@tula-tech/contract 0.0.0-stage → 0.1.1

package/dist/shared/chunk-r202nxfw.js

@@ -0,0 +1,438 @@
+// src/email-template.ts
+var EMAIL_TEMPLATE_KINDS2 = [
+  "email_verification",
+  "password_reset",
+  "sign_in",
+  "step_up",
+  "account_exists",
+  "no_account",
+  "no_account_sign_in",
+  "password_changed",
+  "password_added",
+  "password_reset_completed",
+  "password_added_by_reset",
+  "password_set_by_admin",
+  "password_added_by_admin",
+  "password_removed",
+  "new_sign_in",
+  "mfa_enabled",
+  "mfa_disabled",
+  "mfa_reset_by_admin",
+  "backup_codes_regenerated",
+  "backup_code_used",
+  "sms_factor_enabled",
+  "sms_factor_removed",
+  "passkey_added",
+  "passkey_removed",
+  "identity_linked",
+  "identity_unlinked",
+  "email_in_use",
+  "email_added"
+];
+var EMAIL_TEMPLATE_PLACEHOLDERS2 = [
+  "appName",
+  "code",
+  "link",
+  "expiresInMinutes",
+  "device",
+  "time",
+  "provider",
+  "backupCodesLeft"
+];
+var EMAIL_TEMPLATE_DIGIT_PLACEHOLDERS2 = [
+  "code",
+  "expiresInMinutes",
+  "time",
+  "backupCodesLeft"
+];
+var CODE = {
+  category: "code",
+  required: ["code"],
+  optional: ["appName", "expiresInMinutes"]
+};
+var DECOY = { category: "notice", required: [], optional: ["appName"] };
+var NOTICE = {
+  category: "notice",
+  required: [],
+  optional: ["appName", "time"]
+};
+var EMAIL_TEMPLATE_RULES2 = {
+  email_verification: CODE,
+  password_reset: CODE,
+  sign_in: { ...CODE, required: ["code", "link"] },
+  step_up: CODE,
+  account_exists: DECOY,
+  no_account: DECOY,
+  no_account_sign_in: DECOY,
+  password_changed: NOTICE,
+  password_added: NOTICE,
+  password_reset_completed: NOTICE,
+  password_added_by_reset: NOTICE,
+  password_set_by_admin: NOTICE,
+  password_added_by_admin: NOTICE,
+  password_removed: NOTICE,
+  new_sign_in: { ...NOTICE, optional: ["appName", "time", "device"] },
+  mfa_enabled: NOTICE,
+  mfa_disabled: NOTICE,
+  mfa_reset_by_admin: NOTICE,
+  backup_codes_regenerated: NOTICE,
+  backup_code_used: { ...NOTICE, optional: ["appName", "time", "backupCodesLeft"] },
+  sms_factor_enabled: NOTICE,
+  sms_factor_removed: NOTICE,
+  passkey_added: NOTICE,
+  passkey_removed: NOTICE,
+  identity_linked: { ...NOTICE, optional: ["appName", "time", "provider"] },
+  identity_unlinked: { ...NOTICE, optional: ["appName", "time", "provider"] },
+  email_in_use: DECOY,
+  email_added: NOTICE
+};
+var MAX_EMAIL_SUBJECT_LENGTH2 = 200;
+var MAX_EMAIL_BODY_LENGTH2 = 2000;
+var MAX_EMAIL_TEMPLATES_BYTES2 = 40 * 1024;
+var PLACEHOLDER = /\{\{([A-Za-z][A-Za-z0-9]*)\}\}/g;
+function parseEmailTemplate2(text) {
+  const tokens = [];
+  let from = 0;
+  for (const match of text.matchAll(PLACEHOLDER)) {
+    if (match.index > from) {
+      tokens.push({ text: text.slice(from, match.index) });
+    }
+    tokens.push({ placeholder: match[1] });
+    from = match.index + match[0].length;
+  }
+  if (from < text.length) {
+    tokens.push({ text: text.slice(from) });
+  }
+  const stray = tokens.some((token) => ("text" in token) && /[{}]/.test(token.text));
+  return stray ? null : tokens;
+}
+function emailTemplateParagraphs2(body) {
+  return body.split(/\n[^\S\n]*\n/).map((paragraph) => paragraph.trim()).filter((paragraph) => paragraph !== "");
+}
+var SUBJECT_UNPRINTABLE = /[\p{Cc}\p{Zl}\p{Zp}]/u;
+var BODY_UNPRINTABLE = /[^\P{Cc}\n]|[\p{Zl}\p{Zp}]/u;
+var HIDDEN = /[\u{202A}-\u{202E}\u{2066}-\u{2069}\u{200E}\u{200F}\u{061C}\p{Co}\p{Cn}\p{Cs}]/u;
+function hasHiddenCharacter2(text) {
+  return HIDDEN.test(text);
+}
+function withoutHiddenCharacters2(text) {
+  return text.replace(new RegExp(HIDDEN.source, "gu"), "");
+}
+var INVISIBLE = /[\p{Cf}\p{Variation_Selector}\p{Default_Ignorable_Code_Point}]/gu;
+function visibleEmailText2(text) {
+  return withoutInvisibleCharacters2(text).trim();
+}
+function withoutInvisibleCharacters2(text) {
+  return text.replace(INVISIBLE, "");
+}
+var ANY_INVISIBLE = new RegExp(INVISIBLE.source, "u");
+function hasInvisibleCharacter2(text) {
+  return ANY_INVISIBLE.test(text);
+}
+var EMAIL_LINK_SCHEMES2 = [
+  "mailto",
+  "tel",
+  "sms",
+  "smsto",
+  "mms",
+  "xmpp",
+  "sip",
+  "sips",
+  "facetime",
+  "facetime-audio",
+  "skype",
+  "callto",
+  "whatsapp",
+  "tg",
+  "viber",
+  "signal",
+  "msteams",
+  "geo",
+  "maps",
+  "data",
+  "javascript",
+  "vbscript",
+  "file",
+  "blob",
+  "intent"
+];
+var SCHEME = new RegExp(`://|(?<![\\p{L}\\p{N}_-])(?:${EMAIL_LINK_SCHEMES2.join("|")}):(?=\\S)`, "iu");
+var WWW = /(?:^|[^\p{L}\p{N}\p{M}])w\p{M}*w\p{M}*w\p{M}*[.。]/iu;
+var DOMAIN = /[\p{L}\p{N}]\p{M}*[.。]\p{L}[\p{L}\p{M}]+/u;
+var IPV4 = /\p{Nd}{1,3}(?:[.。]\p{Nd}{1,3}){3}/u;
+function readsAsLink2(text) {
+  const seen = text.normalize("NFKC").replace(INVISIBLE, "");
+  return SCHEME.test(seen) || WWW.test(seen) || DOMAIN.test(seen) || IPV4.test(seen);
+}
+var MAX_REPORTED_NAME_LENGTH = 40;
+function placeholdersOf(tokens) {
+  return tokens.flatMap((token) => ("placeholder" in token) ? [token.placeholder] : []);
+}
+function withStandIns(tokens) {
+  return tokens.map((token) => ("text" in token) ? token.text : "x").join("");
+}
+function withLeadingStandIns(tokens) {
+  const digits = EMAIL_TEMPLATE_DIGIT_PLACEHOLDERS2;
+  return tokens.map((token) => ("text" in token) ? token.text : digits.includes(token.placeholder) ? "1" : "x").join("");
+}
+function fieldProblems(kind, field, text) {
+  const rules = EMAIL_TEMPLATE_RULES2[kind];
+  const problem = (code, message, placeholder) => ({
+    field,
+    code,
+    message,
+    ...placeholder !== undefined && { placeholder }
+  });
+  const max = field === "subject" ? MAX_EMAIL_SUBJECT_LENGTH2 : MAX_EMAIL_BODY_LENGTH2;
+  if (text.length > max) {
+    return [problem("too_long", `must be at most ${max} characters`)];
+  }
+  if (visibleEmailText2(text) === "") {
+    return [problem("empty", "must not be empty")];
+  }
+  if ((field === "subject" ? SUBJECT_UNPRINTABLE : BODY_UNPRINTABLE).test(text)) {
+    return [
+      problem("control_character", field === "subject" ? "must not contain control characters or line breaks" : "must not contain control characters (lines end in \\n)")
+    ];
+  }
+  if (hasHiddenCharacter2(text)) {
+    return [
+      problem("hidden_character", "must not contain text-direction controls, private-use or unassigned characters, or half a surrogate pair")
+    ];
+  }
+  const tokens = parseEmailTemplate2(text);
+  if (tokens === null) {
+    return [
+      problem("malformed_braces", "a brace must be part of a placeholder written as {{name}}, with no space inside")
+    ];
+  }
+  const problems = [];
+  const allowed = new Set([...rules.required, ...rules.optional]);
+  if (field === "subject") {
+    allowed.delete("link");
+  }
+  const named = new Set(placeholdersOf(tokens));
+  for (const written of named) {
+    if (!allowed.has(written)) {
+      const name = written.length > MAX_REPORTED_NAME_LENGTH ? `${written.slice(0, MAX_REPORTED_NAME_LENGTH)}…` : written;
+      problems.push(problem("unknown_placeholder", `{{${name}}} is not a placeholder of this ${field === "subject" ? "subject" : "message"}`, name));
+    }
+  }
+  if (field === "body") {
+    for (const name of rules.required) {
+      if (!named.has(name)) {
+        problems.push(problem("missing_placeholder", `the body must contain {{${name}}}`, name));
+      }
+    }
+    const together = emailTemplateParagraphs2(text).some((paragraph) => {
+      const inside = new Set(placeholdersOf(parseEmailTemplate2(paragraph) ?? []));
+      return inside.has("link") && inside.has("code");
+    });
+    if (together) {
+      problems.push(problem("link_beside_code", "{{link}} and {{code}} must be in different paragraphs: the paragraph of a link is left out of a message that has none"));
+    }
+  }
+  if (readsAsLink2(withStandIns(tokens))) {
+    problems.push(problem("reads_as_link", "must not contain a link, an address or a domain name (put a space after a full stop)"));
+  }
+  if (rules.category === "notice" && field === "subject" && /^\p{Nd}/u.test(visibleEmailText2(withLeadingStandIns(tokens)))) {
+    problems.push(problem("leading_digit", "the subject of a notice must not start with a digit, or with a placeholder that is always a number or a time"));
+  }
+  return problems;
+}
+function emailTemplateProblems2(kind, template) {
+  return [
+    ...template.subject === undefined ? [] : fieldProblems(kind, "subject", template.subject),
+    ...template.body === undefined ? [] : fieldProblems(kind, "body", template.body)
+  ];
+}
+function isEmailTemplateKind2(value) {
+  return EMAIL_TEMPLATE_KINDS2.includes(value);
+}
+function emailTemplatesBytes2(templates) {
+  return new TextEncoder().encode(JSON.stringify(templates)).length;
+}
+function storedTemplate(kind, stored) {
+  if (typeof stored !== "object" || stored === null || Array.isArray(stored)) {
+    return { template: null, whole: false };
+  }
+  const written = stored;
+  const template = {};
+  let whole = written.subject !== undefined || written.body !== undefined;
+  for (const field of ["subject", "body"]) {
+    const value = written[field];
+    if (value === undefined) {
+      continue;
+    }
+    if (typeof value === "string" && emailTemplateProblems2(kind, { [field]: value }).length === 0) {
+      template[field] = value;
+    } else {
+      whole = false;
+    }
+  }
+  const kept = template.subject !== undefined || template.body !== undefined;
+  return { template: kept ? template : null, whole };
+}
+function readStoredEmailTemplates2(stored) {
+  const templates = {};
+  const dropped = [];
+  if (typeof stored !== "object" || stored === null || Array.isArray(stored)) {
+    return { templates, dropped, unknown: stored === undefined || stored === null ? 0 : 1 };
+  }
+  const unknown = Object.keys(stored).filter((key) => !isEmailTemplateKind2(key)).length;
+  for (const key of EMAIL_TEMPLATE_KINDS2) {
+    if (!Object.hasOwn(stored, key)) {
+      continue;
+    }
+    const { template, whole } = storedTemplate(key, stored[key]);
+    if (!whole) {
+      dropped.push(key);
+    }
+    if (template !== null) {
+      templates[key] = template;
+    }
+  }
+  if (emailTemplatesBytes2(templates) > MAX_EMAIL_TEMPLATES_BYTES2) {
+    const lost = new Set([...dropped, ...kindsOf(templates)]);
+    return {
+      templates: {},
+      dropped: EMAIL_TEMPLATE_KINDS2.filter((kind) => lost.has(kind)),
+      unknown
+    };
+  }
+  return { templates, dropped, unknown };
+}
+function kindsOf(templates) {
+  return EMAIL_TEMPLATE_KINDS2.filter((kind) => Object.hasOwn(templates, kind));
+}
+
+// src/redirect-url.ts
+var REDIRECT_SCHEMES_NEVER_CUSTOM2 = [
+  "http",
+  "https",
+  "javascript",
+  "vbscript",
+  "data",
+  "file",
+  "filesystem",
+  "blob",
+  "about",
+  "mailto",
+  "tel",
+  "sms",
+  "facetime",
+  "geo",
+  "maps",
+  "intent",
+  "content",
+  "android-app",
+  "market",
+  "itms",
+  "itms-apps",
+  "itms-services",
+  "app-settings",
+  "ms-settings",
+  "x-apple.systempreferences",
+  "ftp",
+  "ws",
+  "wss",
+  "chrome",
+  "chrome-extension",
+  "moz-extension",
+  "resource",
+  "jar",
+  "cid",
+  "mid",
+  "view-source"
+];
+var REDIRECT_SCHEME_FAMILIES_NEVER_CUSTOM2 = [
+  "microsoft.windows.",
+  "x-apple.",
+  "com.apple."
+];
+var LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+var CUSTOM_SCHEME = /^[a-z][a-z0-9-]*(?:\.[a-z0-9-]+)+$/;
+var CUSTOM_REST = /^(?:\/[A-Za-z0-9._~-]*)+$/;
+function customSchemeOf(value) {
+  const colon = value.indexOf(":");
+  if (colon <= 0) {
+    return null;
+  }
+  const scheme = value.slice(0, colon);
+  const rest = value.slice(colon + 1);
+  if (!CUSTOM_SCHEME.test(scheme) || REDIRECT_SCHEMES_NEVER_CUSTOM2.includes(scheme) || REDIRECT_SCHEME_FAMILIES_NEVER_CUSTOM2.some((family) => scheme.startsWith(family)) || !CUSTOM_REST.test(rest) || rest.split("/").some((segment) => segment === "." || segment === "..")) {
+    return null;
+  }
+  return scheme;
+}
+var WEB_NEVER = /[\u{0}-\u{1f}\u{7f}-\u{9f}\\]/u;
+function hasForbiddenRedirectCharacter2(value) {
+  return value.includes("*") || /\s/.test(value) || WEB_NEVER.test(value) || hasInvisibleCharacter2(value) || hasHiddenCharacter2(value);
+}
+function webKindOf(value) {
+  if (!(value.startsWith("https://") || value.startsWith("http://"))) {
+    return null;
+  }
+  if (hasForbiddenRedirectCharacter2(value)) {
+    return null;
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return null;
+  }
+  if (url.username !== "" || url.password !== "" || url.hash !== "") {
+    return null;
+  }
+  if (url.protocol === "https:") {
+    return "https";
+  }
+  return url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname) ? "loopback" : null;
+}
+function redirectUrlKind2(value) {
+  if (/^https?:/i.test(value)) {
+    return webKindOf(value);
+  }
+  return customSchemeOf(value) === null ? null : "custom_scheme";
+}
+function isRedirectUrl2(value) {
+  return redirectUrlKind2(value) !== null;
+}
+function isCustomSchemeRedirectUrl2(value) {
+  return redirectUrlKind2(value) === "custom_scheme";
+}
+var OAUTH_PROVIDERS_WITH_PKCE2 = [
+  "google",
+  "github",
+  "microsoft",
+  "discord",
+  "x"
+];
+var OAUTH_PROVIDERS_WITHOUT_PKCE2 = [
+  "apple",
+  "linkedin",
+  "facebook"
+];
+function bindsCodeWithPkce2(provider) {
+  return OAUTH_PROVIDERS_WITH_PKCE2.includes(provider);
+}
+var CUSTOM_SCHEME_REDIRECT_REFUSALS2 = [
+  "provider_without_pkce",
+  "client_not_native",
+  "not_a_provider_sign_in"
+];
+function customSchemeRedirectRefusal2(url, use) {
+  if (!isCustomSchemeRedirectUrl2(url)) {
+    return null;
+  }
+  if (use.provider === undefined) {
+    return "not_a_provider_sign_in";
+  }
+  if (!bindsCodeWithPkce2(use.provider)) {
+    return "provider_without_pkce";
+  }
+  return use.client === "ios" || use.client === "android" ? null : "client_not_native";
+}
+
+export { EMAIL_TEMPLATE_KINDS2, EMAIL_TEMPLATE_PLACEHOLDERS2, EMAIL_TEMPLATE_DIGIT_PLACEHOLDERS2, EMAIL_TEMPLATE_RULES2, MAX_EMAIL_SUBJECT_LENGTH2, MAX_EMAIL_BODY_LENGTH2, MAX_EMAIL_TEMPLATES_BYTES2, parseEmailTemplate2, emailTemplateParagraphs2, hasHiddenCharacter2, withoutHiddenCharacters2, visibleEmailText2, withoutInvisibleCharacters2, hasInvisibleCharacter2, EMAIL_LINK_SCHEMES2, readsAsLink2, emailTemplateProblems2, isEmailTemplateKind2, emailTemplatesBytes2, readStoredEmailTemplates2, REDIRECT_SCHEMES_NEVER_CUSTOM2, REDIRECT_SCHEME_FAMILIES_NEVER_CUSTOM2, hasForbiddenRedirectCharacter2, redirectUrlKind2, isRedirectUrl2, isCustomSchemeRedirectUrl2, OAUTH_PROVIDERS_WITH_PKCE2, OAUTH_PROVIDERS_WITHOUT_PKCE2, bindsCodeWithPkce2, CUSTOM_SCHEME_REDIRECT_REFUSALS2, customSchemeRedirectRefusal2 };

package/dist/shared/chunk-sc6qg3d2.js

@@ -0,0 +1,219 @@
+// src/common-passwords.ts
+var COMMON_PASSWORDS2 = new Set([
+  "123456",
+  "123456789",
+  "12345678",
+  "password",
+  "qwerty123",
+  "qwerty1",
+  "111111",
+  "12345",
+  "secret",
+  "123123",
+  "1234567890",
+  "1234567",
+  "000000",
+  "qwerty",
+  "abc123",
+  "password1",
+  "iloveyou",
+  "11111111",
+  "dragon",
+  "monkey",
+  "123321",
+  "qwertyuiop",
+  "654321",
+  "666666",
+  "987654321",
+  "superman",
+  "1q2w3e4r",
+  "1q2w3e4r5t",
+  "qwe123",
+  "asdfghjkl",
+  "football",
+  "baseball",
+  "welcome",
+  "welcome1",
+  "letmein",
+  "princess",
+  "sunshine",
+  "master",
+  "shadow",
+  "ashley",
+  "michael",
+  "jennifer",
+  "trustno1",
+  "passw0rd",
+  "password123",
+  "password1234",
+  "admin",
+  "admin123",
+  "administrator",
+  "login",
+  "starwars",
+  "whatever",
+  "freedom",
+  "hello123",
+  "charlie",
+  "donald",
+  "batman",
+  "zaq12wsx",
+  "qazwsx",
+  "1qaz2wsx",
+  "solo",
+  "loveme",
+  "mustang",
+  "access",
+  "flower",
+  "hottie",
+  "ninja",
+  "azerty",
+  "password!",
+  "p@ssw0rd",
+  "p@ssword",
+  "changeme",
+  "default",
+  "test1234",
+  "testtest",
+  "computer",
+  "internet",
+  "samsung",
+  "google",
+  "liverpool",
+  "chelsea",
+  "arsenal",
+  "pokemon",
+  "minecraft",
+  "summer2024",
+  "winter2024",
+  "spring2025",
+  "summer2025",
+  "autumn2025",
+  "winter2025",
+  "summer2026",
+  "qwerty12345",
+  "iloveyou1",
+  "aa123456",
+  "abcd1234",
+  "a1b2c3d4",
+  "zxcvbnm",
+  "asdfasdf",
+  "fuckyou",
+  "killer",
+  "jordan23",
+  "michelle",
+  "daniel",
+  "thomas",
+  "hunter2",
+  "letmein123",
+  "welcome123"
+]);
+
+// src/password-rules.ts
+var DEFAULT_SPECIAL_CHARS2 = "!@#$%^&*()-_=+[]{};:,.?/\\|'\"`~<>";
+function normalizePassword2(password) {
+  return password.normalize("NFC");
+}
+var LOWER = /\p{Ll}/u;
+var UPPER = /\p{Lu}/u;
+var NUMBER = /\p{Nd}/u;
+var SEQUENCE_LENGTH = 4;
+var MIN_USER_INFO_LENGTH = 3;
+function longestRun(chars) {
+  let longest = 0;
+  let current = 0;
+  for (let i = 0;i < chars.length; i++) {
+    current = i > 0 && chars[i] === chars[i - 1] ? current + 1 : 1;
+    longest = Math.max(longest, current);
+  }
+  return longest;
+}
+function hasSequence(chars) {
+  const codes = chars.map((c) => c.toLowerCase().codePointAt(0) ?? 0);
+  let ascending = 1;
+  let descending = 1;
+  for (let i = 1;i < codes.length; i++) {
+    const step = (codes[i] ?? 0) - (codes[i - 1] ?? 0);
+    ascending = step === 1 ? ascending + 1 : 1;
+    descending = step === -1 ? descending + 1 : 1;
+    if (ascending >= SEQUENCE_LENGTH || descending >= SEQUENCE_LENGTH) {
+      return true;
+    }
+  }
+  return false;
+}
+function userInfoTokens(info) {
+  const localPart = info.email?.split("@")[0];
+  return [localPart, info.firstName, info.lastName, info.username].map((value) => value ? normalizePassword2(value).trim().toLowerCase() : undefined).filter((value) => !!value && value.length >= MIN_USER_INFO_LENGTH);
+}
+function evaluatePassword2(policy, password, userInfo = {}) {
+  const chars = [...normalizePassword2(password)];
+  const special = new Set([...policy.specialChars]);
+  const hasLower = chars.some((c) => LOWER.test(c));
+  const hasUpper = chars.some((c) => UPPER.test(c));
+  const hasNumber = chars.some((c) => NUMBER.test(c));
+  const hasSpecial = chars.some((c) => special.has(c));
+  const checks = [];
+  checks.push({
+    rule: "min_length",
+    code: "password.too_short",
+    passed: chars.length >= policy.minLength,
+    params: { min: policy.minLength }
+  });
+  checks.push({
+    rule: "max_length",
+    code: "password.too_long",
+    passed: chars.length <= policy.maxLength,
+    params: { max: policy.maxLength }
+  });
+  if (policy.requireLowercase) {
+    checks.push({ rule: "lowercase", code: "password.missing_lowercase", passed: hasLower });
+  }
+  if (policy.requireUppercase) {
+    checks.push({ rule: "uppercase", code: "password.missing_uppercase", passed: hasUpper });
+  }
+  if (policy.requireNumber) {
+    checks.push({ rule: "number", code: "password.missing_number", passed: hasNumber });
+  }
+  if (policy.requireSpecial) {
+    checks.push({ rule: "special", code: "password.missing_special", passed: hasSpecial });
+  }
+  if (policy.minCharacterClasses > 0) {
+    const classes = [hasLower, hasUpper, hasNumber, hasSpecial].filter(Boolean).length;
+    checks.push({
+      rule: "character_classes",
+      code: "password.too_few_character_classes",
+      passed: classes >= policy.minCharacterClasses,
+      params: { min: policy.minCharacterClasses }
+    });
+  }
+  if (policy.disallowUserInfo) {
+    const lower = chars.join("").toLowerCase();
+    checks.push({
+      rule: "user_info",
+      code: "password.contains_user_info",
+      passed: !userInfoTokens(userInfo).some((token) => lower.includes(token))
+    });
+  }
+  if (policy.disallowCommon) {
+    checks.push({
+      rule: "common",
+      code: "password.common",
+      passed: !COMMON_PASSWORDS2.has(chars.join("").toLowerCase())
+    });
+  }
+  if (policy.maxRepeatedChars !== null) {
+    checks.push({
+      rule: "repeated_characters",
+      code: "password.repeated_characters",
+      passed: longestRun(chars) <= policy.maxRepeatedChars,
+      params: { max: policy.maxRepeatedChars }
+    });
+  }
+  if (policy.blockSequences) {
+    checks.push({ rule: "sequence", code: "password.sequence", passed: !hasSequence(chars) });
+  }
+  return { ok: checks.every((check) => check.passed), checks };
+}
+
+export { COMMON_PASSWORDS2, DEFAULT_SPECIAL_CHARS2, normalizePassword2, evaluatePassword2 };