@virastack/password 1.0.2 → 1.1.0

package/dist/strength.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/strength/index.ts","../src/strength/common.ts","../src/strength/core.ts"],"sourcesContent":["export { definePolicy, evaluate, normalizePassword } from \"./core\";\nexport type * from \"./types\";\n","// Cores of common passwords: lowercase letters only, as `commonCore()` reduces them\n// (\"P@ssw0rd123!\" → \"password\"). Includes Turkish favourites. Digits-only and keyboard runs\n// are caught by the repetition and sequence checks instead.\nexport const COMMON =\n  \"password passwort parola sifre sifrem sifreniz parolam qwerty qwertz azerty qwertyuiop asdfgh asdfghjkl \" +\n  \"zxcvbn zxcvbnm qazwsx qwaszx wsxedc abc abcdef letmein welcome welcom admin administrator root user guest \" +\n  \"login test tester demo default changeme secret private iloveyou loveyou lovely love monkey dragon master \" +\n  \"shadow sunshine princess football baseball soccer basketball hockey superman batman spiderman starwars \" +\n  \"pokemon minecraft trustno whatever freedom flower hello hellothere cookie cheese chocolate summer winter \" +\n  \"autumn spring michael jessica jennifer charlie thomas jordan hunter ranger buster tigger ginger pepper \" +\n  \"matrix computer internet google facebook instagram twitter yahoo hotmail gmail apple samsung iphone \" +\n  \"android microsoft windows linux ubuntu killer access mustang harley ferrari porsche mercedes yankees \" +\n  \"liverpool chelsea arsenal barcelona realmadrid juventus galatasaray fenerbahce besiktas trabzonspor \" +\n  \"bursaspor cimbom istanbul ankara izmir antalya bursa turkiye turkey ataturk allah bismillah askim \" +\n  \"sevgilim bitanem canim hayatim prenses kelebek melek gunes yildiz deniz mehmet ahmet mustafa ali \" +\n  \"ayse fatma emine hatice zeynep elif omer murat emre burak huseyin hasan ibrahim yusuf merhaba \" +\n  \"selam kardesim annem babam qwertyasdfgh correcthorsebatterystaple passphrase mypassword newpassword \" +\n  \"temppassword passwordpassword nopassword sifreyok\";\n","import { COMMON } from \"./common\";\nimport type {\n  EvaluateOptions,\n  PasswordChecks,\n  PasswordIssue,\n  Policy,\n  PolicyOptions,\n  StrengthLevel,\n  StrengthResult,\n  StrengthScore,\n} from \"./types\";\n\nconst ZERO_WIDTH = /[\\u200B-\\u200D\\u2060\\uFEFF]/g;\nconst LEET: Record<string, string> = { \"0\": \"o\", \"1\": \"i\", \"3\": \"e\", \"4\": \"a\", \"5\": \"s\", \"7\": \"t\", \"8\": \"b\", \"@\": \"a\", \"$\": \"s\", \"!\": \"i\", \"+\": \"t\" };\n// Rows and runs that read as a sequence when typed, forwards or backwards.\nconst SEQUENCES = [\n  \"abcdefghijklmnopqrstuvwxyz\",\n  \"0123456789\",\n  \"qwertyuiopasdfghjklzxcvbnm\",\n  \"qwertzuiopasdfghjklyxcvbnm\",\n  \"azertyuiopqsdfghjklmwxcvbn\",\n  // Turkish Q layout, folded: ı→i, ğ→g, ü→u, ş→s, ö→o, ç→c\n  \"qwertyuiopguasdfghjklsizxcvbnmoc\",\n  \"1qaz2wsx3edc4rfv5tgb6yhn7ujm8ik9ol0p\",\n];\nconst LEVELS: readonly StrengthLevel[] = [\"weak\", \"weak\", \"fair\", \"good\", \"strong\"];\n\nlet common: Set<string> | undefined;\n\n/** NFKC, so visually identical input from different keyboards compares and hashes the same. */\nexport const normalizePassword = (password: string): string => password.normalize(\"NFKC\");\n\nconst codePoints = (value: string): string[] => Array.from(value.replace(ZERO_WIDTH, \"\"));\n\n/** Lowercase without accents, for comparisons only: \"Şifre\" and \"sifre\" match, so do \"İ\" and \"i\". */\nconst fold = (value: string): string =>\n  value.normalize(\"NFKD\").replace(/\\p{M}/gu, \"\").toLowerCase().replace(/\\u0131/g, \"i\").replace(ZERO_WIDTH, \"\");\n\nconst deLeet = (value: string): string => value.replace(/[0-9@$!+]/g, (c) => LEET[c] ?? c);\n\n/** Length of the shortest unit the string repeats, e.g. 3 for \"abcabcab\" (the last copy may be cut short). */\nconst period = (value: string[]): number => {\n  const n = value.length;\n  const lps = new Array<number>(n).fill(0);\n  for (let i = 1, k = 0; i < n; i++) {\n    while (k > 0 && value[i] !== value[k]) k = lps[k - 1];\n    if (value[i] === value[k]) k++;\n    lps[i] = k;\n  }\n  return n - (lps[n - 1] ?? 0);\n};\n\nconst unit = (value: string): string => {\n  const chars = Array.from(value);\n  return chars.slice(0, period(chars)).join(\"\");\n};\n\n/** \"P@ssw0rd2024!\" → \"password\"; \"summer2024summer\" → \"summer\". Digits inside are leetspeak or separators. */\nconst commonCores = (folded: string): string[] => {\n  const trimmed = folded.replace(/^[^\\p{L}]+|[^\\p{L}]+$/gu, \"\");\n  return [deLeet(trimmed), trimmed].map((core) => unit(core.replace(/[^\\p{L}]/gu, \"\")));\n};\n\nconst isSequence = (folded: string): boolean => {\n  if (folded.length < 3) return false;\n  return SEQUENCES.some((sequence) => {\n    const forward = sequence.repeat(Math.ceil(folded.length / sequence.length) + 1);\n    const backward = Array.from(forward).reverse().join(\"\");\n    return forward.includes(folded) || backward.includes(folded);\n  });\n};\n\nconst isRepetitive = (chars: string[], folded: string): boolean => {\n  // Fewer than 4 distinct characters; short inputs need half of theirs.\n  if (new Set(chars).size < Math.min(4, Math.ceil(chars.length / 2))) return true;\n  if (period(chars) <= chars.length / 3) return true;\n  return isSequence(folded);\n};\n\n/** Splits emails (local part only), names and usernames into lowercase parts. */\nexport const personalTokens = (forbidden: readonly unknown[], minTokenLength: number): string[] => {\n  const tokens = new Set<string>();\n  for (const value of forbidden) {\n    if (typeof value !== \"string\") continue;\n    const at = value.lastIndexOf(\"@\");\n    const source = fold(at > 0 ? value.slice(0, at) : value).trim();\n    const parts = [source, ...source.split(/[^\\p{L}\\p{N}]+|(?<=\\p{L})(?=\\p{N})|(?<=\\p{N})(?=\\p{L})/u)];\n    for (const part of parts) {\n      if (Array.from(part).length >= minTokenLength) tokens.add(part);\n    }\n  }\n  return [...tokens];\n};\n\nconst containsAny = (folded: string, words: readonly string[]): boolean => {\n  if (words.length === 0) return false;\n  const variants = [folded, deLeet(folded), folded.replace(/[^\\p{L}\\p{N}]/gu, \"\")];\n  return words.some((word) => variants.some((variant) => variant.includes(word)));\n};\n\nconst scoreFor = (chars: string[], issues: PasswordIssue[], minLength: number): StrengthScore => {\n  if (chars.length === 0) return 0;\n  if (issues.length > 0) {\n    const severe = issues.some((issue) =>\n      [\"password.common\", \"password.blocked\", \"password.repetitive\", \"password.containsPersonalInfo\"].includes(issue),\n    );\n    return severe || chars.length < minLength / 2 ? 0 : 1;\n  }\n  let pool = 0;\n  const text = chars.join(\"\");\n  if (/\\p{Ll}/u.test(text)) pool += 26;\n  if (/\\p{Lu}/u.test(text)) pool += 26;\n  if (/\\p{Nd}/u.test(text)) pool += 10;\n  if (/[\\p{P}\\p{S}\\p{Zs}]/u.test(text)) pool += 33;\n  if (/[^\\p{Ll}\\p{Lu}\\p{Nd}\\p{P}\\p{S}\\p{Zs}]/u.test(text)) pool += 100;\n  // Repeated characters add little; count each distinct one at most twice.\n  const effective = Math.min(chars.length, new Set(chars).size * 2);\n  const bits = effective * Math.log2(Math.max(pool, 2));\n  return bits >= 100 ? 4 : bits >= 80 ? 3 : 2;\n};\n\nconst evaluateWith = (policy: Policy, input: unknown, options: EvaluateOptions = {}): StrengthResult => {\n  const password = typeof input === \"string\" ? normalizePassword(input) : \"\";\n  const chars = codePoints(password);\n  const folded = fold(password);\n  const { require } = policy;\n  const issues: PasswordIssue[] = [];\n  const checks: PasswordChecks = {\n    minLength: chars.length >= policy.minLength,\n    maxLength: chars.length <= policy.maxLength,\n    notCommon: true,\n    notBlocked: true,\n    notRepetitive: true,\n    notPersonal: true,\n  };\n\n  if (!checks.minLength) issues.push(\"password.tooShort\");\n  if (!checks.maxLength) issues.push(\"password.tooLong\");\n\n  if (require.lowercase) checks.lowercase = /\\p{Ll}/u.test(password);\n  if (require.uppercase) checks.uppercase = /\\p{Lu}/u.test(password);\n  if (require.digit) checks.digit = /\\p{Nd}/u.test(password);\n  if (require.symbol) checks.symbol = /[^\\p{L}\\p{N}]/u.test(password);\n  if (checks.lowercase === false) issues.push(\"password.noLowercase\");\n  if (checks.uppercase === false) issues.push(\"password.noUppercase\");\n  if (checks.digit === false) issues.push(\"password.noDigit\");\n  if (checks.symbol === false) issues.push(\"password.noSymbol\");\n\n  // Far past the limit the answer is \"too long\" anyway; skip the pattern checks on huge input.\n  const huge = password.length > policy.maxLength * 4;\n  if (chars.length >= 4 && !huge) {\n    if (policy.blockCommon) {\n      const list = (common ??= new Set(COMMON.split(\" \")));\n      checks.notCommon = !commonCores(folded).some((core) => list.has(core));\n    }\n    checks.notBlocked = !containsAny(folded, policy.blocklist);\n    if (policy.blockRepetitive) checks.notRepetitive = !isRepetitive(Array.from(folded), folded);\n  }\n  if (chars.length > 0 && options.forbidden && !huge) {\n    checks.notPersonal = !containsAny(folded, personalTokens(options.forbidden, policy.minTokenLength));\n  }\n\n  if (!checks.notCommon) issues.push(\"password.common\");\n  if (!checks.notBlocked) issues.push(\"password.blocked\");\n  if (!checks.notRepetitive) issues.push(\"password.repetitive\");\n  if (!checks.notPersonal) issues.push(\"password.containsPersonalInfo\");\n\n  const score = scoreFor(chars, issues, policy.minLength);\n  return { score, level: LEVELS[score], length: chars.length, valid: issues.length === 0, checks, issues };\n};\n\nconst PRESETS = {\n  nist: { minLength: 15, maxLength: 64, require: {} },\n  legacy: { minLength: 8, maxLength: 64, require: { lowercase: true, uppercase: true, digit: true, symbol: true } },\n} as const;\n\nconst assertLength = (name: string, value: number) => {\n  if (!Number.isInteger(value) || value < 1) throw new RangeError(`definePolicy: ${name} must be a positive integer, got ${value}`);\n};\n\n/** A password policy. Define it once in a shared module and use it in the form and on the server. */\nexport const definePolicy = (options: PolicyOptions = {}): Policy => {\n  const preset = options.preset ?? \"nist\";\n  const base = PRESETS[preset];\n  if (!base) throw new RangeError(`definePolicy: unknown preset \"${String(preset)}\"`);\n  const minLength = options.minLength ?? base.minLength;\n  const maxLength = options.maxLength ?? base.maxLength;\n  const minTokenLength = options.minTokenLength ?? 3;\n  assertLength(\"minLength\", minLength);\n  assertLength(\"maxLength\", maxLength);\n  assertLength(\"minTokenLength\", minTokenLength);\n  if (minLength > maxLength) throw new RangeError(`definePolicy: minLength (${minLength}) is greater than maxLength (${maxLength})`);\n  const req = { ...base.require, ...options.require };\n  const require = {\n    lowercase: req.lowercase === true,\n    uppercase: req.uppercase === true,\n    digit: req.digit === true,\n    symbol: req.symbol === true,\n  };\n  const classes = Object.values(require).filter(Boolean).length;\n  if (classes > maxLength) throw new RangeError(`definePolicy: ${classes} required character classes do not fit in maxLength (${maxLength})`);\n\n  const policy: Policy = Object.freeze({\n    preset,\n    minLength,\n    maxLength,\n    require: Object.freeze(require),\n    blockCommon: options.blockCommon ?? true,\n    blockRepetitive: options.blockRepetitive ?? true,\n    blocklist: Object.freeze((options.blocklist ?? []).map((word) => fold(word).replace(/[^\\p{L}\\p{N}]/gu, \"\")).filter(Boolean)),\n    minTokenLength,\n    evaluate: (password: string, evaluateOptions?: EvaluateOptions) => evaluateWith(policy, password, evaluateOptions),\n  });\n  return policy;\n};\n\n/** Scores a password against a policy. Pure; no UI. */\nexport const evaluate = (password: string, policy: Policy, options?: EvaluateOptions): StrengthResult =>\n  policy.evaluate(password, options);\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACGO,IAAM,SACX;;;ACQF,IAAM,aAAa;AACnB,IAAM,OAA+B,EAAE,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,IAAI;AAEpJ,IAAM,YAAY;AAAA,EAChB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AACF;AACA,IAAM,SAAmC,CAAC,QAAQ,QAAQ,QAAQ,QAAQ,QAAQ;AAElF,IAAI;AAGG,IAAM,oBAAoB,CAAC,aAA6B,SAAS,UAAU,MAAM;AAExF,IAAM,aAAa,CAAC,UAA4B,MAAM,KAAK,MAAM,QAAQ,YAAY,EAAE,CAAC;AAGxF,IAAM,OAAO,CAAC,UACZ,MAAM,UAAU,MAAM,EAAE,QAAQ,WAAW,EAAE,EAAE,YAAY,EAAE,QAAQ,WAAW,GAAG,EAAE,QAAQ,YAAY,EAAE;AAE7G,IAAM,SAAS,CAAC,UAA0B,MAAM,QAAQ,cAAc,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC;AAGzF,IAAM,SAAS,CAAC,UAA4B;AAC1C,QAAM,IAAI,MAAM;AAChB,QAAM,MAAM,IAAI,MAAc,CAAC,EAAE,KAAK,CAAC;AACvC,WAAS,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,KAAK;AACjC,WAAO,IAAI,KAAK,MAAM,CAAC,MAAM,MAAM,CAAC,EAAG,KAAI,IAAI,IAAI,CAAC;AACpD,QAAI,MAAM,CAAC,MAAM,MAAM,CAAC,EAAG;AAC3B,QAAI,CAAC,IAAI;AAAA,EACX;AACA,SAAO,KAAK,IAAI,IAAI,CAAC,KAAK;AAC5B;AAEA,IAAM,OAAO,CAAC,UAA0B;AACtC,QAAM,QAAQ,MAAM,KAAK,KAAK;AAC9B,SAAO,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,EAAE,KAAK,EAAE;AAC9C;AAGA,IAAM,cAAc,CAAC,WAA6B;AAChD,QAAM,UAAU,OAAO,QAAQ,2BAA2B,EAAE;AAC5D,SAAO,CAAC,OAAO,OAAO,GAAG,OAAO,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,QAAQ,cAAc,EAAE,CAAC,CAAC;AACtF;AAEA,IAAM,aAAa,CAAC,WAA4B;AAC9C,MAAI,OAAO,SAAS,EAAG,QAAO;AAC9B,SAAO,UAAU,KAAK,CAAC,aAAa;AAClC,UAAM,UAAU,SAAS,OAAO,KAAK,KAAK,OAAO,SAAS,SAAS,MAAM,IAAI,CAAC;AAC9E,UAAM,WAAW,MAAM,KAAK,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE;AACtD,WAAO,QAAQ,SAAS,MAAM,KAAK,SAAS,SAAS,MAAM;AAAA,EAC7D,CAAC;AACH;AAEA,IAAM,eAAe,CAAC,OAAiB,WAA4B;AAEjE,MAAI,IAAI,IAAI,KAAK,EAAE,OAAO,KAAK,IAAI,GAAG,KAAK,KAAK,MAAM,SAAS,CAAC,CAAC,EAAG,QAAO;AAC3E,MAAI,OAAO,KAAK,KAAK,MAAM,SAAS,EAAG,QAAO;AAC9C,SAAO,WAAW,MAAM;AAC1B;AAGO,IAAM,iBAAiB,CAAC,WAA+B,mBAAqC;AACjG,QAAM,SAAS,oBAAI,IAAY;AAC/B,aAAW,SAAS,WAAW;AAC7B,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,KAAK,MAAM,YAAY,GAAG;AAChC,UAAM,SAAS,KAAK,KAAK,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,KAAK,EAAE,KAAK;AAC9D,UAAM,QAAQ,CAAC,QAAQ,GAAG,OAAO,MAAM,yDAAyD,CAAC;AACjG,eAAW,QAAQ,OAAO;AACxB,UAAI,MAAM,KAAK,IAAI,EAAE,UAAU,eAAgB,QAAO,IAAI,IAAI;AAAA,IAChE;AAAA,EACF;AACA,SAAO,CAAC,GAAG,MAAM;AACnB;AAEA,IAAM,cAAc,CAAC,QAAgB,UAAsC;AACzE,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAM,WAAW,CAAC,QAAQ,OAAO,MAAM,GAAG,OAAO,QAAQ,mBAAmB,EAAE,CAAC;AAC/E,SAAO,MAAM,KAAK,CAAC,SAAS,SAAS,KAAK,CAAC,YAAY,QAAQ,SAAS,IAAI,CAAC,CAAC;AAChF;AAEA,IAAM,WAAW,CAAC,OAAiB,QAAyB,cAAqC;AAC/F,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,SAAS,OAAO;AAAA,MAAK,CAAC,UAC1B,CAAC,mBAAmB,oBAAoB,uBAAuB,+BAA+B,EAAE,SAAS,KAAK;AAAA,IAChH;AACA,WAAO,UAAU,MAAM,SAAS,YAAY,IAAI,IAAI;AAAA,EACtD;AACA,MAAI,OAAO;AACX,QAAM,OAAO,MAAM,KAAK,EAAE;AAC1B,MAAI,UAAU,KAAK,IAAI,EAAG,SAAQ;AAClC,MAAI,UAAU,KAAK,IAAI,EAAG,SAAQ;AAClC,MAAI,UAAU,KAAK,IAAI,EAAG,SAAQ;AAClC,MAAI,sBAAsB,KAAK,IAAI,EAAG,SAAQ;AAC9C,MAAI,yCAAyC,KAAK,IAAI,EAAG,SAAQ;AAEjE,QAAM,YAAY,KAAK,IAAI,MAAM,QAAQ,IAAI,IAAI,KAAK,EAAE,OAAO,CAAC;AAChE,QAAM,OAAO,YAAY,KAAK,KAAK,KAAK,IAAI,MAAM,CAAC,CAAC;AACpD,SAAO,QAAQ,MAAM,IAAI,QAAQ,KAAK,IAAI;AAC5C;AAEA,IAAM,eAAe,CAAC,QAAgB,OAAgB,UAA2B,CAAC,MAAsB;AACtG,QAAM,WAAW,OAAO,UAAU,WAAW,kBAAkB,KAAK,IAAI;AACxE,QAAM,QAAQ,WAAW,QAAQ;AACjC,QAAM,SAAS,KAAK,QAAQ;AAC5B,QAAM,EAAE,SAAAA,SAAQ,IAAI;AACpB,QAAM,SAA0B,CAAC;AACjC,QAAM,SAAyB;AAAA,IAC7B,WAAW,MAAM,UAAU,OAAO;AAAA,IAClC,WAAW,MAAM,UAAU,OAAO;AAAA,IAClC,WAAW;AAAA,IACX,YAAY;AAAA,IACZ,eAAe;AAAA,IACf,aAAa;AAAA,EACf;AAEA,MAAI,CAAC,OAAO,UAAW,QAAO,KAAK,mBAAmB;AACtD,MAAI,CAAC,OAAO,UAAW,QAAO,KAAK,kBAAkB;AAErD,MAAIA,SAAQ,UAAW,QAAO,YAAY,UAAU,KAAK,QAAQ;AACjE,MAAIA,SAAQ,UAAW,QAAO,YAAY,UAAU,KAAK,QAAQ;AACjE,MAAIA,SAAQ,MAAO,QAAO,QAAQ,UAAU,KAAK,QAAQ;AACzD,MAAIA,SAAQ,OAAQ,QAAO,SAAS,iBAAiB,KAAK,QAAQ;AAClE,MAAI,OAAO,cAAc,MAAO,QAAO,KAAK,sBAAsB;AAClE,MAAI,OAAO,cAAc,MAAO,QAAO,KAAK,sBAAsB;AAClE,MAAI,OAAO,UAAU,MAAO,QAAO,KAAK,kBAAkB;AAC1D,MAAI,OAAO,WAAW,MAAO,QAAO,KAAK,mBAAmB;AAG5D,QAAM,OAAO,SAAS,SAAS,OAAO,YAAY;AAClD,MAAI,MAAM,UAAU,KAAK,CAAC,MAAM;AAC9B,QAAI,OAAO,aAAa;AACtB,YAAM,OAAQ,WAAW,IAAI,IAAI,OAAO,MAAM,GAAG,CAAC;AAClD,aAAO,YAAY,CAAC,YAAY,MAAM,EAAE,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC;AAAA,IACvE;AACA,WAAO,aAAa,CAAC,YAAY,QAAQ,OAAO,SAAS;AACzD,QAAI,OAAO,gBAAiB,QAAO,gBAAgB,CAAC,aAAa,MAAM,KAAK,MAAM,GAAG,MAAM;AAAA,EAC7F;AACA,MAAI,MAAM,SAAS,KAAK,QAAQ,aAAa,CAAC,MAAM;AAClD,WAAO,cAAc,CAAC,YAAY,QAAQ,eAAe,QAAQ,WAAW,OAAO,cAAc,CAAC;AAAA,EACpG;AAEA,MAAI,CAAC,OAAO,UAAW,QAAO,KAAK,iBAAiB;AACpD,MAAI,CAAC,OAAO,WAAY,QAAO,KAAK,kBAAkB;AACtD,MAAI,CAAC,OAAO,cAAe,QAAO,KAAK,qBAAqB;AAC5D,MAAI,CAAC,OAAO,YAAa,QAAO,KAAK,+BAA+B;AAEpE,QAAM,QAAQ,SAAS,OAAO,QAAQ,OAAO,SAAS;AACtD,SAAO,EAAE,OAAO,OAAO,OAAO,KAAK,GAAG,QAAQ,MAAM,QAAQ,OAAO,OAAO,WAAW,GAAG,QAAQ,OAAO;AACzG;AAEA,IAAM,UAAU;AAAA,EACd,MAAM,EAAE,WAAW,IAAI,WAAW,IAAI,SAAS,CAAC,EAAE;AAAA,EAClD,QAAQ,EAAE,WAAW,GAAG,WAAW,IAAI,SAAS,EAAE,WAAW,MAAM,WAAW,MAAM,OAAO,MAAM,QAAQ,KAAK,EAAE;AAClH;AAEA,IAAM,eAAe,CAAC,MAAc,UAAkB;AACpD,MAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,EAAG,OAAM,IAAI,WAAW,iBAAiB,IAAI,oCAAoC,KAAK,EAAE;AAClI;AAGO,IAAM,eAAe,CAAC,UAAyB,CAAC,MAAc;AACnE,QAAM,SAAS,QAAQ,UAAU;AACjC,QAAM,OAAO,QAAQ,MAAM;AAC3B,MAAI,CAAC,KAAM,OAAM,IAAI,WAAW,iCAAiC,OAAO,MAAM,CAAC,GAAG;AAClF,QAAM,YAAY,QAAQ,aAAa,KAAK;AAC5C,QAAM,YAAY,QAAQ,aAAa,KAAK;AAC5C,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,eAAa,aAAa,SAAS;AACnC,eAAa,aAAa,SAAS;AACnC,eAAa,kBAAkB,cAAc;AAC7C,MAAI,YAAY,UAAW,OAAM,IAAI,WAAW,4BAA4B,SAAS,gCAAgC,SAAS,GAAG;AACjI,QAAM,MAAM,EAAE,GAAG,KAAK,SAAS,GAAG,QAAQ,QAAQ;AAClD,QAAMA,WAAU;AAAA,IACd,WAAW,IAAI,cAAc;AAAA,IAC7B,WAAW,IAAI,cAAc;AAAA,IAC7B,OAAO,IAAI,UAAU;AAAA,IACrB,QAAQ,IAAI,WAAW;AAAA,EACzB;AACA,QAAM,UAAU,OAAO,OAAOA,QAAO,EAAE,OAAO,OAAO,EAAE;AACvD,MAAI,UAAU,UAAW,OAAM,IAAI,WAAW,iBAAiB,OAAO,wDAAwD,SAAS,GAAG;AAE1I,QAAM,SAAiB,OAAO,OAAO;AAAA,IACnC;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS,OAAO,OAAOA,QAAO;AAAA,IAC9B,aAAa,QAAQ,eAAe;AAAA,IACpC,iBAAiB,QAAQ,mBAAmB;AAAA,IAC5C,WAAW,OAAO,QAAQ,QAAQ,aAAa,CAAC,GAAG,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,QAAQ,mBAAmB,EAAE,CAAC,EAAE,OAAO,OAAO,CAAC;AAAA,IAC3H;AAAA,IACA,UAAU,CAAC,UAAkB,oBAAsC,aAAa,QAAQ,UAAU,eAAe;AAAA,EACnH,CAAC;AACD,SAAO;AACT;AAGO,IAAM,WAAW,CAAC,UAAkB,QAAgB,YACzD,OAAO,SAAS,UAAU,OAAO;","names":["require"]}

package/dist/strength.d.cts

@@ -0,0 +1,77 @@
+/** Error keys. Map them to messages in your own i18n. */
+type PasswordIssue = "password.tooShort" | "password.tooLong" | "password.noLowercase" | "password.noUppercase" | "password.noDigit" | "password.noSymbol" | "password.common" | "password.blocked" | "password.repetitive" | "password.containsPersonalInfo" | "password.mismatch";
+type StrengthScore = 0 | 1 | 2 | 3 | 4;
+type StrengthLevel = "weak" | "fair" | "good" | "strong";
+interface PasswordChecks {
+    minLength: boolean;
+    maxLength: boolean;
+    notCommon: boolean;
+    notBlocked: boolean;
+    notRepetitive: boolean;
+    notPersonal: boolean;
+    /** Only present when the policy requires the character class. */
+    lowercase?: boolean;
+    uppercase?: boolean;
+    digit?: boolean;
+    symbol?: boolean;
+}
+interface StrengthResult {
+    /** 0–1 fail the policy, 2–4 pass it. */
+    score: StrengthScore;
+    level: StrengthLevel;
+    /** Characters (Unicode code points) after NFKC normalization, without zero-width characters. */
+    length: number;
+    /** No issues. */
+    valid: boolean;
+    checks: PasswordChecks;
+    issues: PasswordIssue[];
+}
+interface EvaluateOptions {
+    /** Values the password must not contain, e.g. the user's email and name. Non-strings are ignored. */
+    forbidden?: readonly unknown[];
+}
+interface CharacterRequirements {
+    lowercase?: boolean;
+    uppercase?: boolean;
+    digit?: boolean;
+    symbol?: boolean;
+}
+type PolicyPreset = "nist" | "legacy";
+interface PolicyOptions {
+    /** `nist` (default): 15–64 characters, no composition rules. `legacy`: 8–64 characters, all four classes. */
+    preset?: PolicyPreset;
+    minLength?: number;
+    maxLength?: number;
+    /** Composition rules. Not recommended by NIST SP 800-63B-4. */
+    require?: CharacterRequirements;
+    /** Reject common passwords from the built-in list. @default true */
+    blockCommon?: boolean;
+    /** Reject repeated characters and sequences like `aaaa…` or `12345…`. @default true */
+    blockRepetitive?: boolean;
+    /** Words the password must not contain, e.g. your product name. Case and accents are ignored. */
+    blocklist?: readonly string[];
+    /** Parts of `forbidden` values shorter than this are ignored. @default 3 */
+    minTokenLength?: number;
+}
+interface Policy {
+    readonly preset: PolicyPreset;
+    readonly minLength: number;
+    readonly maxLength: number;
+    readonly require: Readonly<Required<CharacterRequirements>>;
+    readonly blockCommon: boolean;
+    readonly blockRepetitive: boolean;
+    readonly blocklist: readonly string[];
+    readonly minTokenLength: number;
+    /** The engine travels with the policy, so the hook does not import it. */
+    readonly evaluate: (password: string, options?: EvaluateOptions) => StrengthResult;
+}
+
+/** NFKC, so visually identical input from different keyboards compares and hashes the same. */
+declare const normalizePassword: (password: string) => string;
+/** A password policy. Define it once in a shared module and use it in the form and on the server. */
+declare const definePolicy: (options?: PolicyOptions) => Policy;
+/** Scores a password against a policy. Pure; no UI. */
+declare const evaluate: (password: string, policy: Policy, options?: EvaluateOptions) => StrengthResult;
+
+export { definePolicy, evaluate, normalizePassword };
+export type { CharacterRequirements, EvaluateOptions, PasswordChecks, PasswordIssue, Policy, PolicyOptions, PolicyPreset, StrengthLevel, StrengthResult, StrengthScore };

package/dist/strength.d.mts

@@ -0,0 +1,77 @@
+/** Error keys. Map them to messages in your own i18n. */
+type PasswordIssue = "password.tooShort" | "password.tooLong" | "password.noLowercase" | "password.noUppercase" | "password.noDigit" | "password.noSymbol" | "password.common" | "password.blocked" | "password.repetitive" | "password.containsPersonalInfo" | "password.mismatch";
+type StrengthScore = 0 | 1 | 2 | 3 | 4;
+type StrengthLevel = "weak" | "fair" | "good" | "strong";
+interface PasswordChecks {
+    minLength: boolean;
+    maxLength: boolean;
+    notCommon: boolean;
+    notBlocked: boolean;
+    notRepetitive: boolean;
+    notPersonal: boolean;
+    /** Only present when the policy requires the character class. */
+    lowercase?: boolean;
+    uppercase?: boolean;
+    digit?: boolean;
+    symbol?: boolean;
+}
+interface StrengthResult {
+    /** 0–1 fail the policy, 2–4 pass it. */
+    score: StrengthScore;
+    level: StrengthLevel;
+    /** Characters (Unicode code points) after NFKC normalization, without zero-width characters. */
+    length: number;
+    /** No issues. */
+    valid: boolean;
+    checks: PasswordChecks;
+    issues: PasswordIssue[];
+}
+interface EvaluateOptions {
+    /** Values the password must not contain, e.g. the user's email and name. Non-strings are ignored. */
+    forbidden?: readonly unknown[];
+}
+interface CharacterRequirements {
+    lowercase?: boolean;
+    uppercase?: boolean;
+    digit?: boolean;
+    symbol?: boolean;
+}
+type PolicyPreset = "nist" | "legacy";
+interface PolicyOptions {
+    /** `nist` (default): 15–64 characters, no composition rules. `legacy`: 8–64 characters, all four classes. */
+    preset?: PolicyPreset;
+    minLength?: number;
+    maxLength?: number;
+    /** Composition rules. Not recommended by NIST SP 800-63B-4. */
+    require?: CharacterRequirements;
+    /** Reject common passwords from the built-in list. @default true */
+    blockCommon?: boolean;
+    /** Reject repeated characters and sequences like `aaaa…` or `12345…`. @default true */
+    blockRepetitive?: boolean;
+    /** Words the password must not contain, e.g. your product name. Case and accents are ignored. */
+    blocklist?: readonly string[];
+    /** Parts of `forbidden` values shorter than this are ignored. @default 3 */
+    minTokenLength?: number;
+}
+interface Policy {
+    readonly preset: PolicyPreset;
+    readonly minLength: number;
+    readonly maxLength: number;
+    readonly require: Readonly<Required<CharacterRequirements>>;
+    readonly blockCommon: boolean;
+    readonly blockRepetitive: boolean;
+    readonly blocklist: readonly string[];
+    readonly minTokenLength: number;
+    /** The engine travels with the policy, so the hook does not import it. */
+    readonly evaluate: (password: string, options?: EvaluateOptions) => StrengthResult;
+}
+
+/** NFKC, so visually identical input from different keyboards compares and hashes the same. */
+declare const normalizePassword: (password: string) => string;
+/** A password policy. Define it once in a shared module and use it in the form and on the server. */
+declare const definePolicy: (options?: PolicyOptions) => Policy;
+/** Scores a password against a policy. Pure; no UI. */
+declare const evaluate: (password: string, policy: Policy, options?: EvaluateOptions) => StrengthResult;
+
+export { definePolicy, evaluate, normalizePassword };
+export type { CharacterRequirements, EvaluateOptions, PasswordChecks, PasswordIssue, Policy, PolicyOptions, PolicyPreset, StrengthLevel, StrengthResult, StrengthScore };

package/dist/strength.mjs

@@ -0,0 +1,180 @@
+// src/strength/common.ts
+var COMMON = "password passwort parola sifre sifrem sifreniz parolam qwerty qwertz azerty qwertyuiop asdfgh asdfghjkl zxcvbn zxcvbnm qazwsx qwaszx wsxedc abc abcdef letmein welcome welcom admin administrator root user guest login test tester demo default changeme secret private iloveyou loveyou lovely love monkey dragon master shadow sunshine princess football baseball soccer basketball hockey superman batman spiderman starwars pokemon minecraft trustno whatever freedom flower hello hellothere cookie cheese chocolate summer winter autumn spring michael jessica jennifer charlie thomas jordan hunter ranger buster tigger ginger pepper matrix computer internet google facebook instagram twitter yahoo hotmail gmail apple samsung iphone android microsoft windows linux ubuntu killer access mustang harley ferrari porsche mercedes yankees liverpool chelsea arsenal barcelona realmadrid juventus galatasaray fenerbahce besiktas trabzonspor bursaspor cimbom istanbul ankara izmir antalya bursa turkiye turkey ataturk allah bismillah askim sevgilim bitanem canim hayatim prenses kelebek melek gunes yildiz deniz mehmet ahmet mustafa ali ayse fatma emine hatice zeynep elif omer murat emre burak huseyin hasan ibrahim yusuf merhaba selam kardesim annem babam qwertyasdfgh correcthorsebatterystaple passphrase mypassword newpassword temppassword passwordpassword nopassword sifreyok";
+
+// src/strength/core.ts
+var ZERO_WIDTH = /[\u200B-\u200D\u2060\uFEFF]/g;
+var LEET = { "0": "o", "1": "i", "3": "e", "4": "a", "5": "s", "7": "t", "8": "b", "@": "a", "$": "s", "!": "i", "+": "t" };
+var SEQUENCES = [
+  "abcdefghijklmnopqrstuvwxyz",
+  "0123456789",
+  "qwertyuiopasdfghjklzxcvbnm",
+  "qwertzuiopasdfghjklyxcvbnm",
+  "azertyuiopqsdfghjklmwxcvbn",
+  // Turkish Q layout, folded: ı→i, ğ→g, ü→u, ş→s, ö→o, ç→c
+  "qwertyuiopguasdfghjklsizxcvbnmoc",
+  "1qaz2wsx3edc4rfv5tgb6yhn7ujm8ik9ol0p"
+];
+var LEVELS = ["weak", "weak", "fair", "good", "strong"];
+var common;
+var normalizePassword = (password) => password.normalize("NFKC");
+var codePoints = (value) => Array.from(value.replace(ZERO_WIDTH, ""));
+var fold = (value) => value.normalize("NFKD").replace(/\p{M}/gu, "").toLowerCase().replace(/\u0131/g, "i").replace(ZERO_WIDTH, "");
+var deLeet = (value) => value.replace(/[0-9@$!+]/g, (c) => LEET[c] ?? c);
+var period = (value) => {
+  const n = value.length;
+  const lps = new Array(n).fill(0);
+  for (let i = 1, k = 0; i < n; i++) {
+    while (k > 0 && value[i] !== value[k]) k = lps[k - 1];
+    if (value[i] === value[k]) k++;
+    lps[i] = k;
+  }
+  return n - (lps[n - 1] ?? 0);
+};
+var unit = (value) => {
+  const chars = Array.from(value);
+  return chars.slice(0, period(chars)).join("");
+};
+var commonCores = (folded) => {
+  const trimmed = folded.replace(/^[^\p{L}]+|[^\p{L}]+$/gu, "");
+  return [deLeet(trimmed), trimmed].map((core) => unit(core.replace(/[^\p{L}]/gu, "")));
+};
+var isSequence = (folded) => {
+  if (folded.length < 3) return false;
+  return SEQUENCES.some((sequence) => {
+    const forward = sequence.repeat(Math.ceil(folded.length / sequence.length) + 1);
+    const backward = Array.from(forward).reverse().join("");
+    return forward.includes(folded) || backward.includes(folded);
+  });
+};
+var isRepetitive = (chars, folded) => {
+  if (new Set(chars).size < Math.min(4, Math.ceil(chars.length / 2))) return true;
+  if (period(chars) <= chars.length / 3) return true;
+  return isSequence(folded);
+};
+var personalTokens = (forbidden, minTokenLength) => {
+  const tokens = /* @__PURE__ */ new Set();
+  for (const value of forbidden) {
+    if (typeof value !== "string") continue;
+    const at = value.lastIndexOf("@");
+    const source = fold(at > 0 ? value.slice(0, at) : value).trim();
+    const parts = [source, ...source.split(/[^\p{L}\p{N}]+|(?<=\p{L})(?=\p{N})|(?<=\p{N})(?=\p{L})/u)];
+    for (const part of parts) {
+      if (Array.from(part).length >= minTokenLength) tokens.add(part);
+    }
+  }
+  return [...tokens];
+};
+var containsAny = (folded, words) => {
+  if (words.length === 0) return false;
+  const variants = [folded, deLeet(folded), folded.replace(/[^\p{L}\p{N}]/gu, "")];
+  return words.some((word) => variants.some((variant) => variant.includes(word)));
+};
+var scoreFor = (chars, issues, minLength) => {
+  if (chars.length === 0) return 0;
+  if (issues.length > 0) {
+    const severe = issues.some(
+      (issue) => ["password.common", "password.blocked", "password.repetitive", "password.containsPersonalInfo"].includes(issue)
+    );
+    return severe || chars.length < minLength / 2 ? 0 : 1;
+  }
+  let pool = 0;
+  const text = chars.join("");
+  if (/\p{Ll}/u.test(text)) pool += 26;
+  if (/\p{Lu}/u.test(text)) pool += 26;
+  if (/\p{Nd}/u.test(text)) pool += 10;
+  if (/[\p{P}\p{S}\p{Zs}]/u.test(text)) pool += 33;
+  if (/[^\p{Ll}\p{Lu}\p{Nd}\p{P}\p{S}\p{Zs}]/u.test(text)) pool += 100;
+  const effective = Math.min(chars.length, new Set(chars).size * 2);
+  const bits = effective * Math.log2(Math.max(pool, 2));
+  return bits >= 100 ? 4 : bits >= 80 ? 3 : 2;
+};
+var evaluateWith = (policy, input, options = {}) => {
+  const password = typeof input === "string" ? normalizePassword(input) : "";
+  const chars = codePoints(password);
+  const folded = fold(password);
+  const { require: require2 } = policy;
+  const issues = [];
+  const checks = {
+    minLength: chars.length >= policy.minLength,
+    maxLength: chars.length <= policy.maxLength,
+    notCommon: true,
+    notBlocked: true,
+    notRepetitive: true,
+    notPersonal: true
+  };
+  if (!checks.minLength) issues.push("password.tooShort");
+  if (!checks.maxLength) issues.push("password.tooLong");
+  if (require2.lowercase) checks.lowercase = /\p{Ll}/u.test(password);
+  if (require2.uppercase) checks.uppercase = /\p{Lu}/u.test(password);
+  if (require2.digit) checks.digit = /\p{Nd}/u.test(password);
+  if (require2.symbol) checks.symbol = /[^\p{L}\p{N}]/u.test(password);
+  if (checks.lowercase === false) issues.push("password.noLowercase");
+  if (checks.uppercase === false) issues.push("password.noUppercase");
+  if (checks.digit === false) issues.push("password.noDigit");
+  if (checks.symbol === false) issues.push("password.noSymbol");
+  const huge = password.length > policy.maxLength * 4;
+  if (chars.length >= 4 && !huge) {
+    if (policy.blockCommon) {
+      const list = common ??= new Set(COMMON.split(" "));
+      checks.notCommon = !commonCores(folded).some((core) => list.has(core));
+    }
+    checks.notBlocked = !containsAny(folded, policy.blocklist);
+    if (policy.blockRepetitive) checks.notRepetitive = !isRepetitive(Array.from(folded), folded);
+  }
+  if (chars.length > 0 && options.forbidden && !huge) {
+    checks.notPersonal = !containsAny(folded, personalTokens(options.forbidden, policy.minTokenLength));
+  }
+  if (!checks.notCommon) issues.push("password.common");
+  if (!checks.notBlocked) issues.push("password.blocked");
+  if (!checks.notRepetitive) issues.push("password.repetitive");
+  if (!checks.notPersonal) issues.push("password.containsPersonalInfo");
+  const score = scoreFor(chars, issues, policy.minLength);
+  return { score, level: LEVELS[score], length: chars.length, valid: issues.length === 0, checks, issues };
+};
+var PRESETS = {
+  nist: { minLength: 15, maxLength: 64, require: {} },
+  legacy: { minLength: 8, maxLength: 64, require: { lowercase: true, uppercase: true, digit: true, symbol: true } }
+};
+var assertLength = (name, value) => {
+  if (!Number.isInteger(value) || value < 1) throw new RangeError(`definePolicy: ${name} must be a positive integer, got ${value}`);
+};
+var definePolicy = (options = {}) => {
+  const preset = options.preset ?? "nist";
+  const base = PRESETS[preset];
+  if (!base) throw new RangeError(`definePolicy: unknown preset "${String(preset)}"`);
+  const minLength = options.minLength ?? base.minLength;
+  const maxLength = options.maxLength ?? base.maxLength;
+  const minTokenLength = options.minTokenLength ?? 3;
+  assertLength("minLength", minLength);
+  assertLength("maxLength", maxLength);
+  assertLength("minTokenLength", minTokenLength);
+  if (minLength > maxLength) throw new RangeError(`definePolicy: minLength (${minLength}) is greater than maxLength (${maxLength})`);
+  const req = { ...base.require, ...options.require };
+  const require2 = {
+    lowercase: req.lowercase === true,
+    uppercase: req.uppercase === true,
+    digit: req.digit === true,
+    symbol: req.symbol === true
+  };
+  const classes = Object.values(require2).filter(Boolean).length;
+  if (classes > maxLength) throw new RangeError(`definePolicy: ${classes} required character classes do not fit in maxLength (${maxLength})`);
+  const policy = Object.freeze({
+    preset,
+    minLength,
+    maxLength,
+    require: Object.freeze(require2),
+    blockCommon: options.blockCommon ?? true,
+    blockRepetitive: options.blockRepetitive ?? true,
+    blocklist: Object.freeze((options.blocklist ?? []).map((word) => fold(word).replace(/[^\p{L}\p{N}]/gu, "")).filter(Boolean)),
+    minTokenLength,
+    evaluate: (password, evaluateOptions) => evaluateWith(policy, password, evaluateOptions)
+  });
+  return policy;
+};
+var evaluate = (password, policy, options) => policy.evaluate(password, options);
+export {
+  definePolicy,
+  evaluate,
+  normalizePassword
+};
+//# sourceMappingURL=strength.mjs.map

package/dist/strength.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/strength/common.ts","../src/strength/core.ts"],"sourcesContent":["// Cores of common passwords: lowercase letters only, as `commonCore()` reduces them\n// (\"P@ssw0rd123!\" → \"password\"). Includes Turkish favourites. Digits-only and keyboard runs\n// are caught by the repetition and sequence checks instead.\nexport const COMMON =\n  \"password passwort parola sifre sifrem sifreniz parolam qwerty qwertz azerty qwertyuiop asdfgh asdfghjkl \" +\n  \"zxcvbn zxcvbnm qazwsx qwaszx wsxedc abc abcdef letmein welcome welcom admin administrator root user guest \" +\n  \"login test tester demo default changeme secret private iloveyou loveyou lovely love monkey dragon master \" +\n  \"shadow sunshine princess football baseball soccer basketball hockey superman batman spiderman starwars \" +\n  \"pokemon minecraft trustno whatever freedom flower hello hellothere cookie cheese chocolate summer winter \" +\n  \"autumn spring michael jessica jennifer charlie thomas jordan hunter ranger buster tigger ginger pepper \" +\n  \"matrix computer internet google facebook instagram twitter yahoo hotmail gmail apple samsung iphone \" +\n  \"android microsoft windows linux ubuntu killer access mustang harley ferrari porsche mercedes yankees \" +\n  \"liverpool chelsea arsenal barcelona realmadrid juventus galatasaray fenerbahce besiktas trabzonspor \" +\n  \"bursaspor cimbom istanbul ankara izmir antalya bursa turkiye turkey ataturk allah bismillah askim \" +\n  \"sevgilim bitanem canim hayatim prenses kelebek melek gunes yildiz deniz mehmet ahmet mustafa ali \" +\n  \"ayse fatma emine hatice zeynep elif omer murat emre burak huseyin hasan ibrahim yusuf merhaba \" +\n  \"selam kardesim annem babam qwertyasdfgh correcthorsebatterystaple passphrase mypassword newpassword \" +\n  \"temppassword passwordpassword nopassword sifreyok\";\n","import { COMMON } from \"./common\";\nimport type {\n  EvaluateOptions,\n  PasswordChecks,\n  PasswordIssue,\n  Policy,\n  PolicyOptions,\n  StrengthLevel,\n  StrengthResult,\n  StrengthScore,\n} from \"./types\";\n\nconst ZERO_WIDTH = /[\\u200B-\\u200D\\u2060\\uFEFF]/g;\nconst LEET: Record<string, string> = { \"0\": \"o\", \"1\": \"i\", \"3\": \"e\", \"4\": \"a\", \"5\": \"s\", \"7\": \"t\", \"8\": \"b\", \"@\": \"a\", \"$\": \"s\", \"!\": \"i\", \"+\": \"t\" };\n// Rows and runs that read as a sequence when typed, forwards or backwards.\nconst SEQUENCES = [\n  \"abcdefghijklmnopqrstuvwxyz\",\n  \"0123456789\",\n  \"qwertyuiopasdfghjklzxcvbnm\",\n  \"qwertzuiopasdfghjklyxcvbnm\",\n  \"azertyuiopqsdfghjklmwxcvbn\",\n  // Turkish Q layout, folded: ı→i, ğ→g, ü→u, ş→s, ö→o, ç→c\n  \"qwertyuiopguasdfghjklsizxcvbnmoc\",\n  \"1qaz2wsx3edc4rfv5tgb6yhn7ujm8ik9ol0p\",\n];\nconst LEVELS: readonly StrengthLevel[] = [\"weak\", \"weak\", \"fair\", \"good\", \"strong\"];\n\nlet common: Set<string> | undefined;\n\n/** NFKC, so visually identical input from different keyboards compares and hashes the same. */\nexport const normalizePassword = (password: string): string => password.normalize(\"NFKC\");\n\nconst codePoints = (value: string): string[] => Array.from(value.replace(ZERO_WIDTH, \"\"));\n\n/** Lowercase without accents, for comparisons only: \"Şifre\" and \"sifre\" match, so do \"İ\" and \"i\". */\nconst fold = (value: string): string =>\n  value.normalize(\"NFKD\").replace(/\\p{M}/gu, \"\").toLowerCase().replace(/\\u0131/g, \"i\").replace(ZERO_WIDTH, \"\");\n\nconst deLeet = (value: string): string => value.replace(/[0-9@$!+]/g, (c) => LEET[c] ?? c);\n\n/** Length of the shortest unit the string repeats, e.g. 3 for \"abcabcab\" (the last copy may be cut short). */\nconst period = (value: string[]): number => {\n  const n = value.length;\n  const lps = new Array<number>(n).fill(0);\n  for (let i = 1, k = 0; i < n; i++) {\n    while (k > 0 && value[i] !== value[k]) k = lps[k - 1];\n    if (value[i] === value[k]) k++;\n    lps[i] = k;\n  }\n  return n - (lps[n - 1] ?? 0);\n};\n\nconst unit = (value: string): string => {\n  const chars = Array.from(value);\n  return chars.slice(0, period(chars)).join(\"\");\n};\n\n/** \"P@ssw0rd2024!\" → \"password\"; \"summer2024summer\" → \"summer\". Digits inside are leetspeak or separators. */\nconst commonCores = (folded: string): string[] => {\n  const trimmed = folded.replace(/^[^\\p{L}]+|[^\\p{L}]+$/gu, \"\");\n  return [deLeet(trimmed), trimmed].map((core) => unit(core.replace(/[^\\p{L}]/gu, \"\")));\n};\n\nconst isSequence = (folded: string): boolean => {\n  if (folded.length < 3) return false;\n  return SEQUENCES.some((sequence) => {\n    const forward = sequence.repeat(Math.ceil(folded.length / sequence.length) + 1);\n    const backward = Array.from(forward).reverse().join(\"\");\n    return forward.includes(folded) || backward.includes(folded);\n  });\n};\n\nconst isRepetitive = (chars: string[], folded: string): boolean => {\n  // Fewer than 4 distinct characters; short inputs need half of theirs.\n  if (new Set(chars).size < Math.min(4, Math.ceil(chars.length / 2))) return true;\n  if (period(chars) <= chars.length / 3) return true;\n  return isSequence(folded);\n};\n\n/** Splits emails (local part only), names and usernames into lowercase parts. */\nexport const personalTokens = (forbidden: readonly unknown[], minTokenLength: number): string[] => {\n  const tokens = new Set<string>();\n  for (const value of forbidden) {\n    if (typeof value !== \"string\") continue;\n    const at = value.lastIndexOf(\"@\");\n    const source = fold(at > 0 ? value.slice(0, at) : value).trim();\n    const parts = [source, ...source.split(/[^\\p{L}\\p{N}]+|(?<=\\p{L})(?=\\p{N})|(?<=\\p{N})(?=\\p{L})/u)];\n    for (const part of parts) {\n      if (Array.from(part).length >= minTokenLength) tokens.add(part);\n    }\n  }\n  return [...tokens];\n};\n\nconst containsAny = (folded: string, words: readonly string[]): boolean => {\n  if (words.length === 0) return false;\n  const variants = [folded, deLeet(folded), folded.replace(/[^\\p{L}\\p{N}]/gu, \"\")];\n  return words.some((word) => variants.some((variant) => variant.includes(word)));\n};\n\nconst scoreFor = (chars: string[], issues: PasswordIssue[], minLength: number): StrengthScore => {\n  if (chars.length === 0) return 0;\n  if (issues.length > 0) {\n    const severe = issues.some((issue) =>\n      [\"password.common\", \"password.blocked\", \"password.repetitive\", \"password.containsPersonalInfo\"].includes(issue),\n    );\n    return severe || chars.length < minLength / 2 ? 0 : 1;\n  }\n  let pool = 0;\n  const text = chars.join(\"\");\n  if (/\\p{Ll}/u.test(text)) pool += 26;\n  if (/\\p{Lu}/u.test(text)) pool += 26;\n  if (/\\p{Nd}/u.test(text)) pool += 10;\n  if (/[\\p{P}\\p{S}\\p{Zs}]/u.test(text)) pool += 33;\n  if (/[^\\p{Ll}\\p{Lu}\\p{Nd}\\p{P}\\p{S}\\p{Zs}]/u.test(text)) pool += 100;\n  // Repeated characters add little; count each distinct one at most twice.\n  const effective = Math.min(chars.length, new Set(chars).size * 2);\n  const bits = effective * Math.log2(Math.max(pool, 2));\n  return bits >= 100 ? 4 : bits >= 80 ? 3 : 2;\n};\n\nconst evaluateWith = (policy: Policy, input: unknown, options: EvaluateOptions = {}): StrengthResult => {\n  const password = typeof input === \"string\" ? normalizePassword(input) : \"\";\n  const chars = codePoints(password);\n  const folded = fold(password);\n  const { require } = policy;\n  const issues: PasswordIssue[] = [];\n  const checks: PasswordChecks = {\n    minLength: chars.length >= policy.minLength,\n    maxLength: chars.length <= policy.maxLength,\n    notCommon: true,\n    notBlocked: true,\n    notRepetitive: true,\n    notPersonal: true,\n  };\n\n  if (!checks.minLength) issues.push(\"password.tooShort\");\n  if (!checks.maxLength) issues.push(\"password.tooLong\");\n\n  if (require.lowercase) checks.lowercase = /\\p{Ll}/u.test(password);\n  if (require.uppercase) checks.uppercase = /\\p{Lu}/u.test(password);\n  if (require.digit) checks.digit = /\\p{Nd}/u.test(password);\n  if (require.symbol) checks.symbol = /[^\\p{L}\\p{N}]/u.test(password);\n  if (checks.lowercase === false) issues.push(\"password.noLowercase\");\n  if (checks.uppercase === false) issues.push(\"password.noUppercase\");\n  if (checks.digit === false) issues.push(\"password.noDigit\");\n  if (checks.symbol === false) issues.push(\"password.noSymbol\");\n\n  // Far past the limit the answer is \"too long\" anyway; skip the pattern checks on huge input.\n  const huge = password.length > policy.maxLength * 4;\n  if (chars.length >= 4 && !huge) {\n    if (policy.blockCommon) {\n      const list = (common ??= new Set(COMMON.split(\" \")));\n      checks.notCommon = !commonCores(folded).some((core) => list.has(core));\n    }\n    checks.notBlocked = !containsAny(folded, policy.blocklist);\n    if (policy.blockRepetitive) checks.notRepetitive = !isRepetitive(Array.from(folded), folded);\n  }\n  if (chars.length > 0 && options.forbidden && !huge) {\n    checks.notPersonal = !containsAny(folded, personalTokens(options.forbidden, policy.minTokenLength));\n  }\n\n  if (!checks.notCommon) issues.push(\"password.common\");\n  if (!checks.notBlocked) issues.push(\"password.blocked\");\n  if (!checks.notRepetitive) issues.push(\"password.repetitive\");\n  if (!checks.notPersonal) issues.push(\"password.containsPersonalInfo\");\n\n  const score = scoreFor(chars, issues, policy.minLength);\n  return { score, level: LEVELS[score], length: chars.length, valid: issues.length === 0, checks, issues };\n};\n\nconst PRESETS = {\n  nist: { minLength: 15, maxLength: 64, require: {} },\n  legacy: { minLength: 8, maxLength: 64, require: { lowercase: true, uppercase: true, digit: true, symbol: true } },\n} as const;\n\nconst assertLength = (name: string, value: number) => {\n  if (!Number.isInteger(value) || value < 1) throw new RangeError(`definePolicy: ${name} must be a positive integer, got ${value}`);\n};\n\n/** A password policy. Define it once in a shared module and use it in the form and on the server. */\nexport const definePolicy = (options: PolicyOptions = {}): Policy => {\n  const preset = options.preset ?? \"nist\";\n  const base = PRESETS[preset];\n  if (!base) throw new RangeError(`definePolicy: unknown preset \"${String(preset)}\"`);\n  const minLength = options.minLength ?? base.minLength;\n  const maxLength = options.maxLength ?? base.maxLength;\n  const minTokenLength = options.minTokenLength ?? 3;\n  assertLength(\"minLength\", minLength);\n  assertLength(\"maxLength\", maxLength);\n  assertLength(\"minTokenLength\", minTokenLength);\n  if (minLength > maxLength) throw new RangeError(`definePolicy: minLength (${minLength}) is greater than maxLength (${maxLength})`);\n  const req = { ...base.require, ...options.require };\n  const require = {\n    lowercase: req.lowercase === true,\n    uppercase: req.uppercase === true,\n    digit: req.digit === true,\n    symbol: req.symbol === true,\n  };\n  const classes = Object.values(require).filter(Boolean).length;\n  if (classes > maxLength) throw new RangeError(`definePolicy: ${classes} required character classes do not fit in maxLength (${maxLength})`);\n\n  const policy: Policy = Object.freeze({\n    preset,\n    minLength,\n    maxLength,\n    require: Object.freeze(require),\n    blockCommon: options.blockCommon ?? true,\n    blockRepetitive: options.blockRepetitive ?? true,\n    blocklist: Object.freeze((options.blocklist ?? []).map((word) => fold(word).replace(/[^\\p{L}\\p{N}]/gu, \"\")).filter(Boolean)),\n    minTokenLength,\n    evaluate: (password: string, evaluateOptions?: EvaluateOptions) => evaluateWith(policy, password, evaluateOptions),\n  });\n  return policy;\n};\n\n/** Scores a password against a policy. Pure; no UI. */\nexport const evaluate = (password: string, policy: Policy, options?: EvaluateOptions): StrengthResult =>\n  policy.evaluate(password, options);\n"],"mappings":";AAGO,IAAM,SACX;;;ACQF,IAAM,aAAa;AACnB,IAAM,OAA+B,EAAE,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,IAAI;AAEpJ,IAAM,YAAY;AAAA,EAChB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AACF;AACA,IAAM,SAAmC,CAAC,QAAQ,QAAQ,QAAQ,QAAQ,QAAQ;AAElF,IAAI;AAGG,IAAM,oBAAoB,CAAC,aAA6B,SAAS,UAAU,MAAM;AAExF,IAAM,aAAa,CAAC,UAA4B,MAAM,KAAK,MAAM,QAAQ,YAAY,EAAE,CAAC;AAGxF,IAAM,OAAO,CAAC,UACZ,MAAM,UAAU,MAAM,EAAE,QAAQ,WAAW,EAAE,EAAE,YAAY,EAAE,QAAQ,WAAW,GAAG,EAAE,QAAQ,YAAY,EAAE;AAE7G,IAAM,SAAS,CAAC,UAA0B,MAAM,QAAQ,cAAc,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC;AAGzF,IAAM,SAAS,CAAC,UAA4B;AAC1C,QAAM,IAAI,MAAM;AAChB,QAAM,MAAM,IAAI,MAAc,CAAC,EAAE,KAAK,CAAC;AACvC,WAAS,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,KAAK;AACjC,WAAO,IAAI,KAAK,MAAM,CAAC,MAAM,MAAM,CAAC,EAAG,KAAI,IAAI,IAAI,CAAC;AACpD,QAAI,MAAM,CAAC,MAAM,MAAM,CAAC,EAAG;AAC3B,QAAI,CAAC,IAAI;AAAA,EACX;AACA,SAAO,KAAK,IAAI,IAAI,CAAC,KAAK;AAC5B;AAEA,IAAM,OAAO,CAAC,UAA0B;AACtC,QAAM,QAAQ,MAAM,KAAK,KAAK;AAC9B,SAAO,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,EAAE,KAAK,EAAE;AAC9C;AAGA,IAAM,cAAc,CAAC,WAA6B;AAChD,QAAM,UAAU,OAAO,QAAQ,2BAA2B,EAAE;AAC5D,SAAO,CAAC,OAAO,OAAO,GAAG,OAAO,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,QAAQ,cAAc,EAAE,CAAC,CAAC;AACtF;AAEA,IAAM,aAAa,CAAC,WAA4B;AAC9C,MAAI,OAAO,SAAS,EAAG,QAAO;AAC9B,SAAO,UAAU,KAAK,CAAC,aAAa;AAClC,UAAM,UAAU,SAAS,OAAO,KAAK,KAAK,OAAO,SAAS,SAAS,MAAM,IAAI,CAAC;AAC9E,UAAM,WAAW,MAAM,KAAK,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE;AACtD,WAAO,QAAQ,SAAS,MAAM,KAAK,SAAS,SAAS,MAAM;AAAA,EAC7D,CAAC;AACH;AAEA,IAAM,eAAe,CAAC,OAAiB,WAA4B;AAEjE,MAAI,IAAI,IAAI,KAAK,EAAE,OAAO,KAAK,IAAI,GAAG,KAAK,KAAK,MAAM,SAAS,CAAC,CAAC,EAAG,QAAO;AAC3E,MAAI,OAAO,KAAK,KAAK,MAAM,SAAS,EAAG,QAAO;AAC9C,SAAO,WAAW,MAAM;AAC1B;AAGO,IAAM,iBAAiB,CAAC,WAA+B,mBAAqC;AACjG,QAAM,SAAS,oBAAI,IAAY;AAC/B,aAAW,SAAS,WAAW;AAC7B,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,KAAK,MAAM,YAAY,GAAG;AAChC,UAAM,SAAS,KAAK,KAAK,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,KAAK,EAAE,KAAK;AAC9D,UAAM,QAAQ,CAAC,QAAQ,GAAG,OAAO,MAAM,yDAAyD,CAAC;AACjG,eAAW,QAAQ,OAAO;AACxB,UAAI,MAAM,KAAK,IAAI,EAAE,UAAU,eAAgB,QAAO,IAAI,IAAI;AAAA,IAChE;AAAA,EACF;AACA,SAAO,CAAC,GAAG,MAAM;AACnB;AAEA,IAAM,cAAc,CAAC,QAAgB,UAAsC;AACzE,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAM,WAAW,CAAC,QAAQ,OAAO,MAAM,GAAG,OAAO,QAAQ,mBAAmB,EAAE,CAAC;AAC/E,SAAO,MAAM,KAAK,CAAC,SAAS,SAAS,KAAK,CAAC,YAAY,QAAQ,SAAS,IAAI,CAAC,CAAC;AAChF;AAEA,IAAM,WAAW,CAAC,OAAiB,QAAyB,cAAqC;AAC/F,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,SAAS,OAAO;AAAA,MAAK,CAAC,UAC1B,CAAC,mBAAmB,oBAAoB,uBAAuB,+BAA+B,EAAE,SAAS,KAAK;AAAA,IAChH;AACA,WAAO,UAAU,MAAM,SAAS,YAAY,IAAI,IAAI;AAAA,EACtD;AACA,MAAI,OAAO;AACX,QAAM,OAAO,MAAM,KAAK,EAAE;AAC1B,MAAI,UAAU,KAAK,IAAI,EAAG,SAAQ;AAClC,MAAI,UAAU,KAAK,IAAI,EAAG,SAAQ;AAClC,MAAI,UAAU,KAAK,IAAI,EAAG,SAAQ;AAClC,MAAI,sBAAsB,KAAK,IAAI,EAAG,SAAQ;AAC9C,MAAI,yCAAyC,KAAK,IAAI,EAAG,SAAQ;AAEjE,QAAM,YAAY,KAAK,IAAI,MAAM,QAAQ,IAAI,IAAI,KAAK,EAAE,OAAO,CAAC;AAChE,QAAM,OAAO,YAAY,KAAK,KAAK,KAAK,IAAI,MAAM,CAAC,CAAC;AACpD,SAAO,QAAQ,MAAM,IAAI,QAAQ,KAAK,IAAI;AAC5C;AAEA,IAAM,eAAe,CAAC,QAAgB,OAAgB,UAA2B,CAAC,MAAsB;AACtG,QAAM,WAAW,OAAO,UAAU,WAAW,kBAAkB,KAAK,IAAI;AACxE,QAAM,QAAQ,WAAW,QAAQ;AACjC,QAAM,SAAS,KAAK,QAAQ;AAC5B,QAAM,EAAE,SAAAA,SAAQ,IAAI;AACpB,QAAM,SAA0B,CAAC;AACjC,QAAM,SAAyB;AAAA,IAC7B,WAAW,MAAM,UAAU,OAAO;AAAA,IAClC,WAAW,MAAM,UAAU,OAAO;AAAA,IAClC,WAAW;AAAA,IACX,YAAY;AAAA,IACZ,eAAe;AAAA,IACf,aAAa;AAAA,EACf;AAEA,MAAI,CAAC,OAAO,UAAW,QAAO,KAAK,mBAAmB;AACtD,MAAI,CAAC,OAAO,UAAW,QAAO,KAAK,kBAAkB;AAErD,MAAIA,SAAQ,UAAW,QAAO,YAAY,UAAU,KAAK,QAAQ;AACjE,MAAIA,SAAQ,UAAW,QAAO,YAAY,UAAU,KAAK,QAAQ;AACjE,MAAIA,SAAQ,MAAO,QAAO,QAAQ,UAAU,KAAK,QAAQ;AACzD,MAAIA,SAAQ,OAAQ,QAAO,SAAS,iBAAiB,KAAK,QAAQ;AAClE,MAAI,OAAO,cAAc,MAAO,QAAO,KAAK,sBAAsB;AAClE,MAAI,OAAO,cAAc,MAAO,QAAO,KAAK,sBAAsB;AAClE,MAAI,OAAO,UAAU,MAAO,QAAO,KAAK,kBAAkB;AAC1D,MAAI,OAAO,WAAW,MAAO,QAAO,KAAK,mBAAmB;AAG5D,QAAM,OAAO,SAAS,SAAS,OAAO,YAAY;AAClD,MAAI,MAAM,UAAU,KAAK,CAAC,MAAM;AAC9B,QAAI,OAAO,aAAa;AACtB,YAAM,OAAQ,WAAW,IAAI,IAAI,OAAO,MAAM,GAAG,CAAC;AAClD,aAAO,YAAY,CAAC,YAAY,MAAM,EAAE,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC;AAAA,IACvE;AACA,WAAO,aAAa,CAAC,YAAY,QAAQ,OAAO,SAAS;AACzD,QAAI,OAAO,gBAAiB,QAAO,gBAAgB,CAAC,aAAa,MAAM,KAAK,MAAM,GAAG,MAAM;AAAA,EAC7F;AACA,MAAI,MAAM,SAAS,KAAK,QAAQ,aAAa,CAAC,MAAM;AAClD,WAAO,cAAc,CAAC,YAAY,QAAQ,eAAe,QAAQ,WAAW,OAAO,cAAc,CAAC;AAAA,EACpG;AAEA,MAAI,CAAC,OAAO,UAAW,QAAO,KAAK,iBAAiB;AACpD,MAAI,CAAC,OAAO,WAAY,QAAO,KAAK,kBAAkB;AACtD,MAAI,CAAC,OAAO,cAAe,QAAO,KAAK,qBAAqB;AAC5D,MAAI,CAAC,OAAO,YAAa,QAAO,KAAK,+BAA+B;AAEpE,QAAM,QAAQ,SAAS,OAAO,QAAQ,OAAO,SAAS;AACtD,SAAO,EAAE,OAAO,OAAO,OAAO,KAAK,GAAG,QAAQ,MAAM,QAAQ,OAAO,OAAO,WAAW,GAAG,QAAQ,OAAO;AACzG;AAEA,IAAM,UAAU;AAAA,EACd,MAAM,EAAE,WAAW,IAAI,WAAW,IAAI,SAAS,CAAC,EAAE;AAAA,EAClD,QAAQ,EAAE,WAAW,GAAG,WAAW,IAAI,SAAS,EAAE,WAAW,MAAM,WAAW,MAAM,OAAO,MAAM,QAAQ,KAAK,EAAE;AAClH;AAEA,IAAM,eAAe,CAAC,MAAc,UAAkB;AACpD,MAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,EAAG,OAAM,IAAI,WAAW,iBAAiB,IAAI,oCAAoC,KAAK,EAAE;AAClI;AAGO,IAAM,eAAe,CAAC,UAAyB,CAAC,MAAc;AACnE,QAAM,SAAS,QAAQ,UAAU;AACjC,QAAM,OAAO,QAAQ,MAAM;AAC3B,MAAI,CAAC,KAAM,OAAM,IAAI,WAAW,iCAAiC,OAAO,MAAM,CAAC,GAAG;AAClF,QAAM,YAAY,QAAQ,aAAa,KAAK;AAC5C,QAAM,YAAY,QAAQ,aAAa,KAAK;AAC5C,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,eAAa,aAAa,SAAS;AACnC,eAAa,aAAa,SAAS;AACnC,eAAa,kBAAkB,cAAc;AAC7C,MAAI,YAAY,UAAW,OAAM,IAAI,WAAW,4BAA4B,SAAS,gCAAgC,SAAS,GAAG;AACjI,QAAM,MAAM,EAAE,GAAG,KAAK,SAAS,GAAG,QAAQ,QAAQ;AAClD,QAAMA,WAAU;AAAA,IACd,WAAW,IAAI,cAAc;AAAA,IAC7B,WAAW,IAAI,cAAc;AAAA,IAC7B,OAAO,IAAI,UAAU;AAAA,IACrB,QAAQ,IAAI,WAAW;AAAA,EACzB;AACA,QAAM,UAAU,OAAO,OAAOA,QAAO,EAAE,OAAO,OAAO,EAAE;AACvD,MAAI,UAAU,UAAW,OAAM,IAAI,WAAW,iBAAiB,OAAO,wDAAwD,SAAS,GAAG;AAE1I,QAAM,SAAiB,OAAO,OAAO;AAAA,IACnC;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS,OAAO,OAAOA,QAAO;AAAA,IAC9B,aAAa,QAAQ,eAAe;AAAA,IACpC,iBAAiB,QAAQ,mBAAmB;AAAA,IAC5C,WAAW,OAAO,QAAQ,QAAQ,aAAa,CAAC,GAAG,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,QAAQ,mBAAmB,EAAE,CAAC,EAAE,OAAO,OAAO,CAAC;AAAA,IAC3H;AAAA,IACA,UAAU,CAAC,UAAkB,oBAAsC,aAAa,QAAQ,UAAU,eAAe;AAAA,EACnH,CAAC;AACD,SAAO;AACT;AAGO,IAAM,WAAW,CAAC,UAAkB,QAAgB,YACzD,OAAO,SAAS,UAAU,OAAO;","names":["require"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@virastack/password",
-  "version": "1.0.2",
-  "description": "Fully accessible and customizable password visibility hook for React.",
+  "version": "1.1.0",
+  "description": "Accessible password hook for React: visibility, NIST-style strength, confirmation, server validation and leaked password checks.",
   "author": {
     "name": "Ömer Gülçiçek (ViraStack)",
     "email": "iletisim@omergulcicek.com",
@@ -16,15 +16,52 @@
   "bugs": {
     "url": "https://github.com/virastack/password/issues"
   },
-  "main": "./dist/index.js",
+  "type": "commonjs",
+  "main": "./dist/index.cjs",
   "module": "./dist/index.mjs",
-  "types": "./dist/index.d.ts",
+  "types": "./dist/index.d.cts",
   "exports": {
     ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.mjs",
-      "require": "./dist/index.js"
-    }
+      "import": {
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    },
+    "./strength": {
+      "import": {
+        "types": "./dist/strength.d.mts",
+        "default": "./dist/strength.mjs"
+      },
+      "require": {
+        "types": "./dist/strength.d.cts",
+        "default": "./dist/strength.cjs"
+      }
+    },
+    "./server": {
+      "import": {
+        "types": "./dist/server.d.mts",
+        "default": "./dist/server.mjs"
+      },
+      "require": {
+        "types": "./dist/server.d.cts",
+        "default": "./dist/server.cjs"
+      }
+    },
+    "./pwned": {
+      "import": {
+        "types": "./dist/pwned.d.mts",
+        "default": "./dist/pwned.mjs"
+      },
+      "require": {
+        "types": "./dist/pwned.d.cts",
+        "default": "./dist/pwned.cjs"
+      }
+    },
+    "./package.json": "./package.json"
   },
   "files": [
     "dist"
@@ -37,10 +74,19 @@
     "node": ">=18"
   },
   "scripts": {
-    "build": "tsup",
+    "build": "tsup && node scripts/cjs-types.mjs",
     "dev": "tsup --watch",
-    "test": "vitest",
-    "lint": "tsc"
+    "test": "vitest run --project unit",
+    "test:watch": "vitest --project unit",
+    "test:coverage": "vitest run --project unit --coverage",
+    "test:browser": "vitest run --project browser",
+    "typecheck": "tsc -p .",
+    "lint": "eslint .",
+    "size": "size-limit",
+    "check:package": "publint --strict && attw --pack . --profile node16 && node scripts/check-dist.mjs",
+    "check": "pnpm typecheck && pnpm lint && pnpm test:coverage && pnpm build && pnpm check:package && pnpm size",
+    "prepublishOnly": "pnpm check",
+    "e2e:next": "node e2e/nextjs/run.mjs"
   },
   "keywords": [
     "virastack",
@@ -48,9 +94,16 @@
     "hook",
     "password",
     "password-visibility",
+    "password-strength",
+    "password-confirmation",
+    "nist",
+    "have-i-been-pwned",
+    "react-hook-form",
+    "server-actions",
     "accessibility",
     "a11y",
     "form-validation",
+    "typescript",
     "dx"
   ],
   "peerDependencies": {
@@ -58,15 +111,78 @@
     "react-dom": ">=18.2.0"
   },
   "devDependencies": {
-    "@testing-library/jest-dom": "^6.4.2",
-    "@testing-library/react": "^14.2.1",
-    "@types/react": "^18.2.64",
-    "@types/react-dom": "^18.2.21",
-    "jsdom": "^24.0.0",
-    "react": "^18.2.0",
-    "react-dom": "^18.2.0",
-    "tsup": "^8.0.2",
-    "typescript": "^5.3.3",
-    "vitest": "^1.3.1"
+    "@arethetypeswrong/cli": "^0.18.5",
+    "@eslint/js": "^10.0.1",
+    "@hookform/resolvers": "^6.0.0",
+    "@size-limit/preset-small-lib": "^14.3.0",
+    "@testing-library/jest-dom": "^7.0.1",
+    "@testing-library/react": "^16.3.3",
+    "@testing-library/user-event": "^14.6.8",
+    "@types/node": "^22.20.5",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "@vitest/browser-playwright": "5.0.5",
+    "@vitest/coverage-v8": "5.0.5",
+    "eslint": "^10.13.0",
+    "fast-check": "^4.10.2",
+    "jsdom": "^30.1.3",
+    "playwright": "^1.64.1",
+    "publint": "^0.3.25",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
+    "react-hook-form": "^7.91.0",
+    "size-limit": "^14.3.0",
+    "tsup": "^9.0.0",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.72.0",
+    "vite": "^8.3.5",
+    "vitest": "^5.0.5",
+    "vitest-browser-react": "^2.3.0",
+    "zod": "^4.6.7"
+  },
+  "size-limit": [
+    {
+      "name": "@virastack/password",
+      "path": "dist/index.mjs",
+      "import": "*",
+      "limit": "2.5 kB",
+      "ignore": [
+        "react",
+        "react-dom"
+      ]
+    },
+    {
+      "name": "@virastack/password (toggle only)",
+      "path": "dist/index.mjs",
+      "import": "{ useViraPassword }",
+      "limit": "2.5 kB",
+      "ignore": [
+        "react",
+        "react-dom"
+      ]
+    },
+    {
+      "name": "@virastack/password/strength",
+      "path": "dist/strength.mjs",
+      "import": "*",
+      "limit": "3 kB"
+    },
+    {
+      "name": "@virastack/password/server",
+      "path": "dist/server.mjs",
+      "import": "*",
+      "limit": "3 kB"
+    },
+    {
+      "name": "@virastack/password/pwned",
+      "path": "dist/pwned.mjs",
+      "import": "*",
+      "limit": "1 kB"
+    }
+  ],
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "esbuild"
+    ]
   }
 }