121212
+112233 123321 666666 696969 777777 888888 999999 987654321 159753 147258
+myspace facebook twitter instagram linkedin microsoft windows samsung iphone
+nintendo pokemon minecraft fortnite matrix hello123 welcome1 letmein1 football1
+princess1 monkey1 dragon1 sunshine1 iloveyou1 qwerty1 charlie1 lovely1 secret1
+tiger lion bear wolf eagle falcon dolphin horse puppy kitty kitten doggie
+snoopy scooter buddy lucky oliver jack harry sophie emily olivia jacob william
+james john david richard joseph charles mark paul steven kevin brian edward
+mary patricia linda barbara elizabeth susan margaret sarah karen nancy lisa
+anna maria laura helen emma grace chloe lucy ella mia amelia isla ava lily
+alexander benjamin samuel henry oscar leo noah arthur alfie theo archie freddie
+jesus christ god heaven blessed faith hope peace happy smile sweet honey sugar
+magic dream star stars moon sun sky ocean river mountain forest fire water
+earth storm rain snow ice money cash rich gold diamond king queen prince
+princesa boss legend ninja pirate zombie monster devil demon ghost hunter1
+music guitar piano rock metal jazz dance party fun cool awesome super power
+player gamer game games soccer1 rugby cricket tennis golf boxing racing
+chicken pizza burger pasta cherry lemon mango peach strawberry
+college school student teacher doctor nurse office company business work
+home house garden city country world england1 scotland wales ireland
+britain america canada australia france germany spain italy india china japan
+spurs everton leeds celtic rangers chelsea1 barcelona madrid juventus
+batman1 spiderman ironman wonder marvel hulk thor loki yoda jedi sith vader
+secret123 mypassword yourpassword nopassword letme letmein123 iloveu
+sexy hottie babe darling sweetheart kiss hugs cuddles
+`;
+export const COMMON_WORDS = [...new Set(WORDS.trim().split(/\s+/))];
+//# sourceMappingURL=common.js.map

package/dist/password/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../src/password/common.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCb,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAsB,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC"}

package/dist/password/estimate-index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * `@connextar/house/password/estimate` — the strength estimator alone, for the
+ * server.
+ *
+ * It imports nothing at all, so a route handler that refuses the weakest
+ * passwords with the same judgement the meter showed pulls in neither React nor
+ * an icon set. `src/password/entry-points.test.ts` holds it to that.
+ */
+export { estimatePasswordStrength, MAX_ANALYSED_LENGTH, PASSWORD_STRENGTH_MESSAGES, type EstimatePasswordStrengthOptions, type PasswordScore, type PasswordStrengthEstimate, type PasswordStrengthMessages, type PasswordWeakness, } from "./estimate.js";
+//# sourceMappingURL=estimate-index.d.ts.map

package/dist/password/estimate-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"estimate-index.d.ts","sourceRoot":"","sources":["../../src/password/estimate-index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,KAAK,+BAA+B,EACpC,KAAK,aAAa,EAClB,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC"}

package/dist/password/estimate-index.js

@@ -0,0 +1,10 @@
+/**
+ * `@connextar/house/password/estimate` — the strength estimator alone, for the
+ * server.
+ *
+ * It imports nothing at all, so a route handler that refuses the weakest
+ * passwords with the same judgement the meter showed pulls in neither React nor
+ * an icon set. `src/password/entry-points.test.ts` holds it to that.
+ */
+export { estimatePasswordStrength, MAX_ANALYSED_LENGTH, PASSWORD_STRENGTH_MESSAGES, } from "./estimate.js";
+//# sourceMappingURL=estimate-index.js.map

package/dist/password/estimate-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"estimate-index.js","sourceRoot":"","sources":["../../src/password/estimate-index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,GAM3B,MAAM,eAAe,CAAC"}

package/dist/password/estimate.d.ts

@@ -0,0 +1,65 @@
+export type PasswordScore = 0 | 1 | 2 | 3 | 4;
+/** The main reason a password scored low, when there is one worth naming. */
+export type PasswordWeakness = "user-input" | "common" | "common-decorated" | "keyboard" | "repeat" | "sequence" | "date" | "short";
+export interface PasswordStrengthMessages {
+    /** What each score is called, from 0 to 4. */
+    labels: readonly [string, string, string, string, string];
+    /** The sentence for a low score (0–2) with a reason that can be named. */
+    weakness: Record<PasswordWeakness, string>;
+    /** Score 0–1 with no single reason. */
+    weak: string;
+    /** Score 2 with no single reason. */
+    fair: string;
+    strong: string;
+    veryStrong: string;
+    /** Shown instead of the score's sentence while the password is shorter than the app's `minLength`. */
+    tooShort: (minLength: number) => string;
+}
+export declare const PASSWORD_STRENGTH_MESSAGES: PasswordStrengthMessages;
+export interface EstimatePasswordStrengthOptions {
+    /**
+     * Things this person's password should not be built from: their email, name,
+     * username, organisation, the app's name. Matched in pieces, so
+     * "amir@connextar.com" also penalises "amir" and "connextar".
+     */
+    userInputs?: ReadonlyArray<string | null | undefined>;
+    /**
+     * The app's own minimum length. While the password is shorter, the sentence
+     * says so instead of describing the score — the score itself is unchanged.
+     */
+    minLength?: number;
+    messages?: Partial<PasswordStrengthMessages>;
+}
+export interface PasswordStrengthEstimate {
+    score: PasswordScore;
+    /** `labels[score]`, or "" for an empty password. */
+    label: string;
+    /** One plain sentence, or "" for an empty password. */
+    sentence: string;
+    /** Why it scored low, when the score is 2 or less and one reason stands out. */
+    weakness: PasswordWeakness | null;
+    /** Shorter than `minLength`, when one was given. */
+    belowMinLength: boolean;
+    /** log10 of the estimated number of guesses. */
+    guessesLog10: number;
+}
+/**
+ * Only the first 100 characters are analysed. Past that the estimate is already
+ * as high as it goes for anything but a repeat, and the search is cubic in
+ * length, so a pasted essay must not stall a keystroke.
+ */
+export declare const MAX_ANALYSED_LENGTH = 100;
+/**
+ * Estimate how guessable `password` is.
+ *
+ * ```ts
+ * estimatePasswordStrength("Password1!").score; // 1 — "A common word with capitals, numbers or symbols added…"
+ * estimatePasswordStrength("amir-connextar-2026", { userInputs: ["amir@connextar.com"] }).weakness; // "user-input"
+ * ```
+ *
+ * On the server, the same call lets an app refuse what the meter calls very weak
+ * — `if (estimate.score < 2) …` — with the sentence as the error message. Whether
+ * to do that is the app's decision; nothing here refuses anything.
+ */
+export declare function estimatePasswordStrength(password: string, options?: EstimatePasswordStrengthOptions): PasswordStrengthEstimate;
+//# sourceMappingURL=estimate.d.ts.map

package/dist/password/estimate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"estimate.d.ts","sourceRoot":"","sources":["../../src/password/estimate.ts"],"names":[],"mappings":"AAyBA,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAE9C,6EAA6E;AAC7E,MAAM,MAAM,gBAAgB,GAC1B,YAAY,GAAG,QAAQ,GAAG,kBAAkB,GAAG,UAAU,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;AAEvG,MAAM,WAAW,wBAAwB;IACvC,8CAA8C;IAC9C,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1D,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAC3C,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,sGAAsG;IACtG,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;CACzC;AAED,eAAO,MAAM,0BAA0B,EAAE,wBAkBxC,CAAC;AAEF,MAAM,WAAW,+BAA+B;IAC9C;;;;OAIG;IACH,UAAU,CAAC,EAAE,aAAa,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACtD;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,aAAa,CAAC;IACrB,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAClC,oDAAoD;IACpD,cAAc,EAAE,OAAO,CAAC;IACxB,gDAAgD;IAChD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAwjBvC;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,+BAAoC,GAC5C,wBAAwB,CA+B1B"}