stimeo-ui 0.16.0 → 0.18.0

package/dist/controllers/password_strength_controller.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/announce.ts","../../src/utils/before_cache_reset.ts","../../src/utils/coerce.ts","../../src/utils/microtask_coalescer.ts","../../src/utils/safe_timeout.ts","../../src/utils/string_list.ts","../../src/controllers/password_strength_controller.ts"],"names":[],"mappings":";;;;;AAoBO,SAAS,QAAA,CAAS,OAAA,EAAiB,OAAA,GAAmC,EAAC,EAAS;AACrF,EAAA,MAAM,IAAA,GAAO,QAAQ,IAAA,EAAK;AAC1B,EAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG;AACvB,EAAA,MAAA,CAAO,aAAA;AAAA,IACL,IAAI,YAAY,4BAAA,EAA8B;AAAA,MAC5C,QAAQ,EAAE,OAAA,EAAS,MAAM,SAAA,EAAW,OAAA,CAAQ,cAAc,IAAA;AAAK,KAChE;AAAA,GACH;AACF;AAUO,SAAS,YAAA,CAAa,UAAkB,MAAA,EAAiD;AAC9F,EAAA,OAAO,QAAA,CAAS,OAAA,CAAQ,6BAAA,EAA+B,CAAC,OAAO,IAAA,KAAiB;AAC9E,IAAA,MAAM,WAAA,GAAc,OAAO,IAAI,CAAA;AAC/B,IAAA,OAAO,WAAA,KAAgB,MAAA,GAAY,KAAA,GAAQ,MAAA,CAAO,WAAW,CAAA;AAAA,EAC/D,CAAC,CAAA;AACH;;;ACAO,IAAM,gBAAA,GAAN,MAAM,iBAAA,CAAiB;AAAA;AAAA,EAE5B,OAAgB,YAAA,mBAAe,IAAI,GAAA,EAAsB;AAAA;AAAA,EAGzD,OAAgB,iBAAiB,MAAY;AAC3C,IAAA,KAAA,MAAW,UAAA,IAAc,iBAAA,CAAiB,YAAA,EAAc,UAAA,CAAW,OAAA,EAAQ;AAAA,EAC7E,CAAA;AAAA,EAES,OAAA;AAAA;AAAA,EAGT,YAAY,MAAA,EAAoB;AAC9B,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AAAA,EACjB;AAAA;AAAA,EAGA,QAAA,GAAiB;AACf,IAAA,MAAM,KAAA,GAAQ,iBAAA,CAAiB,YAAA,CAAa,IAAA,KAAS,CAAA;AACrD,IAAA,iBAAA,CAAiB,YAAA,CAAa,IAAI,IAAI,CAAA;AACtC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,QAAA,CAAS,gBAAA,CAAiB,oBAAA,EAAsB,iBAAA,CAAiB,cAAc,CAAA;AAAA,IACjF;AAAA,EACF;AAAA;AAAA,EAGA,UAAA,GAAmB;AACjB,IAAA,iBAAA,CAAiB,YAAA,CAAa,OAAO,IAAI,CAAA;AACzC,IAAA,IAAI,iBAAA,CAAiB,YAAA,CAAa,IAAA,GAAO,CAAA,EAAG;AAC5C,IAAA,QAAA,CAAS,mBAAA,CAAoB,oBAAA,EAAsB,iBAAA,CAAiB,cAAc,CAAA;AAAA,EACpF;AACF,CAAA;;;AC3DO,SAAS,eAAe,GAAA,EAAwD;AACrF,EAAA,IAAI,QAAQ,IAAA,IAAQ,GAAA,KAAQ,MAAA,IAAa,GAAA,KAAQ,IAAI,OAAO,IAAA;AAC5D,EAAA,MAAM,QAAQ,OAAO,GAAA,KAAQ,QAAA,GAAW,GAAA,GAAM,OAAO,GAAG,CAAA;AACxD,EAAA,OAAO,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,GAAI,KAAA,GAAQ,IAAA;AAC1C;;;ACkCO,IAAM,qBAAN,MAAyB;AAAA,EACrB,IAAA;AAAA,EACT,OAAA,GAAU,KAAA;AAAA,EACV,OAAA,GAAU,KAAA;AAAA,EACV,WAAA,GAAc,CAAA;AAAA;AAAA,EAGd,YAAY,GAAA,EAAiB;AAC3B,IAAA,IAAA,CAAK,IAAA,GAAO,GAAA;AAAA,EACd;AAAA;AAAA,EAGA,QAAA,GAAiB;AACf,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA;AAAA,EACjB;AAAA;AAAA,EAGA,MAAA,GAAe;AACb,IAAA,IAAA,CAAK,OAAA,GAAU,KAAA;AACf,IAAA,IAAA,CAAK,OAAA,GAAU,KAAA;AACf,IAAA,IAAA,CAAK,WAAA,IAAe,CAAA;AAAA,EACtB;AAAA;AAAA,EAGA,QAAA,GAAiB;AACf,IAAA,IAAI,CAAC,IAAA,CAAK,OAAA,IAAW,IAAA,CAAK,OAAA,EAAS;AACnC,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA;AACf,IAAA,MAAM,aAAa,IAAA,CAAK,WAAA;AACxB,IAAA,cAAA,CAAe,MAAM;AAEnB,MAAA,IAAI,UAAA,KAAe,KAAK,WAAA,IAAe,CAAC,KAAK,OAAA,IAAW,CAAC,KAAK,OAAA,EAAS;AACvE,MAAA,IAAA,CAAK,OAAA,GAAU,KAAA;AACf,MAAA,IAAA,CAAK,IAAA,EAAK;AAAA,IACZ,CAAC,CAAA;AAAA,EACH;AACF,CAAA;;;ACxDA,IAAe,gBAAf,MAA6B;AAAA;AAAA,EAER,GAAA,uBAAU,GAAA,EAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAczC,MAAM,EAAA,EAAkB;AACtB,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA,EAAG;AACvB,MAAA,IAAA,CAAK,OAAO,EAAE,CAAA;AAAA,IAChB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAA,GAAiB;AACf,IAAA,KAAA,MAAW,EAAA,IAAM,KAAK,GAAA,EAAK;AACzB,MAAA,IAAA,CAAK,OAAO,EAAE,CAAA;AAAA,IAChB;AACA,IAAA,IAAA,CAAK,IAAI,KAAA,EAAM;AAAA,EACjB;AAAA;AAAA,EAGA,IAAI,IAAA,GAAe;AACjB,IAAA,OAAO,KAAK,GAAA,CAAI,IAAA;AAAA,EAClB;AACF,CAAA;AAmBO,IAAM,WAAA,GAAN,cAA0B,aAAA,CAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO7C,GAAA,CAAI,UAAsB,KAAA,EAAuB;AAC/C,IAAA,MAAM,EAAA,GAAK,IAAA,CAAK,QAAA,CAAS,MAAM;AAC7B,MAAA,IAAA,CAAK,GAAA,CAAI,OAAO,EAAE,CAAA;AAClB,MAAA,QAAA,EAAS;AAAA,IACX,GAAG,KAAK,CAAA;AACR,IAAA,IAAA,CAAK,GAAA,CAAI,IAAI,EAAE,CAAA;AACf,IAAA,OAAO,EAAA;AAAA,EACT;AAAA,EAEU,QAAA,CAAS,UAAsB,KAAA,EAAuB;AAC9D,IAAA,OAAO,MAAA,CAAO,UAAA,CAAW,QAAA,EAAU,KAAK,CAAA;AAAA,EAC1C;AAAA,EAEU,OAAO,EAAA,EAAkB;AACjC,IAAA,MAAA,CAAO,aAAa,EAAE,CAAA;AAAA,EACxB;AACF,CAAA;;;AChFO,SAAS,eAAA,CAAgB,GAAA,EAAa,QAAA,GAA8B,EAAC,EAAa;AAIvF,EAAA,MAAM,IAAA,GAAO,IAAI,IAAA,EAAK;AACtB,EAAA,IAAI,KAAK,MAAA,KAAW,CAAA,EAAG,OAAO,CAAC,GAAG,QAAQ,CAAA;AAE1C,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,CAAC,GAAG,QAAQ,CAAA;AAAA,EACrB;AAEA,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,MAAM,GAAG,OAAO,CAAC,GAAG,QAAQ,CAAA;AAC/C,EAAA,OAAO,OAAO,MAAA,CAAO,CAAC,KAAA,KAA2B,OAAO,UAAU,QAAQ,CAAA;AAC5E;;;ACfA,IAAM,cAAA,GAAoC,CAAC,OAAA,EAAS,OAAA,EAAS,SAAS,cAAc,CAAA;AAGpF,IAAM,cAAA,GAAiB,CAAC,MAAA,EAAQ,MAAA,EAAQ,QAAQ,QAAQ,CAAA;AAGxD,IAAM,iBAAA,GAAuC,CAAC,CAAA,EAAG,EAAA,EAAI,EAAE,CAAA;AAGvD,IAAM,UAAA,GAAa,iBAAA,CAAkB,MAAA,IAAU,cAAA,CAAe,MAAA,GAAS,CAAA,CAAA;AAQvE,IAAM,cAAA,GAAiB,CAAC,MAAA,EAAQ,MAAA,EAAQ,QAAQ,QAAQ,CAAA;AAQxD,IAAM,UAAA,GAAa,CAAA;AAiDZ,IAAM,0BAAA,GAAN,MAAM,2BAAA,SAAmC,UAAA,CAAwB;AAAA,EACtE,OAAgB,OAAA,GAAU,CAAC,OAAA,EAAS,SAAS,OAAO,CAAA;AAAA,EACpD,OAAgB,MAAA,GAAS;AAAA,IACvB,QAAA,EAAU,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,CAAA,EAAE;AAAA;AAAA;AAAA;AAAA,IAIrC,MAAA,EAAQ,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,EAAA,EAAG;AAAA,IACpC,YAAA,EAAc,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,EAAA;AAAG,GAC5C;AAAA,EACA,OAAO,OAAA,GAAU,CAAC,UAAA,EAAY,UAAU,CAAA;AAAA,EACxC,OAAO,MAAA,GAAS,CAAC,QAAA,EAAU,WAAW,CAAA;AAAA;AAAA,EActC,OAAgB,cAAA,GAAiB,GAAA;AAAA,EAExB,OAAA,GAAU,IAAI,WAAA,EAAY;AAAA,EAC1B,eAAe,IAAI,gBAAA,CAAiB,MAAM,IAAA,CAAK,iBAAiB,CAAA;AAAA,EAChE,WAAW,IAAI,kBAAA,CAAmB,MAAM,IAAA,CAAK,YAAY,CAAA;AAAA,EAClE,OAAA,GAAoB,CAAC,GAAG,cAAc,CAAA;AAAA,EACtC,WAAA,GAA6B,IAAA;AAAA,EAC7B,eAAA,GAAiC,IAAA;AAAA,EACjC,cAAA,GAAgC,IAAA;AAAA,EAChC,WAAA,GAA6C,IAAA;AAAA;AAAA,EAGpC,OAAA,GAAgB;AACvB,IAAA,IAAA,CAAK,SAAS,QAAA,EAAS;AACvB,IAAA,IAAA,CAAK,aAAa,QAAA,EAAS;AAI3B,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,SAAS,CAAA;AAAA,EAChD;AAAA;AAAA,EAGS,UAAA,GAAmB;AAC1B,IAAA,IAAA,CAAK,SAAS,MAAA,EAAO;AACrB,IAAA,IAAA,CAAK,aAAa,UAAA,EAAW;AAC7B,IAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,IAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AACtB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,EACrB;AAAA;AAAA,EAGA,QAAA,GAAiB;AACf,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AACtB,IAAA,IAAA,CAAK,OAAA,EAAQ;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,SAAS,KAAA,EAA4B;AACnC,IAAA,MAAM,OAAO,cAAA,CAAe,KAAA,CAAM,QAAQ,KAAA,IAAS,KAAA,CAAM,QAAQ,KAAK,CAAA;AACtE,IAAA,IAAI,SAAS,IAAA,EAAM;AACnB,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AACtB,IAAA,IAAA,CAAK,OAAA,EAAQ;AAAA,EACf;AAAA;AAAA,EAGA,kBAAA,GAA2B;AACzB,IAAA,IAAA,CAAK,OAAA,GAAU,KAAK,WAAA,EAAY;AAChC,IAAA,IAAA,CAAK,SAAS,QAAA,EAAS;AAAA,EACzB;AAAA;AAAA,EAGA,oBAAA,GAA6B;AAC3B,IAAA,IAAA,CAAK,SAAS,QAAA,EAAS;AAAA,EACzB;AAAA;AAAA,EAGA,wBAAA,GAAiC;AAC/B,IAAA,IAAA,CAAK,SAAS,QAAA,EAAS;AAAA,EACzB;AAAA;AAAA,EAGA,oBAAA,GAA6B;AAC3B,IAAA,IAAA,CAAK,SAAS,QAAA,EAAS;AAAA,EACzB;AAAA;AAAA,EAGA,uBAAA,GAAgC;AAC9B,IAAA,IAAA,CAAK,SAAS,QAAA,EAAS;AAAA,EACzB;AAAA;AAAA,EAGA,oBAAA,GAA6B;AAC3B,IAAA,IAAA,CAAK,SAAS,QAAA,EAAS;AAAA,EACzB;AAAA;AAAA,EAGA,uBAAA,GAAgC;AAC9B,IAAA,IAAA,CAAK,SAAS,QAAA,EAAS;AAAA,EACzB;AAAA;AAAA,EAGA,oBAAA,GAA6B;AAC3B,IAAA,IAAA,CAAK,SAAS,QAAA,EAAS;AAAA,EACzB;AAAA;AAAA,EAGA,uBAAA,GAAgC;AAC9B,IAAA,IAAA,CAAK,SAAS,QAAA,EAAS;AAAA,EACzB;AAAA;AAAA,EAGA,OAAA,GAAgB;AACd,IAAA,MAAM,OAAA,GAAU,KAAK,OAAA,EAAQ;AAC7B,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,OAAA,CAAQ,OAAO,CAAA;AACvC,IAAA,IAAA,CAAK,SAAS,QAAA,EAAU,EAAE,MAAA,EAAQ,IAAA,CAAK,aAAa,CAAA;AACpD,IAAA,IAAA,CAAK,sBAAsB,OAAO,CAAA;AAAA,EACpC;AAAA;AAAA,EAGA,UAAA,GAAmB;AACjB,IAAA,MAAM,WAAW,IAAA,CAAK,WAAA;AAMtB,IAAA,MAAM,IAAA,GAAO,KAAK,WAAA,KAAgB,IAAA;AAClC,IAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,IAAA,MAAM,OAAA,GAAU,KAAK,OAAA,EAAQ;AAC7B,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,OAAO,CAAA;AACnC,IAAA,IAAA,CAAK,WAAA,GAAc,MAAA;AAGnB,IAAA,IAAI,OAAA,CAAQ,KAAA,KAAU,CAAA,EAAG,IAAA,CAAK,eAAA,GAAkB,IAAA;AAChD,IAAA,IAAI,IAAA,EAAM,IAAA,CAAK,qBAAA,CAAsB,OAAO,CAAA;AAC5C,IAAA,IAAI,QAAA,IAAY,IAAA,CAAK,cAAA,CAAe,QAAA,EAAU,MAAM,CAAA,EAAG;AACrD,MAAA,IAAA,CAAK,QAAA,CAAS,WAAA,EAAa,EAAE,MAAA,EAAQ,CAAA;AAAA,IACvC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAA,GAA2B;AACzB,IAAA,MAAM,GAAA,GAAM,KAAK,OAAA,CAAQ,MAAA;AACzB,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,aAAA,CAAc,GAAG,CAAA;AACpC,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,KAAA,GAAQ,CAAC,CAAA,IAAK,EAAA;AACzC,IAAA,MAAM,QAAA,GAAW,KAAA,GAAQ,CAAA,IAAK,KAAA,IAAS,IAAA,CAAK,SAAA;AAC5C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,KAAA,EAAO,GAAG,CAAA;AAElC,IAAA,IAAA,CAAK,aAAA,CAAc,OAAO,GAAG,CAAA;AAC7B,IAAA,IAAA,CAAK,YAAA,CAAa,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM,QAAQ,CAAA;AAC5C,IAAA,IAAA,CAAK,YAAY,KAAK,CAAA;AACtB,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,GAAA,EAAK,UAAU,IAAA,EAAK;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,IAAI,SAAA,GAAoB;AACtB,IAAA,OAAO,OAAO,QAAA,CAAS,IAAA,CAAK,aAAa,CAAA,GAAI,KAAK,aAAA,GAAgB,CAAA;AAAA,EACpE;AAAA;AAAA,EAGA,cAAc,GAAA,EAAqB;AACjC,IAAA,IAAI,IAAA,CAAK,mBAAmB,IAAA,EAAM;AAChC,MAAA,OAAO,IAAA,CAAK,GAAA,CAAI,GAAA,EAAK,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,cAAc,CAAC,CAAC,CAAA;AAAA,IACnE;AACA,IAAA,OAAO,IAAA,CAAK,OAAO,IAAA,CAAK,cAAA,GAAiB,KAAK,WAAA,CAAY,KAAA,GAAQ,IAAI,GAAG,CAAA;AAAA,EAC3E;AAAA;AAAA,EAGA,aAAA,CAAc,OAAe,GAAA,EAAmB;AAC9C,IAAA,IAAI,CAAC,KAAK,cAAA,EAAgB;AAC1B,IAAA,IAAA,CAAK,WAAA,CAAY,YAAA,CAAa,eAAA,EAAiB,GAAG,CAAA;AAClD,IAAA,IAAA,CAAK,WAAA,CAAY,YAAA,CAAa,eAAA,EAAiB,MAAA,CAAO,GAAG,CAAC,CAAA;AAC1D,IAAA,IAAA,CAAK,WAAA,CAAY,YAAA,CAAa,eAAA,EAAiB,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,EAC9D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,YAAA,CAAa,KAAA,EAAe,GAAA,EAAa,IAAA,EAAc,QAAA,EAAyB;AAC9E,IAAA,IAAA,CAAK,OAAA,CAAQ,eAAA,EAAiB,IAAA,EAAM,IAAA,CAAK,SAAS,CAAC,CAAA;AAKnD,IAAA,IAAA,CAAK,QAAQ,gBAAA,EAAkB,MAAA,EAAQ,KAAA,GAAQ,CAAA,IAAK,CAAC,QAAQ,CAAA;AAC7D,IAAA,IAAA,CAAK,QAAQ,KAAA,CAAM,WAAA,CAAY,+BAA+B,MAAA,CAAO,KAAA,GAAQ,GAAG,CAAC,CAAA;AAAA,EACnF;AAAA;AAAA,EAGA,YAAY,IAAA,EAAoB;AAC9B,IAAA,IAAI,CAAC,IAAA,CAAK,cAAA,IAAkB,IAAA,CAAK,WAAA,CAAY,gBAAgB,IAAA,EAAM;AACnE,IAAA,IAAA,CAAK,YAAY,WAAA,GAAc,IAAA;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,KAAA,CAAM,OAAe,GAAA,EAAqB;AACxC,IAAA,IAAI,KAAA,IAAS,GAAG,OAAO,EAAA;AACvB,IAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,CAAA,CAAQ,KAAA,GAAQ,MAAM,GAAA,GAAM,CAAA,CAAA,IAAO,cAAA,CAAe,MAAA,GAAS,CAAA,CAAE,CAAA;AAGhF,IAAA,OAAO,cAAA,CAAe,KAAK,CAAA,IAAK,cAAA,CAAe,CAAC,CAAA;AAAA,EAClD;AAAA;AAAA,EAGA,OAAA,CAAQ,IAAA,EAAc,KAAA,EAAe,EAAA,EAAmB;AACtD,IAAA,IAAI,EAAA,EAAI;AACN,MAAA,IAAA,CAAK,OAAA,CAAQ,YAAA,CAAa,IAAA,EAAM,KAAK,CAAA;AAAA,IACvC,CAAA,MAAO;AACL,MAAA,IAAA,CAAK,OAAA,CAAQ,gBAAgB,IAAI,CAAA;AAAA,IACnC;AAAA,EACF;AAAA;AAAA,EAGA,WAAA,GAAwB;AACtB,IAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,IAAA,CAAK,WAAA,EAAa,cAAc,CAAA;AACjE,IAAA,OAAO,SAAS,MAAA,IAAU,UAAA,GAAa,QAAA,GAAW,CAAC,GAAG,cAAc,CAAA;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAA,CAAO,UAAkB,GAAA,EAAqB;AAC5C,IAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG,OAAO,CAAA;AAElC,IAAA,IAAI,MAAA,GAAS,CAAA;AACb,IAAA,KAAA,MAAW,aAAa,iBAAA,EAAmB;AACzC,MAAA,IAAI,QAAA,CAAS,MAAA,IAAU,SAAA,EAAW,MAAA,IAAU,CAAA;AAAA,IAC9C;AAEA,IAAA,MAAA,IAAU,cAAA,CAAe,OAAO,CAAC,EAAA,KAAO,GAAG,IAAA,CAAK,QAAQ,CAAC,CAAA,CAAE,MAAA,GAAS,CAAA;AAEpE,IAAA,IAAI,IAAI,GAAA,CAAI,QAAQ,CAAA,CAAE,IAAA,IAAQ,GAAG,MAAA,GAAS,CAAA;AAE1C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAO,MAAA,GAAS,aAAc,GAAG,CAAA;AACvD,IAAA,OAAO,KAAK,GAAA,CAAI,GAAA,EAAK,KAAK,GAAA,CAAI,CAAA,EAAG,QAAQ,CAAC,CAAA;AAAA,EAC5C;AAAA;AAAA,EAGA,sBAAsB,OAAA,EAAgC;AACpD,IAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,IAAA,IAAI,OAAA,CAAQ,UAAU,CAAA,EAAG;AAEvB,MAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,MAAA;AAAA,IACF;AACA,IAAA,IAAI,OAAA,CAAQ,KAAA,KAAU,IAAA,CAAK,eAAA,EAAiB;AAE5C,IAAA,MAAM,OAAA,GAAU,YAAA,CAAa,IAAA,CAAK,iBAAA,EAAmB;AAAA,MACnD,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,KAAK,OAAA,CAAQ,GAAA;AAAA,MACb,MAAM,OAAA,CAAQ;AAAA,KACf,CAAA;AACD,IAAA,IAAI,OAAA,CAAQ,IAAA,EAAK,CAAE,MAAA,KAAW,CAAA,EAAG;AAEjC,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,MAAM;AACxC,MAAA,IAAA,CAAK,kBAAkB,OAAA,CAAQ,KAAA;AAC/B,MAAA,QAAA,CAAS,OAAO,CAAA;AAChB,MAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,IACrB,CAAA,EAAG,4BAA2B,cAAc,CAAA;AAAA,EAC9C;AAAA;AAAA,EAGA,mBAAA,GAA4B;AAC1B,IAAA,IAAI,KAAK,WAAA,KAAgB,IAAA,OAAW,OAAA,CAAQ,KAAA,CAAM,KAAK,WAAW,CAAA;AAClE,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,eAAA,GAAwB;AACtB,IAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,IAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AACtB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AACnB,IAAA,IAAA,CAAK,aAAA,CAAc,CAAA,EAAG,IAAA,CAAK,OAAA,CAAQ,MAAM,CAAA;AACzC,IAAA,IAAA,CAAK,OAAA,CAAQ,eAAA,EAAiB,EAAA,EAAI,KAAK,CAAA;AACvC,IAAA,IAAA,CAAK,OAAA,CAAQ,gBAAA,EAAkB,MAAA,EAAQ,KAAK,CAAA;AAC5C,IAAA,IAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,cAAA,CAAe,6BAA6B,CAAA;AAC/D,IAAA,IAAA,CAAK,YAAY,EAAE,CAAA;AAAA,EACrB;AAAA;AAAA,EAGA,QAAQ,OAAA,EAAkD;AACxD,IAAA,OAAO;AAAA,MACL,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,KAAK,OAAA,CAAQ,GAAA;AAAA,MACb,UAAU,OAAA,CAAQ;AAAA,KACpB;AAAA,EACF;AAAA;AAAA,EAGA,cAAA,CAAe,MAA8B,KAAA,EAAwC;AACnF,IAAA,OACE,IAAA,CAAK,KAAA,KAAU,KAAA,CAAM,KAAA,IACrB,KAAK,KAAA,KAAU,KAAA,CAAM,KAAA,IACrB,IAAA,CAAK,GAAA,KAAQ,KAAA,CAAM,GAAA,IACnB,IAAA,CAAK,aAAa,KAAA,CAAM,QAAA;AAAA,EAE5B;AACF","file":"password_strength_controller.js","sourcesContent":["/**\n * Sends one message to the page's shared `stimeo--announcer`.\n *\n * A component that has to reach assistive tech does not carry a live region of its\n * own: a region only announces what changes *after* assistive tech already knows\n * about it, which a region that appears (or is un-hidden) with its message cannot\n * satisfy. The one region that can is the announcer sitting in the page from the\n * start, so state changes are handed to it as an event and it does the reading.\n *\n * The event goes to `window` because the announcer is usually a sibling high in the\n * document rather than an ancestor of the component dispatching it.\n *\n * Wording comes from the consumer — the library ships no English strings — so an\n * empty message is silently dropped and nothing is announced.\n *\n * @example\n * ```ts\n * announce(this.announceTextValue, { assertive: false });\n * ```\n */\nexport function announce(message: string, options: { assertive?: boolean } = {}): void {\n  const text = message.trim();\n  if (text.length === 0) return;\n  window.dispatchEvent(\n    new CustomEvent(\"stimeo--announcer:announce\", {\n      detail: { message: text, assertive: options.assertive === true },\n    }),\n  );\n}\n\n/**\n * Fills `{name}` placeholders in an announcement template from `values`.\n *\n * The same substitution the value-text templates use, so a consumer writes\n * `\"{percent}% complete\"` in one attribute and gets the same rules everywhere. A\n * placeholder with no matching entry is left as authored rather than blanked, which\n * keeps a typo visible instead of silently swallowing the word.\n */\nexport function fillTemplate(template: string, values: Record<string, string | number>): string {\n  return template.replace(/\\{([a-zA-Z][a-zA-Z0-9]*)\\}/g, (match, name: string) => {\n    const replacement = values[name];\n    return replacement === undefined ? match : String(replacement);\n  });\n}\n","/**\n * Runs a controller's \"return to the initial state\" pass just before Turbo\n * caches the page.\n *\n * **`disconnect()` cannot do this job, for two independent reasons.** Turbo\n * queues the clone from this event rather than taking it here, and the body swap\n * that runs the controller's `disconnect()` is queued separately — so which of\n * the two lands first is not something a controller can rely on, and a rewind\n * written in `disconnect()` may reach only the DOM being thrown away. In the\n * other direction, `disconnect()` also fires on an in-page move (Stimulus tears\n * down and reconnects the same element), where rewinding would wipe a\n * legitimately in-progress interaction — a spinner mid-load would vanish. One\n * timing is unreliable, the other is too eager; `turbo:before-cache` is the only\n * point that is exactly \"the page is about to be frozen\".\n *\n * Scope is the subscription only: registering on `activate()`, unregistering on\n * `deactivate()`, and one shared document listener no matter how many instances\n * are live. *What* to return to its initial state — which `data-state`, which\n * `hidden`, which `aria-busy` — stays in the controller, because no two\n * consumers answer it the same way.\n *\n * **Rewind state, not appearance.** The pass writes attributes the controller\n * itself owns; the visual result of those attributes is the consumer's CSS, and\n * a library that reached for style or class names would be guessing at markup\n * it does not own.\n *\n * Both entry points are idempotent, so the lifecycle hooks can call them\n * unconditionally: a second `activate()` does not double-subscribe and does not\n * make the callback run twice, and `deactivate()` on an instance that never\n * subscribed is a no-op.\n *\n * This file's own doc block is dropped from `dist`, but every member comment is\n * inlined into each consumer entry (`tsup` builds with `splitting: false`), so\n * rationale belongs here and only the contract belongs on the members.\n *\n * @example\n * ```ts\n * readonly #beforeCache = new BeforeCacheReset(() => this.#rewind());\n *\n * connect()    { this.#beforeCache.activate(); }\n * disconnect() { this.#beforeCache.deactivate(); }\n * ```\n */\nexport class BeforeCacheReset {\n  /** Every subscribed instance, iterated by the one shared document listener. */\n  static readonly #subscribers = new Set<BeforeCacheReset>();\n\n  /** The shared listener; installed while at least one instance is subscribed. */\n  static readonly #onBeforeCache = (): void => {\n    for (const subscriber of BeforeCacheReset.#subscribers) subscriber.#rewind();\n  };\n\n  readonly #rewind: () => void;\n\n  /** @param rewind - the pass that returns this controller's state to its initial form. */\n  constructor(rewind: () => void) {\n    this.#rewind = rewind;\n  }\n\n  /** Subscribes to `turbo:before-cache`; call from `connect()`. Idempotent. */\n  activate(): void {\n    const first = BeforeCacheReset.#subscribers.size === 0;\n    BeforeCacheReset.#subscribers.add(this);\n    if (first) {\n      document.addEventListener(\"turbo:before-cache\", BeforeCacheReset.#onBeforeCache);\n    }\n  }\n\n  /** Unsubscribes; call from `disconnect()`. Safe when never subscribed. */\n  deactivate(): void {\n    BeforeCacheReset.#subscribers.delete(this);\n    if (BeforeCacheReset.#subscribers.size > 0) return;\n    document.removeEventListener(\"turbo:before-cache\", BeforeCacheReset.#onBeforeCache);\n  }\n}\n","/**\n * Numeric coercion for controllers that accept a number through a Value, an action\n * param, or an event detail.\n *\n * Stimulus already coerces numeric action params to numbers, but a value can also\n * arrive as a string — via a `*:set` CustomEvent `detail`, or an action param\n * whose attribute does not look numeric. Centralizing the parse keeps `setValue`\n * tolerant of either form while rejecting anything that is not a finite number.\n */\n\n/**\n * Coerces `raw` to a finite number, or returns `null` when it is absent, empty,\n * or not parseable. Empty strings are treated as \"no value\" rather than `0`, so a\n * stray blank param cannot silently reset the value.\n */\nexport function toFiniteNumber(raw: number | string | null | undefined): number | null {\n  if (raw === null || raw === undefined || raw === \"\") return null;\n  const value = typeof raw === \"number\" ? raw : Number(raw);\n  return Number.isFinite(value) ? value : null;\n}\n","/**\n * Collapses many Stimulus lifecycle callbacks from one DOM mutation into a\n * single pass.\n *\n * Stimulus fires `<name>TargetConnected` / `Disconnected` once per element and\n * `<name>ValueChanged` once per changed attribute. Replacing a list of N options\n * or morphing several render Values therefore delivers N callbacks — but the\n * useful unit of work is \"reconcile against the resulting declarative input\",\n * once, after the batch has settled. Every controller with reconcilable targets\n * or render Values needs the same shape: a `queued` flag plus `queueMicrotask`.\n *\n * **A microtask is the right horizon, and the reason is specific.** Stimulus\n * drives these callbacks from a `MutationObserver`, whose own callback already\n * runs as a microtask with the whole batch in hand; scheduling one more lands\n * after the last sibling callback of that batch and still before paint or any\n * event handler. A timer would be later than it needs to be, and reconciling\n * synchronously would run once per element against a half-applied DOM.\n *\n * **The two guards are not the same guard.** Scheduling is refused before the\n * controller connects, and running is refused after it disconnects:\n *\n * - **Before `connect()`** — Stimulus delivers initial target and Value callbacks\n *   ahead of `connect()`. Reconciling there would compute output against a\n *   controller whose own state has not been initialised, and `connect()` is\n *   about to do a full pass anyway.\n * - **After `disconnect()`** — Stimulus fires a callback for **every** target\n *   during teardown, and a microtask queued just before it would otherwise run\n *   against a detached tree. {@link MicrotaskCoalescer.cancel} exists for the\n *   teardown path to drop the pending pass outright.\n *\n * Both guards are part of one contract here rather than something each consumer\n * has to remember separately.\n *\n * Scope is the scheduling only. *What* to reconcile — keep the surviving active\n * option, fall back to the next / previous / first visible one, rebuild derived\n * chips or hidden fields — stays in the controller, because no two consumers\n * answer it the same way.\n *\n * This file's own doc block is dropped from `dist`, but every member comment is\n * inlined into each consumer entry (`tsup` builds with `splitting: false`), so\n * rationale belongs here and only the contract belongs on the members.\n *\n * @example\n * ```ts\n * readonly #reconcile = new MicrotaskCoalescer(() => this.#reconcileOptions());\n *\n * connect()    { this.#reconcile.activate(); }\n * disconnect() { this.#reconcile.cancel(); }\n *\n * optionTargetConnected()    { this.#reconcile.schedule(); }\n * optionTargetDisconnected() { this.#reconcile.schedule(); }\n * ```\n */\nexport class MicrotaskCoalescer {\n  readonly #run: () => void;\n  #queued = false;\n  #active = false;\n  #generation = 0;\n\n  /** @param run - the single reconciliation pass, invoked at most once per batch. */\n  constructor(run: () => void) {\n    this.#run = run;\n  }\n\n  /** Opens the window in which {@link schedule} is honoured; call from `connect()`. */\n  activate(): void {\n    this.#active = true;\n  }\n\n  /** Closes the window and drops any pending pass; call from `disconnect()`. */\n  cancel(): void {\n    this.#active = false;\n    this.#queued = false;\n    this.#generation += 1;\n  }\n\n  /** Requests one pass after the batch settles. Idempotent; inert outside the window. */\n  schedule(): void {\n    if (!this.#active || this.#queued) return;\n    this.#queued = true;\n    const generation = this.#generation;\n    queueMicrotask(() => {\n      // A cancelled callback must not consume a pass queued after reconnect.\n      if (generation !== this.#generation || !this.#queued || !this.#active) return;\n      this.#queued = false;\n      this.#run();\n    });\n  }\n}\n","/**\n * Self-cleaning timer registries shared by Stimeo controllers.\n *\n * Stimulus controllers frequently schedule `setTimeout` / `setInterval` work\n * (auto-dismiss, debouncing, polling). When the element leaves the DOM — a\n * Turbo Drive navigation, a Turbo Stream replacement, or any `disconnect()` —\n * orphaned timers keep firing against a detached controller, leaking memory and\n * mutating stale state. {@link SafeTimeout} and {@link SafeInterval} track every\n * timer they create so a single {@link TimerRegistry.clearAll | clearAll()} call\n * in `disconnect()` tears them all down.\n *\n * These are intentionally low-level primitives: they own *registration and\n * cleanup only*. Higher-level policy (pause/resume, remaining-time accounting)\n * stays in the individual controllers so per-widget semantics are not flattened\n * into a lowest-common-denominator helper.\n */\n\n/**\n * Largest delay a timer can hold: the platform stores it in a 32-bit signed\n * integer, and anything larger overflows to `1`, so a delay meant to be far in\n * the future fires almost immediately. A declared delay above this bound names\n * no delay at all, and a controller reading one falls back to its default.\n */\nexport const MAX_TIMER_DELAY_MS = 2_147_483_647;\n\n/**\n * Shared registry bookkeeping for the timeout/interval variants.\n *\n * Subclasses provide the scheduling primitive ({@link schedule}) and its matching\n * canceller ({@link cancel}); this base owns the set of live ids plus the\n * per-id and bulk teardown shared by both.\n */\nabstract class TimerRegistry {\n  /** Live timer ids that have not yet been cleared (or, for timeouts, fired). */\n  protected readonly ids = new Set<number>();\n\n  /** Schedules the underlying platform timer and returns its id. */\n  protected abstract schedule(callback: () => void, delay: number): number;\n\n  /** Cancels the underlying platform timer for `id`. */\n  protected abstract cancel(id: number): void;\n\n  /**\n   * Cancels a single tracked timer.\n   *\n   * No-ops if the id is unknown (already cleared, fired, or never owned by this\n   * registry), so callers can clear defensively without guarding.\n   */\n  clear(id: number): void {\n    if (this.ids.delete(id)) {\n      this.cancel(id);\n    }\n  }\n\n  /**\n   * Cancels every tracked timer. Call this from a controller's `disconnect()`\n   * to guarantee no timer outlives the element.\n   */\n  clearAll(): void {\n    for (const id of this.ids) {\n      this.cancel(id);\n    }\n    this.ids.clear();\n  }\n\n  /** Number of timers currently tracked (pending). */\n  get size(): number {\n    return this.ids.size;\n  }\n}\n\n/**\n * `setTimeout` wrapper that auto-forgets each timer once it fires and supports\n * bulk teardown on disconnect.\n *\n * @example\n * ```ts\n * #timers = new SafeTimeout();\n *\n * connect() {\n *   this.#timers.set(() => this.dismiss(), 5000);\n * }\n *\n * disconnect() {\n *   this.#timers.clearAll();\n * }\n * ```\n */\nexport class SafeTimeout extends TimerRegistry {\n  /**\n   * Schedules `callback` after `delay` ms and returns the timer id.\n   *\n   * The id is removed from the registry automatically when the timeout fires,\n   * so {@link TimerRegistry.size | size} reflects only still-pending timers.\n   */\n  set(callback: () => void, delay: number): number {\n    const id = this.schedule(() => {\n      this.ids.delete(id);\n      callback();\n    }, delay);\n    this.ids.add(id);\n    return id;\n  }\n\n  protected schedule(callback: () => void, delay: number): number {\n    return window.setTimeout(callback, delay);\n  }\n\n  protected cancel(id: number): void {\n    window.clearTimeout(id);\n  }\n}\n\n/**\n * `setInterval` wrapper that tracks every interval for bulk teardown on\n * disconnect. Unlike {@link SafeTimeout}, intervals are retained until they are\n * explicitly cleared because they fire repeatedly.\n *\n * @example\n * ```ts\n * #intervals = new SafeInterval();\n *\n * connect() {\n *   this.#intervals.set(() => this.tick(), 1000);\n * }\n *\n * disconnect() {\n *   this.#intervals.clearAll();\n * }\n * ```\n */\nexport class SafeInterval extends TimerRegistry {\n  /** Schedules a repeating `callback` every `delay` ms and returns the timer id. */\n  set(callback: () => void, delay: number): number {\n    const id = this.schedule(callback, delay);\n    this.ids.add(id);\n    return id;\n  }\n\n  protected schedule(callback: () => void, delay: number): number {\n    return window.setInterval(callback, delay);\n  }\n\n  protected cancel(id: number): void {\n    window.clearInterval(id);\n  }\n}\n","/**\n * JSON string-list parsing for the controllers that take a list as a Value.\n *\n * Stimulus offers an `Array` Value type, but its reader runs `JSON.parse` inside\n * the value observer — **before** the `<name>ValueChanged` callback — and\n * rethrows on malformed text. The throw propagates out of the observer that runs\n * during connection, so a single unparseable attribute stops the controller from\n * connecting at all: no lifecycle callback runs and the element is left inert\n * rather than degraded. A consumer cannot guard against it either, because the\n * callback that would hold the `try` never runs.\n *\n * Declaring the attribute as a `String` Value and parsing it here keeps a\n * malformed declaration local to the value it declares. The attribute text is\n * identical either way (`'[\"a\", \"b\"]'`), so markup does not change with the\n * declaration.\n */\n\n/**\n * Parses `raw` as a JSON array of strings.\n *\n * Returns `fallback` when the text is absent, unparseable, or not an array, so a\n * malformed declaration behaves like an omitted one. A parsed array keeps only\n * its string entries: every caller indexes or compares strings, and a stray\n * number would otherwise sit in the list without ever matching.\n *\n * An explicit `\"[]\"` is honoured as an empty list rather than falling back — it\n * is the only way to declare \"none\" against a non-empty default.\n *\n * @param raw - the attribute text, e.g. `'[\"password\"]'`.\n * @param fallback - the list to use when `raw` declares nothing usable.\n */\nexport function parseStringList(raw: string, fallback: readonly string[] = []): string[] {\n  // The common case is an undeclared attribute, and `JSON.parse(\"\")` answers it\n  // by throwing. Reaching the same fallback without building an exception keeps\n  // the callers that ask per element off that path.\n  const text = raw.trim();\n  if (text.length === 0) return [...fallback];\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(text);\n  } catch {\n    return [...fallback];\n  }\n\n  if (!Array.isArray(parsed)) return [...fallback];\n  return parsed.filter((entry): entry is string => typeof entry === \"string\");\n}\n","import { Controller } from \"@hotwired/stimulus\";\nimport { announce, fillTemplate } from \"../utils/announce\";\nimport { BeforeCacheReset } from \"../utils/before_cache_reset\";\nimport { toFiniteNumber } from \"../utils/coerce\";\nimport { MicrotaskCoalescer } from \"../utils/microtask_coalescer\";\nimport { SafeTimeout } from \"../utils/safe_timeout\";\nimport { parseStringList } from \"../utils/string_list\";\n\n/**\n * Event shape {@link PasswordStrengthController.setScore} accepts: an action param\n * `score` or a `detail.score`. Both are typed `number | string` because, while\n * Stimulus coerces numeric action params to numbers, a `CustomEvent` (or a\n * non-numeric-looking param) may carry a string.\n */\ntype SetScoreEvent = Event & {\n  params?: { score?: number | string };\n  detail?: { score?: number | string };\n};\n\n/** One scoring pass: the level it lands on plus everything drawn from it. */\ninterface StrengthReading {\n  readonly score: number;\n  readonly level: string;\n  readonly max: number;\n  readonly meetsMin: boolean;\n  readonly band: string;\n}\n\n/** The public derived state `change` and `reconcile` both carry. */\ntype PasswordStrengthDetail = Pick<StrengthReading, \"score\" | \"level\" | \"max\" | \"meetsMin\">;\n\n/** Character classes that contribute to password variety (one point each beyond the first). */\nconst CLASS_PATTERNS: readonly RegExp[] = [/[a-z]/, /[A-Z]/, /[0-9]/, /[^A-Za-z0-9]/];\n\n/** Strength labels used unless the consumer declares its own scale. */\nconst DEFAULT_LEVELS = [\"weak\", \"fair\", \"good\", \"strong\"];\n\n/** Length milestones that each add a strength point. */\nconst LENGTH_MILESTONES: readonly number[] = [8, 12, 16];\n\n/** Upper bound of the raw heuristic points, used to bucket into the level scale. */\nconst MAX_POINTS = LENGTH_MILESTONES.length + (CLASS_PATTERNS.length - 1);\n\n/**\n * Fixed, locale-independent styling bands `data-strength` is drawn from. Kept\n * separate from the (localizable) `levels` labels so `data-strength` stays a\n * stable CSS hook (e.g. `[data-strength=\"weak\"]`) even when `levels` is\n * translated. Ascending: weakest → strongest.\n */\nconst STRENGTH_BANDS = [\"weak\", \"fair\", \"good\", \"strong\"] as const;\n\n/**\n * Fewest labels an ordered scale can carry. One label orders nothing and none\n * leaves the meter a zero-width range, so a shorter declaration resolves to\n * {@link DEFAULT_LEVELS} — which also makes `max >= 2` an invariant every\n * consumer of the scale can rely on.\n */\nconst MIN_LEVELS = 2;\n\n/**\n * Headless password-strength behavior: scores the field with a lightweight\n * zero-dependency heuristic and drives a meter plus a visible level readout. No\n * dedicated APG pattern; the meter display follows {@link MeterController}.\n *\n * Markup contract (identifier: `stimeo--password-strength`):\n *   <div data-controller=\"stimeo--password-strength\"\n *        data-stimeo--password-strength-announce-text-value=\"Password strength: {level}\">\n *     <input type=\"password\" data-stimeo--password-strength-target=\"input\"\n *            data-action=\"input->stimeo--password-strength#evaluate\" aria-describedby=\"pw\">\n *     <div data-stimeo--password-strength-target=\"meter\" role=\"meter\"\n *          aria-label=\"Password strength\" aria-valuemin=\"0\" aria-valuemax=\"4\"></div>\n *     <span id=\"pw\" data-stimeo--password-strength-target=\"label\"></span>\n *   </div>\n *\n * On each input the controller scores the password (length milestones + character\n * variety, capped for trivial repetition), syncs the meter's `aria-valuenow`,\n * reflects a stable band on `data-strength`, the `0–1` fill on\n * `--stimeo--password-strength`, and (when `minScore` is set) `data-below-min`,\n * and writes the level label into the label target.\n *\n * `change` and `reconcile` dispatch `{ score, level, max, meetsMin }`.\n *\n * @remarks\n * Behavior only — the meter/bar look is the consumer's, keyed off the data hooks.\n * `data-strength` is one of the fixed bands `weak` / `fair` / `good` / `strong`\n * (not the localizable\n * `levels` text), so consumers can style by it regardless of locale; the visible\n * label receives the matching `levels` entry. Every visible and non-text output\n * updates on the keystroke that caused it, so the readout never trails the meter.\n *\n * Assistive notification is opt-in and i18n-neutral: `announceText` accepts\n * `{level}`, `{score}`, `{max}` and `{band}`, and one settled message is handed to\n * the page's shared `stimeo--announcer` after a short debounce. Only a level the\n * reader has not already heard is sent, so typing inside one level stays quiet.\n * The label target is plain visible output and is not itself a live region.\n *\n * The score is a pure function of the field value (no module-scope state), so\n * `connect()` re-evaluates idempotently; the initial reflection never dispatches\n * or announces. Runtime Value and target changes repaint on a microtask and\n * dispatch `reconcile` only when the public derived state actually moves. Because\n * the field value is not part of a Turbo snapshot, everything derived from it is\n * rewound on `turbo:before-cache` — silently, since `connect()` derives it again\n * after a restore. The estimator is intentionally not a dictionary/zxcvbn-grade\n * one (kept zero-dep); a consumer that needs a stronger one computes the score\n * itself and hands it over through {@link setScore}.\n */\nexport class PasswordStrengthController extends Controller<HTMLElement> {\n  static override targets = [\"input\", \"meter\", \"label\"];\n  static override values = {\n    minScore: { type: Number, default: 0 },\n    // A JSON list read through `parseStringList` rather than Stimulus's `Array`\n    // type: that reader throws out of the value observer before any callback\n    // runs, so one malformed attribute would stop the meter connecting.\n    levels: { type: String, default: \"\" },\n    announceText: { type: String, default: \"\" },\n  };\n  static actions = [\"evaluate\", \"setScore\"] as const;\n  static events = [\"change\", \"reconcile\"] as const;\n\n  declare readonly inputTarget: HTMLInputElement;\n  declare readonly meterTarget: HTMLElement;\n  declare readonly labelTarget: HTMLElement;\n  declare readonly hasInputTarget: boolean;\n  declare readonly hasMeterTarget: boolean;\n  declare readonly hasLabelTarget: boolean;\n\n  declare minScoreValue: number;\n  declare levelsValue: string;\n  declare announceTextValue: string;\n\n  /** Delay (ms) before one settled level is sent to the shared announcer. */\n  static readonly #announceDelay = 200;\n\n  readonly #timers = new SafeTimeout();\n  readonly #beforeCache = new BeforeCacheReset(() => this.#rewindForCache());\n  readonly #repaint = new MicrotaskCoalescer(() => this.#reconcile());\n  #levels: string[] = [...DEFAULT_LEVELS];\n  #announceId: number | null = null;\n  #announcedLevel: string | null = null;\n  #externalScore: number | null = null;\n  #lastDetail: PasswordStrengthDetail | null = null;\n\n  /** Reflects the current DOM state and opens the reconciliation window. */\n  override connect(): void {\n    this.#repaint.activate();\n    this.#beforeCache.activate();\n    // Reflect the current value synchronously (no event, no announcement): an\n    // autofilled or cache-restored field shows the right strength without\n    // queuing a screen-reader message.\n    this.#lastDetail = this.#detail(this.#render());\n  }\n\n  /** Releases the reconciliation window, the cache subscription and the debounce. */\n  override disconnect(): void {\n    this.#repaint.cancel();\n    this.#beforeCache.deactivate();\n    this.#cancelAnnouncement();\n    this.#announcedLevel = null;\n    this.#externalScore = null;\n    this.#lastDetail = null;\n  }\n\n  /** Re-evaluates strength from the input. Bound via `data-action` (`input`). */\n  evaluate(): void {\n    this.#externalScore = null;\n    this.#commit();\n  }\n\n  /**\n   * Adopts a score computed outside the built-in heuristic, clamped into the\n   * declared scale. An unreadable value leaves the current score standing, and\n   * the next `evaluate` hands scoring back to the heuristic.\n   */\n  setScore(event: SetScoreEvent): void {\n    const next = toFiniteNumber(event.params?.score ?? event.detail?.score);\n    if (next === null) return;\n    this.#externalScore = next;\n    this.#commit();\n  }\n\n  /** Re-reads the scale when application code or a Turbo morph changes `levels`. */\n  levelsValueChanged(): void {\n    this.#levels = this.#readLevels();\n    this.#repaint.schedule();\n  }\n\n  /** Repaints when application code or a Turbo morph changes `minScore`. */\n  minScoreValueChanged(): void {\n    this.#repaint.schedule();\n  }\n\n  /** Repaints when application code or a Turbo morph changes `announceText`. */\n  announceTextValueChanged(): void {\n    this.#repaint.schedule();\n  }\n\n  /** Scores the field added or replaced at runtime. */\n  inputTargetConnected(): void {\n    this.#repaint.schedule();\n  }\n\n  /** Falls back to the pristine state after the scored field is removed. */\n  inputTargetDisconnected(): void {\n    this.#repaint.schedule();\n  }\n\n  /** Syncs a meter added or replaced at runtime, which carries no value yet. */\n  meterTargetConnected(): void {\n    this.#repaint.schedule();\n  }\n\n  /** Repaints the remaining output after a meter is removed. */\n  meterTargetDisconnected(): void {\n    this.#repaint.schedule();\n  }\n\n  /** Fills a readout added or replaced at runtime. */\n  labelTargetConnected(): void {\n    this.#repaint.schedule();\n  }\n\n  /** Repaints the remaining output after a readout is removed. */\n  labelTargetDisconnected(): void {\n    this.#repaint.schedule();\n  }\n\n  /** Reflects one confirmed scoring pass and offers its level to the reader. */\n  #commit(): void {\n    const reading = this.#render();\n    this.#lastDetail = this.#detail(reading);\n    this.dispatch(\"change\", { detail: this.#lastDetail });\n    this.#scheduleAnnouncement(reading);\n  }\n\n  /** Repaints one mutation batch and reports a changed controller-derived state. */\n  #reconcile(): void {\n    const previous = this.#lastDetail;\n    // An edit inside the debounce window has already earned an announcement.\n    // Reconciliation never originates one, but it must not carry a stale one\n    // through either: the pending message is built from the level and the\n    // template that held when it was queued, and both can move here. It is\n    // retargeted at the settled reading so the reader hears what ends up shown.\n    const owed = this.#announceId !== null;\n    this.#cancelAnnouncement();\n    const reading = this.#render();\n    const detail = this.#detail(reading);\n    this.#lastDetail = detail;\n    // A blank readout has no level left to have been heard, here as much as on\n    // the keystroke that empties the field, so the next level typed is news.\n    if (reading.score === 0) this.#announcedLevel = null;\n    if (owed) this.#scheduleAnnouncement(reading);\n    if (previous && this.#detailsDiffer(previous, detail)) {\n      this.dispatch(\"reconcile\", { detail });\n    }\n  }\n\n  /**\n   * Synchronizes the meter ARIA, the root state hooks, the fill custom property\n   * and the visible level readout.\n   *\n   * @stimeoRenderRoot\n   */\n  #render(): StrengthReading {\n    const max = this.#levels.length;\n    const score = this.#currentScore(max);\n    const level = this.#levels[score - 1] ?? \"\";\n    const meetsMin = score > 0 && score >= this.#minScore;\n    const band = this.#band(score, max);\n\n    this.#reflectMeter(score, max);\n    this.#reflectRoot(score, max, band, meetsMin);\n    this.#writeLabel(level);\n    return { score, level, max, meetsMin, band };\n  }\n\n  /**\n   * The declared minimum, or the Value's default (`0`, an inert gate) when the\n   * declaration cannot be read as a number. Every comparison against an unread\n   * number answers false, which would fail even the strongest password instead\n   * of leaving the gate off, so the unreadable declaration is confined to its\n   * own Value the way an unreadable scale is.\n   */\n  get #minScore(): number {\n    return Number.isFinite(this.minScoreValue) ? this.minScoreValue : 0;\n  }\n\n  /** The externally supplied score when one stands, else the heuristic's. */\n  #currentScore(max: number): number {\n    if (this.#externalScore !== null) {\n      return Math.min(max, Math.max(0, Math.round(this.#externalScore)));\n    }\n    return this.#score(this.hasInputTarget ? this.inputTarget.value : \"\", max);\n  }\n\n  /** Syncs the meter target's ARIA value attributes (`0..levels.length`). */\n  #reflectMeter(score: number, max: number): void {\n    if (!this.hasMeterTarget) return;\n    this.meterTarget.setAttribute(\"aria-valuemin\", \"0\");\n    this.meterTarget.setAttribute(\"aria-valuemax\", String(max));\n    this.meterTarget.setAttribute(\"aria-valuenow\", String(score));\n  }\n\n  /**\n   * Reflects the level onto the root: the stable `data-strength` band (absent when\n   * empty), the `data-below-min` hook when the score is under `minScore`, and the\n   * `0–1` fill the consumer's CSS turns into the bar width.\n   */\n  #reflectRoot(score: number, max: number, band: string, meetsMin: boolean): void {\n    this.#toggle(\"data-strength\", band, band.length > 0);\n    // Empty/pristine input (`score === 0`) is never \"below min\": that would let CSS\n    // flag an untouched field as failing. The hook mirrors the event's `meetsMin`,\n    // so it only marks a *non-empty* password under the threshold. `minScore`\n    // defaults to 0, leaving the hook inert until set positive.\n    this.#toggle(\"data-below-min\", \"true\", score > 0 && !meetsMin);\n    this.element.style.setProperty(\"--stimeo--password-strength\", String(score / max));\n  }\n\n  /** Writes the visible readout only when its text actually changed. */\n  #writeLabel(text: string): void {\n    if (!this.hasLabelTarget || this.labelTarget.textContent === text) return;\n    this.labelTarget.textContent = text;\n  }\n\n  /**\n   * Locale-independent styling band (one of {@link STRENGTH_BANDS}) for `score`\n   * out of `max`. Empty input → `\"\"`. Maps the position within the declared scale\n   * onto the position within the fixed bands, so both ends stay anchored on any\n   * level count: the weakest score is always `weak` and the strongest `strong`,\n   * and only the middle collapses when the scales differ in size.\n   */\n  #band(score: number, max: number): string {\n    if (score <= 0) return \"\";\n    const index = Math.round(((score - 1) / (max - 1)) * (STRENGTH_BANDS.length - 1));\n    // A scored password always lands inside the band list; an unplaceable one\n    // takes the weakest rather than claiming strength it was not measured to have.\n    return STRENGTH_BANDS[index] ?? STRENGTH_BANDS[0];\n  }\n\n  /** Sets `name` to `value` when `on`, else removes it (value/presence data hook). */\n  #toggle(name: string, value: string, on: boolean): void {\n    if (on) {\n      this.element.setAttribute(name, value);\n    } else {\n      this.element.removeAttribute(name);\n    }\n  }\n\n  /** The declared level labels, or the defaults when the scale cannot order. */\n  #readLevels(): string[] {\n    const declared = parseStringList(this.levelsValue, DEFAULT_LEVELS);\n    return declared.length >= MIN_LEVELS ? declared : [...DEFAULT_LEVELS];\n  }\n\n  /**\n   * Lightweight zero-dependency strength heuristic returning an integer in\n   * `[0, max]` (`max` = number of levels). Empty input is `0` (no level); any\n   * non-empty password is at least `1`. Points accrue from length milestones and\n   * character-class variety, then bucket into the level scale. A tiny alphabet\n   * (≤ 2 distinct characters, e.g. \"aaaa\") is capped as the weakest, so length\n   * alone cannot mask trivial repetition.\n   */\n  #score(password: string, max: number): number {\n    if (password.length === 0) return 0;\n\n    let points = 0;\n    for (const milestone of LENGTH_MILESTONES) {\n      if (password.length >= milestone) points += 1;\n    }\n    // The first present character class is free; each additional one adds a point.\n    points += CLASS_PATTERNS.filter((re) => re.test(password)).length - 1;\n\n    if (new Set(password).size <= 2) points = 0; // trivial repetition → weakest\n\n    const bucketed = Math.round((points / MAX_POINTS) * max);\n    return Math.min(max, Math.max(1, bucketed));\n  }\n\n  /** Debounces one i18n-neutral message for a level transition into the announcer. */\n  #scheduleAnnouncement(reading: StrengthReading): void {\n    this.#cancelAnnouncement();\n    if (reading.score === 0) {\n      // An emptied field has no level to read, and the next one typed is news.\n      this.#announcedLevel = null;\n      return;\n    }\n    if (reading.level === this.#announcedLevel) return;\n\n    const message = fillTemplate(this.announceTextValue, {\n      level: reading.level,\n      score: reading.score,\n      max: reading.max,\n      band: reading.band,\n    });\n    if (message.trim().length === 0) return;\n\n    this.#announceId = this.#timers.set(() => {\n      this.#announcedLevel = reading.level;\n      announce(message);\n      this.#announceId = null;\n    }, PasswordStrengthController.#announceDelay);\n  }\n\n  /** Cancels the one outstanding message without touching visible output. */\n  #cancelAnnouncement(): void {\n    if (this.#announceId !== null) this.#timers.clear(this.#announceId);\n    this.#announceId = null;\n  }\n\n  /**\n   * Returns every output derived from the field value to its pristine form.\n   *\n   * The value itself is not carried in a Turbo snapshot, so a band, a fill or a\n   * readout left behind would describe a password the restored page no longer\n   * holds. The pass is silent: `connect()` derives the state again from whatever\n   * the restored field contains.\n   */\n  #rewindForCache(): void {\n    this.#cancelAnnouncement();\n    this.#announcedLevel = null;\n    this.#externalScore = null;\n    this.#lastDetail = null;\n    this.#reflectMeter(0, this.#levels.length);\n    this.#toggle(\"data-strength\", \"\", false);\n    this.#toggle(\"data-below-min\", \"true\", false);\n    this.element.style.removeProperty(\"--stimeo--password-strength\");\n    this.#writeLabel(\"\");\n  }\n\n  /** Selects the public event state from the richer internal reading. */\n  #detail(reading: StrengthReading): PasswordStrengthDetail {\n    return {\n      score: reading.score,\n      level: reading.level,\n      max: reading.max,\n      meetsMin: reading.meetsMin,\n    };\n  }\n\n  /** Compares exactly the state carried by `change` and `reconcile`. */\n  #detailsDiffer(left: PasswordStrengthDetail, right: PasswordStrengthDetail): boolean {\n    return (\n      left.score !== right.score ||\n      left.level !== right.level ||\n      left.max !== right.max ||\n      left.meetsMin !== right.meetsMin\n    );\n  }\n}\n"]}
+{"version":3,"sources":["../../src/utils/template.ts","../../src/utils/announce.ts","../../src/utils/number_bounds.ts","../../src/utils/coerce.ts","../../src/utils/listener_set.ts","../../src/utils/microtask_coalescer.ts","../../src/utils/morph_render_watcher.ts","../../src/utils/number_value.ts","../../src/utils/safe_timeout.ts","../../src/utils/string_list.ts","../../src/controllers/password_strength_controller.ts"],"names":[],"mappings":";;AAUO,SAAS,YAAA,CAAa,UAAkB,MAAA,EAAiD;AAC9F,EAAA,OAAO,QAAA,CAAS,OAAA,CAAQ,6BAAA,EAA+B,CAAC,OAAO,IAAA,KAAiB;AAC9E,IAAA,MAAM,WAAA,GAAc,OAAO,MAAA,CAAO,MAAA,EAAQ,IAAI,CAAA,GAAI,MAAA,CAAO,IAAI,CAAA,GAAI,MAAA;AACjE,IAAA,OAAO,WAAA,KAAgB,MAAA,GAAY,KAAA,GAAQ,MAAA,CAAO,WAAW,CAAA;AAAA,EAC/D,CAAC,CAAA;AACH;;ACQO,SAAS,QAAA,CAAS,OAAA,EAAiB,OAAA,GAAmC,EAAC,EAAS;AACrF,EAAA,MAAM,IAAA,GAAO,QAAQ,IAAA,EAAK;AAC1B,EAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG;AACvB,EAAA,MAAA,CAAO,aAAA;AAAA,IACL,IAAI,YAAY,4BAAA,EAA8B;AAAA,MAC5C,QAAQ,EAAE,OAAA,EAAS,MAAM,SAAA,EAAW,OAAA,CAAQ,cAAc,IAAA;AAAK,KAChE;AAAA,GACH;AACF;;ACDO,IAAM,aAAA,GAAgB;AAAA,EAE3B,WAAA,EAAa,EAAE,MAAA,EAAQ,IAAA,EAAM,KAAK,CAAA,EAQpC,CAAA;AAMO,SAAS,mBAAA,CAAoB,OAAe,MAAA,EAA+B;AAChF,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG;AAC3B,IAAA,MAAM,YAAY,KAAA,KAAU,QAAA,GAAW,UAAA,GAAa,KAAA,KAAU,YAAY,UAAA,GAAa,IAAA;AACvF,IAAA,IAAI,SAAA,KAAc,MAAM,OAAO,KAAA;AAC/B,IAAA,IAAI,OAAO,aAAA,KAAkB,MAAA,IAAU,MAAA,CAAO,aAAA,KAAkB,WAAW,OAAO,KAAA;AAAA,EACpF;AACA,EAAA,IAAI,OAAO,GAAA,KAAQ,MAAA,IAAa,KAAA,GAAQ,MAAA,CAAO,KAAK,OAAO,KAAA;AAC3D,EAAA,IAAI,OAAO,GAAA,KAAQ,MAAA,IAAa,KAAA,GAAQ,MAAA,CAAO,KAAK,OAAO,KAAA;AAC3D,EAAA,IAAI,OAAO,YAAA,KAAiB,MAAA,IAAa,KAAA,IAAS,MAAA,CAAO,cAAc,OAAO,KAAA;AAC9E,EAAA,IAAI,OAAO,OAAA,IAAW,CAAC,OAAO,SAAA,CAAU,KAAK,GAAG,OAAO,KAAA;AACvD,EAAA,IAAI,MAAA,CAAO,kBAAkB,MAAA,IAAa,CAAC,OAAO,aAAA,CAAc,QAAA,CAAS,KAAK,CAAA,EAAG,OAAO,KAAA;AACxF,EAAA,OAAO,IAAA;AACT;;AChCO,SAAS,eAAe,GAAA,EAA6B;AAC1D,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,OAAO,GAAA,KAAQ,UAAU,OAAO,IAAA;AAC/D,EAAA,IAAI,OAAO,QAAQ,QAAA,IAAY,GAAA,CAAI,MAAK,CAAE,MAAA,KAAW,GAAG,OAAO,IAAA;AAC/D,EAAA,MAAM,KAAA,GAAQ,OAAO,GAAG,CAAA;AACxB,EAAA,OAAO,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,GAAI,KAAA,GAAQ,IAAA;AAC1C;AAMO,SAAS,UAAA,CAAW,GAAA,EAAa,QAAA,EAAkB,MAAA,EAA8B;AACtF,EAAA,OAAO,mBAAA,CAAoB,GAAA,EAAK,MAAM,CAAA,GAAI,GAAA,GAAM,QAAA;AAClD;;ACuCO,IAAM,cAAN,MAAkB;AAAA,EAEvB,MAAA,GAAS,IAAI,eAAA,EAAgB;AAAA,EAqB7B,GAAA,CAAI,MAAA,EAAqB,IAAA,EAAc,OAAA,EAAwB,OAAA,EAAiC;AAC9F,IAAA,MAAA,CAAO,gBAAA,CAAiB,IAAA,EAAM,OAAA,EAAS,EAAE,GAAG,SAAS,MAAA,EAAQ,IAAA,CAAK,MAAA,CAAO,MAAA,EAAQ,CAAA;AAAA,EACnF;AAAA,EAMA,OAAA,GAAgB;AACd,IAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAClB,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,eAAA,EAAgB;AAAA,EACpC;AACF,CAAA;;AChEO,IAAM,qBAAN,MAAyB;AAAA,EACrB,IAAA;AAAA,EACT,OAAA,GAAU,KAAA;AAAA,EACV,OAAA,GAAU,KAAA;AAAA,EACV,WAAA,GAAc,CAAA;AAAA,EAGd,YAAY,GAAA,EAAiB;AAC3B,IAAA,IAAA,CAAK,IAAA,GAAO,GAAA;AAAA,EACd;AAAA,EAGA,QAAA,GAAiB;AACf,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA;AAAA,EACjB;AAAA,EAGA,MAAA,GAAe;AACb,IAAA,IAAA,CAAK,OAAA,GAAU,KAAA;AACf,IAAA,IAAA,CAAK,OAAA,GAAU,KAAA;AACf,IAAA,IAAA,CAAK,WAAA,IAAe,CAAA;AAAA,EACtB;AAAA,EAGA,IAAI,OAAA,GAAmB;AACrB,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,EACd;AAAA,EAGA,QAAA,GAAiB;AACf,IAAA,IAAI,CAAC,IAAA,CAAK,OAAA,IAAW,IAAA,CAAK,OAAA,EAAS;AACnC,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA;AACf,IAAA,MAAM,aAAa,IAAA,CAAK,WAAA;AACxB,IAAA,cAAA,CAAe,MAAM;AAEnB,MAAA,IAAI,UAAA,KAAe,KAAK,WAAA,IAAe,CAAC,KAAK,OAAA,IAAW,CAAC,KAAK,OAAA,EAAS;AACvE,MAAA,IAAA,CAAK,OAAA,GAAU,KAAA;AACf,MAAA,IAAA,CAAK,IAAA,EAAK;AAAA,IACZ,CAAC,CAAA;AAAA,EACH;AACF,CAAA;;AC7EO,IAAM,qBAAN,MAAyB;AAAA,EACrB,UAAA,GAAa,IAAI,WAAA,EAAY;AAAA,EAC7B,KAAA;AAAA,EACT,QAAA,GAA2B,IAAA;AAAA,EAClB,QAAA,GAAW,MAAY,IAAA,CAAK,KAAA,CAAM,QAAA,EAAS;AAAA,EAGpD,YAAY,GAAA,EAAiB;AAC3B,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAI,kBAAA,CAAmB,GAAG,CAAA;AAAA,EACzC;AAAA,EAGA,QAAQ,OAAA,EAAwB;AAC9B,IAAA,IAAI,IAAA,CAAK,aAAa,OAAA,EAAS;AAC/B,IAAA,IAAA,CAAK,UAAA,EAAW;AAChB,IAAA,IAAA,CAAK,QAAA,GAAW,OAAA;AAChB,IAAA,IAAA,CAAK,MAAM,QAAA,EAAS;AACpB,IAAA,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,OAAA,EAAS,qBAAA,EAAuB,KAAK,QAAQ,CAAA;AAAA,EACnE;AAAA,EAGA,QAAA,GAAiB;AACf,IAAA,IAAA,CAAK,MAAM,QAAA,EAAS;AAAA,EACtB;AAAA,EAGA,IAAI,OAAA,GAAmB;AACrB,IAAA,OAAO,KAAK,KAAA,CAAM,OAAA;AAAA,EACpB;AAAA,EAGA,UAAA,GAAmB;AACjB,IAAA,IAAA,CAAK,WAAW,OAAA,EAAQ;AACxB,IAAA,IAAA,CAAK,MAAM,MAAA,EAAO;AAClB,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAAA,EAClB;AACF,CAAA;;ACtCO,IAAM,oBAAN,MAAwB;AAAA,EAEpB,aAAA,uBAAoB,GAAA,EAAoB;AAAA,EAGjD,IAAA,CACE,KAAA,EACA,IAAA,EACA,GAAA,EACA,UACA,MAAA,EACQ;AACR,IAAA,MAAM,QAAA,GAAW,UAAA,CAAW,GAAA,EAAK,QAAA,EAAU,MAAM,CAAA;AACjD,IAAA,IAAI,mBAAA,CAAoB,GAAA,EAAK,MAAM,CAAA,EAAG;AACpC,MAAA,IAAA,CAAK,aAAA,CAAc,OAAO,IAAI,CAAA;AAC9B,MAAA,OAAO,QAAA;AAAA,IACT;AACA,IAAA,MAAM,SAAA,GAAY,CAAA,KAAA,EAAQ,KAAA,CAAM,UAAU,IAAI,IAAA,CAAK,OAAA,CAAQ,QAAA,EAAU,CAAC,WAAW,CAAA,CAAA,EAAI,MAAA,CAAO,WAAA,EAAa,EAAE,CAAC,CAAA,MAAA,CAAA;AAC5G,IAAA,MAAM,OAAA,GAAU,KAAA,CAAM,OAAA,CAAQ,YAAA,CAAa,SAAS,CAAA;AACpD,IAAA,IAAI,YAAY,IAAA,EAAM;AACpB,MAAA,IAAA,CAAK,aAAA,CAAc,OAAO,IAAI,CAAA;AAC9B,MAAA,OAAO,QAAA;AAAA,IACT;AACA,IAAA,IAAI,IAAA,CAAK,aAAA,CAAc,GAAA,CAAI,IAAI,MAAM,OAAA,EAAS;AAC5C,MAAA,IAAA,CAAK,aAAA,CAAc,GAAA,CAAI,IAAA,EAAM,OAAO,CAAA;AACpC,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,YAAA,EAAe,KAAA,CAAM,UAAU,CAAA,+BAAA,EAAkC,IAAI,CAAA,cAAA,EAAiB,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA,QAAA,EAAW,QAAQ,CAAA,CAAA;AAAA,OAClI;AAAA,IACF;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AACF,CAAA;;ACfA,IAAe,gBAAf,MAA6B;AAAA,EAER,GAAA,uBAAU,GAAA,EAAY;AAAA,EAczC,MAAM,EAAA,EAAkB;AACtB,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA,EAAG;AACvB,MAAA,IAAA,CAAK,OAAO,EAAE,CAAA;AAAA,IAChB;AAAA,EACF;AAAA,EAMA,QAAA,GAAiB;AACf,IAAA,KAAA,MAAW,EAAA,IAAM,KAAK,GAAA,EAAK;AACzB,MAAA,IAAA,CAAK,OAAO,EAAE,CAAA;AAAA,IAChB;AACA,IAAA,IAAA,CAAK,IAAI,KAAA,EAAM;AAAA,EACjB;AAAA,EAGA,IAAI,IAAA,GAAe;AACjB,IAAA,OAAO,KAAK,GAAA,CAAI,IAAA;AAAA,EAClB;AACF,CAAA;AAmBO,IAAM,WAAA,GAAN,cAA0B,aAAA,CAAc;AAAA,EAO7C,GAAA,CAAI,UAAsB,KAAA,EAAuB;AAC/C,IAAA,MAAM,EAAA,GAAK,IAAA,CAAK,QAAA,CAAS,MAAM;AAC7B,MAAA,IAAA,CAAK,GAAA,CAAI,OAAO,EAAE,CAAA;AAClB,MAAA,QAAA,EAAS;AAAA,IACX,GAAG,KAAK,CAAA;AACR,IAAA,IAAA,CAAK,GAAA,CAAI,IAAI,EAAE,CAAA;AACf,IAAA,OAAO,EAAA;AAAA,EACT;AAAA,EAEU,QAAA,CAAS,UAAsB,KAAA,EAAuB;AAC9D,IAAA,OAAO,MAAA,CAAO,UAAA,CAAW,QAAA,EAAU,KAAK,CAAA;AAAA,EAC1C;AAAA,EAEU,OAAO,EAAA,EAAkB;AACjC,IAAA,MAAA,CAAO,aAAa,EAAE,CAAA;AAAA,EACxB;AACF,CAAA;;AC1EO,SAAS,eAAA,CAAgB,GAAA,EAAa,QAAA,GAA8B,EAAC,EAAa;AAIvF,EAAA,MAAM,IAAA,GAAO,IAAI,IAAA,EAAK;AACtB,EAAA,IAAI,KAAK,MAAA,KAAW,CAAA,EAAG,OAAO,CAAC,GAAG,QAAQ,CAAA;AAE1C,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,CAAC,GAAG,QAAQ,CAAA;AAAA,EACrB;AAEA,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,MAAM,GAAG,OAAO,CAAC,GAAG,QAAQ,CAAA;AAC/C,EAAA,OAAO,OAAO,MAAA,CAAO,CAAC,KAAA,KAA2B,OAAO,UAAU,QAAQ,CAAA;AAC5E;;ACdA,IAAM,cAAA,GAAoC,CAAC,OAAA,EAAS,OAAA,EAAS,SAAS,cAAc,CAAA;AAGpF,IAAM,cAAA,GAAiB,CAAC,MAAA,EAAQ,MAAA,EAAQ,QAAQ,QAAQ,CAAA;AAGxD,IAAM,iBAAA,GAAuC,CAAC,CAAA,EAAG,EAAA,EAAI,EAAE,CAAA;AAGvD,IAAM,UAAA,GAAa,iBAAA,CAAkB,MAAA,IAAU,cAAA,CAAe,MAAA,GAAS,CAAA,CAAA;AAQvE,IAAM,cAAA,GAAiB,CAAC,MAAA,EAAQ,MAAA,EAAQ,QAAQ,QAAQ,CAAA;AAQxD,IAAM,UAAA,GAAa,CAAA;AAoDZ,IAAM,0BAAA,GAAN,MAAM,2BAAA,SAAmC,UAAA,CAAwB;AAAA,EAE7D,QAAA,GAAW,IAAI,iBAAA,EAAkB;AAAA,EAE1C,OAAgB,OAAA,GAAU,CAAC,OAAA,EAAS,SAAS,OAAO,CAAA;AAAA,EACpD,OAAgB,MAAA,GAAS;AAAA,IACvB,QAAA,EAAU,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,CAAA,EAAE;AAAA,IAIrC,MAAA,EAAQ,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,EAAA,EAAG;AAAA,IACpC,YAAA,EAAc,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,EAAA;AAAG,GAC5C;AAAA,EAEA,OAAO,gBAAA,GAAmB;AAAA,IACxB,UAAU,aAAA,CAAc;AAAA,GAC1B;AAAA,EACA,OAAO,OAAA,GAAU,CAAC,UAAA,EAAY,UAAU,CAAA;AAAA,EACxC,OAAO,MAAA,GAAS,CAAC,QAAA,EAAU,WAAW,CAAA;AAAA,EActC,OAAgB,cAAA,GAAiB,GAAA;AAAA,EAExB,OAAA,GAAU,IAAI,WAAA,EAAY;AAAA,EAC1B,WAAW,IAAI,kBAAA,CAAmB,MAAM,IAAA,CAAK,YAAY,CAAA;AAAA,EAClE,OAAA,GAAoB,CAAC,GAAG,cAAc,CAAA;AAAA,EACtC,WAAA,GAA6B,IAAA;AAAA,EAC7B,eAAA,GAAiC,IAAA;AAAA,EACjC,cAAA,GAAgC,IAAA;AAAA,EAChC,WAAA,GAA6C,IAAA;AAAA,EAGpC,OAAA,GAAgB;AACvB,IAAA,IAAA,CAAK,QAAA,CAAS,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAA;AAIlC,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,SAAS,CAAA;AAI9C,IAAA,IAAA,CAAK,SAAS,QAAA,EAAS;AAAA,EACzB;AAAA,EAGS,UAAA,GAAmB;AAC1B,IAAA,IAAA,CAAK,SAAS,UAAA,EAAW;AACzB,IAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,IAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AACtB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,EACrB;AAAA,EAGA,QAAA,GAAiB;AACf,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AACtB,IAAA,IAAA,CAAK,OAAA,EAAQ;AAAA,EACf;AAAA,EAOA,SAAS,KAAA,EAA4B;AACnC,IAAA,MAAM,OAAO,cAAA,CAAe,KAAA,CAAM,QAAQ,KAAA,IAAS,KAAA,CAAM,QAAQ,KAAK,CAAA;AACtE,IAAA,IAAI,SAAS,IAAA,EAAM;AACnB,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AACtB,IAAA,IAAA,CAAK,OAAA,EAAQ;AAAA,EACf;AAAA,EAGA,kBAAA,GAA2B;AACzB,IAAA,IAAA,CAAK,OAAA,GAAU,KAAK,WAAA,EAAY;AAChC,IAAA,IAAA,CAAK,SAAS,QAAA,EAAS;AAAA,EACzB;AAAA,EAGA,oBAAA,GAA6B;AAC3B,IAAA,IAAA,CAAK,SAAS,QAAA,EAAS;AAAA,EACzB;AAAA,EAGA,wBAAA,GAAiC;AAC/B,IAAA,IAAA,CAAK,SAAS,QAAA,EAAS;AAAA,EACzB;AAAA,EAGA,oBAAA,GAA6B;AAC3B,IAAA,IAAA,CAAK,SAAS,QAAA,EAAS;AAAA,EACzB;AAAA,EAGA,uBAAA,GAAgC;AAC9B,IAAA,IAAA,CAAK,SAAS,QAAA,EAAS;AAAA,EACzB;AAAA,EAGA,oBAAA,GAA6B;AAC3B,IAAA,IAAA,CAAK,SAAS,QAAA,EAAS;AAAA,EACzB;AAAA,EAGA,uBAAA,GAAgC;AAC9B,IAAA,IAAA,CAAK,SAAS,QAAA,EAAS;AAAA,EACzB;AAAA,EAGA,oBAAA,GAA6B;AAC3B,IAAA,IAAA,CAAK,SAAS,QAAA,EAAS;AAAA,EACzB;AAAA,EAGA,uBAAA,GAAgC;AAC9B,IAAA,IAAA,CAAK,SAAS,QAAA,EAAS;AAAA,EACzB;AAAA,EAGA,OAAA,GAAgB;AACd,IAAA,MAAM,OAAA,GAAU,KAAK,OAAA,EAAQ;AAC7B,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,OAAA,CAAQ,OAAO,CAAA;AACvC,IAAA,IAAA,CAAK,SAAS,QAAA,EAAU,EAAE,MAAA,EAAQ,IAAA,CAAK,aAAa,CAAA;AACpD,IAAA,IAAA,CAAK,sBAAsB,OAAO,CAAA;AAAA,EACpC;AAAA,EAGA,UAAA,GAAmB;AACjB,IAAA,MAAM,WAAW,IAAA,CAAK,WAAA;AAMtB,IAAA,MAAM,IAAA,GAAO,KAAK,WAAA,KAAgB,IAAA;AAClC,IAAA,MAAM,OAAA,GAAU,KAAK,OAAA,EAAQ;AAC7B,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,OAAO,CAAA;AACnC,IAAA,IAAA,CAAK,WAAA,GAAc,MAAA;AAGnB,IAAA,IAAI,OAAA,CAAQ,KAAA,KAAU,CAAA,EAAG,IAAA,CAAK,eAAA,GAAkB,IAAA;AAChD,IAAA,IAAI,IAAA,EAAM,IAAA,CAAK,qBAAA,CAAsB,OAAO,CAAA;AAC5C,IAAA,IAAI,QAAA,IAAY,IAAA,CAAK,cAAA,CAAe,QAAA,EAAU,MAAM,CAAA,EAAG;AACrD,MAAA,IAAA,CAAK,QAAA,CAAS,WAAA,EAAa,EAAE,MAAA,EAAQ,CAAA;AAAA,IACvC;AAAA,EACF;AAAA,EAQA,OAAA,GAA2B;AACzB,IAAA,MAAM,GAAA,GAAM,KAAK,OAAA,CAAQ,MAAA;AACzB,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,aAAA,CAAc,GAAG,CAAA;AACpC,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,KAAA,GAAQ,CAAC,CAAA,IAAK,EAAA;AACzC,IAAA,MAAM,QAAA,GAAW,KAAA,GAAQ,CAAA,IAAK,KAAA,IAAS,IAAA,CAAK,SAAA;AAC5C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,KAAA,EAAO,GAAG,CAAA;AAElC,IAAA,IAAA,CAAK,aAAA,CAAc,OAAO,GAAG,CAAA;AAC7B,IAAA,IAAA,CAAK,YAAA,CAAa,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM,QAAQ,CAAA;AAC5C,IAAA,IAAA,CAAK,YAAY,KAAK,CAAA;AACtB,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,GAAA,EAAK,UAAU,IAAA,EAAK;AAAA,EAC7C;AAAA,EASA,IAAI,SAAA,GAAoB;AACtB,IAAA,OAAO,IAAA,CAAK,aAAA;AAAA,EACd;AAAA,EAGA,cAAc,GAAA,EAAqB;AACjC,IAAA,IAAI,IAAA,CAAK,mBAAmB,IAAA,EAAM;AAChC,MAAA,OAAO,IAAA,CAAK,GAAA,CAAI,GAAA,EAAK,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,cAAc,CAAC,CAAC,CAAA;AAAA,IACnE;AACA,IAAA,OAAO,IAAA,CAAK,OAAO,IAAA,CAAK,cAAA,GAAiB,KAAK,WAAA,CAAY,KAAA,GAAQ,IAAI,GAAG,CAAA;AAAA,EAC3E;AAAA,EAGA,aAAA,CAAc,OAAe,GAAA,EAAmB;AAC9C,IAAA,IAAI,CAAC,KAAK,cAAA,EAAgB;AAC1B,IAAA,IAAA,CAAK,WAAA,CAAY,YAAA,CAAa,eAAA,EAAiB,GAAG,CAAA;AAClD,IAAA,IAAA,CAAK,WAAA,CAAY,YAAA,CAAa,eAAA,EAAiB,MAAA,CAAO,GAAG,CAAC,CAAA;AAC1D,IAAA,IAAA,CAAK,WAAA,CAAY,YAAA,CAAa,eAAA,EAAiB,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,EAC9D;AAAA,EAOA,YAAA,CAAa,KAAA,EAAe,GAAA,EAAa,IAAA,EAAc,QAAA,EAAyB;AAC9E,IAAA,IAAA,CAAK,OAAA,CAAQ,eAAA,EAAiB,IAAA,EAAM,IAAA,CAAK,SAAS,CAAC,CAAA;AAKnD,IAAA,IAAA,CAAK,QAAQ,gBAAA,EAAkB,MAAA,EAAQ,KAAA,GAAQ,CAAA,IAAK,CAAC,QAAQ,CAAA;AAC7D,IAAA,IAAA,CAAK,QAAQ,KAAA,CAAM,WAAA,CAAY,+BAA+B,MAAA,CAAO,KAAA,GAAQ,GAAG,CAAC,CAAA;AAAA,EACnF;AAAA,EAGA,YAAY,IAAA,EAAoB;AAC9B,IAAA,IAAI,CAAC,IAAA,CAAK,cAAA,IAAkB,IAAA,CAAK,WAAA,CAAY,gBAAgB,IAAA,EAAM;AACnE,IAAA,IAAA,CAAK,YAAY,WAAA,GAAc,IAAA;AAAA,EACjC;AAAA,EASA,KAAA,CAAM,OAAe,GAAA,EAAqB;AACxC,IAAA,IAAI,KAAA,IAAS,GAAG,OAAO,EAAA;AACvB,IAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,CAAA,CAAQ,KAAA,GAAQ,MAAM,GAAA,GAAM,CAAA,CAAA,IAAO,cAAA,CAAe,MAAA,GAAS,CAAA,CAAE,CAAA;AAGhF,IAAA,OAAO,cAAA,CAAe,KAAK,CAAA,IAAK,cAAA,CAAe,CAAC,CAAA;AAAA,EAClD;AAAA,EAGA,OAAA,CAAQ,IAAA,EAAc,KAAA,EAAe,EAAA,EAAmB;AACtD,IAAA,IAAI,EAAA,EAAI;AACN,MAAA,IAAA,CAAK,OAAA,CAAQ,YAAA,CAAa,IAAA,EAAM,KAAK,CAAA;AAAA,IACvC,CAAA,MAAO;AACL,MAAA,IAAA,CAAK,OAAA,CAAQ,gBAAgB,IAAI,CAAA;AAAA,IACnC;AAAA,EACF;AAAA,EAGA,WAAA,GAAwB;AACtB,IAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,IAAA,CAAK,WAAA,EAAa,cAAc,CAAA;AACjE,IAAA,OAAO,SAAS,MAAA,IAAU,UAAA,GAAa,QAAA,GAAW,CAAC,GAAG,cAAc,CAAA;AAAA,EACtE;AAAA,EAUA,MAAA,CAAO,UAAkB,GAAA,EAAqB;AAC5C,IAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG,OAAO,CAAA;AAElC,IAAA,IAAI,MAAA,GAAS,CAAA;AACb,IAAA,KAAA,MAAW,aAAa,iBAAA,EAAmB;AACzC,MAAA,IAAI,QAAA,CAAS,MAAA,IAAU,SAAA,EAAW,MAAA,IAAU,CAAA;AAAA,IAC9C;AAEA,IAAA,MAAA,IAAU,cAAA,CAAe,OAAO,CAAC,EAAA,KAAO,GAAG,IAAA,CAAK,QAAQ,CAAC,CAAA,CAAE,MAAA,GAAS,CAAA;AAEpE,IAAA,IAAI,IAAI,GAAA,CAAI,QAAQ,CAAA,CAAE,IAAA,IAAQ,GAAG,MAAA,GAAS,CAAA;AAE1C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAO,MAAA,GAAS,aAAc,GAAG,CAAA;AACvD,IAAA,OAAO,KAAK,GAAA,CAAI,GAAA,EAAK,KAAK,GAAA,CAAI,CAAA,EAAG,QAAQ,CAAC,CAAA;AAAA,EAC5C;AAAA,EAGA,sBAAsB,OAAA,EAAgC;AACpD,IAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,IAAA,IAAI,OAAA,CAAQ,UAAU,CAAA,EAAG;AAEvB,MAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,MAAA;AAAA,IACF;AACA,IAAA,IAAI,OAAA,CAAQ,KAAA,KAAU,IAAA,CAAK,eAAA,EAAiB;AAE5C,IAAA,MAAM,OAAA,GAAU,YAAA,CAAa,IAAA,CAAK,iBAAA,EAAmB;AAAA,MACnD,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,KAAK,OAAA,CAAQ,GAAA;AAAA,MACb,MAAM,OAAA,CAAQ;AAAA,KACf,CAAA;AACD,IAAA,IAAI,OAAA,CAAQ,IAAA,EAAK,CAAE,MAAA,KAAW,CAAA,EAAG;AAEjC,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,MAAM;AACxC,MAAA,IAAA,CAAK,kBAAkB,OAAA,CAAQ,KAAA;AAC/B,MAAA,QAAA,CAAS,OAAO,CAAA;AAChB,MAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,IACrB,CAAA,EAAG,4BAA2B,cAAc,CAAA;AAAA,EAC9C;AAAA,EAGA,mBAAA,GAA4B;AAC1B,IAAA,IAAI,KAAK,WAAA,KAAgB,IAAA,OAAW,OAAA,CAAQ,KAAA,CAAM,KAAK,WAAW,CAAA;AAClE,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,EACrB;AAAA,EAGA,QAAQ,OAAA,EAAkD;AACxD,IAAA,OAAO;AAAA,MACL,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,KAAK,OAAA,CAAQ,GAAA;AAAA,MACb,UAAU,OAAA,CAAQ;AAAA,KACpB;AAAA,EACF;AAAA,EAGA,cAAA,CAAe,MAA8B,KAAA,EAAwC;AACnF,IAAA,OACE,IAAA,CAAK,KAAA,KAAU,KAAA,CAAM,KAAA,IACrB,KAAK,KAAA,KAAU,KAAA,CAAM,KAAA,IACrB,IAAA,CAAK,GAAA,KAAQ,KAAA,CAAM,GAAA,IACnB,IAAA,CAAK,aAAa,KAAA,CAAM,QAAA;AAAA,EAE5B;AAAA,EAEA,IAAI,aAAA,GAAwB;AAC1B,IAAA,OAAO,KAAK,QAAA,CAAS,IAAA;AAAA,MACnB,IAAA;AAAA,MACA,UAAA;AAAA,MACA,IAAA,CAAK,aAAA;AAAA,MACL,2BAAA,CAA2B,OAAO,QAAA,CAAS,OAAA;AAAA,MAC3C,4BAA2B,gBAAA,CAAiB;AAAA,KAC9C;AAAA,EACF;AACF","file":"password_strength_controller.js","sourcesContent":["/**\n * Fills `{name}` placeholders in a localized template from the own entries of `values`.\n *\n * Announcement and value-text templates share this one substitution, so a consumer writes\n * `\"{percent}% complete\"` in one attribute and gets the same rules everywhere. A\n * placeholder with no matching entry is left as authored rather than blanked, which\n * keeps a typo visible instead of silently swallowing the word.\n * Every occurrence is filled in one pass. Inserted strings stay literal, including\n * replacement-pattern characters and text that resembles another placeholder.\n */\nexport function fillTemplate(template: string, values: Record<string, string | number>): string {\n  return template.replace(/\\{([a-zA-Z][a-zA-Z0-9]*)\\}/g, (match, name: string) => {\n    const replacement = Object.hasOwn(values, name) ? values[name] : undefined;\n    return replacement === undefined ? match : String(replacement);\n  });\n}\n","export { fillTemplate } from \"./template\";\n\n/**\n * Sends one message to the page's shared `stimeo--announcer`.\n *\n * A message that has to reach assistive tech is not put into a live region created\n * or un-hidden along with it: a region only announces what changes *after* assistive\n * tech already knows about it, which such a region cannot satisfy. The announcer has\n * to be in the page before any message is handed to it — one sent while no announcer\n * is listening is not read — so state changes reach it as an event and it does the\n * reading.\n *\n * The event goes to `window` because the announcer is usually a sibling high in the\n * document rather than an ancestor of the component dispatching it.\n *\n * Wording comes from the consumer — this helper adds no text of its own — so an\n * empty message is silently dropped and nothing is announced.\n *\n * @example\n * ```ts\n * announce(this.announceTextValue, { assertive: false });\n * ```\n */\nexport function announce(message: string, options: { assertive?: boolean } = {}): void {\n  const text = message.trim();\n  if (text.length === 0) return;\n  window.dispatchEvent(\n    new CustomEvent(\"stimeo--announcer:announce\", {\n      detail: { message: text, assertive: options.assertive === true },\n    }),\n  );\n}\n","import { MAX_TIMER_DELAY_MS } from \"./timer_bounds\";\n\n/** Semantic constraints on an already decoded number, independent of the DOM. */\nexport interface NumberBounds {\n  /** Finite numbers are required, including when this field is omitted. */\n  readonly finite?: true;\n  /** Inclusive lower endpoint. */\n  readonly min?: number;\n  /** Inclusive upper endpoint. */\n  readonly max?: number;\n  /** Exclusive lower endpoint. */\n  readonly exclusiveMin?: number;\n  /** Require a number without a fractional part. */\n  readonly integer?: boolean;\n  /** Exact decoded numbers accepted by a discrete contract. */\n  readonly allowedValues?: readonly number[];\n  /** JSON-safe exceptions to finite-number checking for unbounded endpoints. */\n  readonly allowInfinity?: \"negative\" | \"positive\" | \"both\";\n}\n\n/** One constraint for each Number Value, including shorthand declarations. */\nexport type NumberValueConstraints<Values> = {\n  readonly [Key in keyof Values as Values[Key] extends\n    | NumberConstructor\n    | { type: NumberConstructor }\n    ? Key\n    : never]: NumberBounds;\n};\n\n/** Reusable semantic domains; fractional inputs remain fractional unless excluded. */\nexport const NUMBER_BOUNDS = {\n  finite: { finite: true },\n  nonNegative: { finite: true, min: 0 },\n  positive: { finite: true, exclusiveMin: 0 },\n  nonNegativeInteger: { finite: true, min: 0, integer: true },\n  positiveInteger: { finite: true, exclusiveMin: 0, integer: true },\n  lowerBound: { finite: true, allowInfinity: \"negative\" },\n  upperBound: { finite: true, allowInfinity: \"positive\" },\n  timer: { finite: true, min: 0, max: MAX_TIMER_DELAY_MS },\n  positiveTimer: { finite: true, exclusiveMin: 0, max: MAX_TIMER_DELAY_MS },\n} as const satisfies Record<string, NumberBounds>;\n\n/**\n * Checks all declared bounds without rounding, clamping, or coercing the input.\n * Infinity exceptions relax only finite checking; every other bound still applies.\n */\nexport function matchesNumberBounds(value: number, bounds: NumberBounds): boolean {\n  if (!Number.isFinite(value)) {\n    const direction = value === Infinity ? \"positive\" : value === -Infinity ? \"negative\" : null;\n    if (direction === null) return false;\n    if (bounds.allowInfinity !== \"both\" && bounds.allowInfinity !== direction) return false;\n  }\n  if (bounds.min !== undefined && value < bounds.min) return false;\n  if (bounds.max !== undefined && value > bounds.max) return false;\n  if (bounds.exclusiveMin !== undefined && value <= bounds.exclusiveMin) return false;\n  if (bounds.integer && !Number.isInteger(value)) return false;\n  if (bounds.allowedValues !== undefined && !bounds.allowedValues.includes(value)) return false;\n  return true;\n}\n\n/** Decodes a Number Value literal; action params use their own JSON decoder. */\nexport function decodeNumberValue(raw: string): number {\n  return Number(raw.replace(/_/g, \"\"));\n}\n","/**\n * Numeric coercion for controllers that accept a number through a Value, an action\n * param, or an event detail.\n *\n * Stimulus decodes action params as JSON when possible and leaves other text\n * untouched. CustomEvent detail can also supply a number or numeric string.\n * The reader accepts those two types while rejecting blank and non-finite input.\n */\n\nimport { matchesNumberBounds, type NumberBounds } from \"./number_bounds\";\n\n/** Numeric update input, accepting decoded action params before CustomEvent detail. */\nexport type NumericValueEvent = Event & {\n  params?: { amount?: unknown };\n  detail?: { value?: unknown };\n};\n\n/** Reads the nullish action-param/detail precedence without falling back from invalid input. */\nexport function eventNumber(event: NumericValueEvent): number | null {\n  return toFiniteNumber(event.params?.amount ?? event.detail?.value);\n}\n\n/**\n * Reads a finite number or nonblank numeric string; other input returns `null`.\n * Blank strings cannot silently reset a value to zero.\n */\nexport function toFiniteNumber(raw: unknown): number | null {\n  if (typeof raw !== \"number\" && typeof raw !== \"string\") return null;\n  if (typeof raw === \"string\" && raw.trim().length === 0) return null;\n  const value = Number(raw);\n  return Number.isFinite(value) ? value : null;\n}\n\n/**\n * Returns an accepted decoded Number Value or the caller's fallback unchanged.\n * The caller owns the fallback contract; this reader does not parse or write a Value.\n */\nexport function readNumber(raw: number, fallback: number, bounds: NumberBounds): number {\n  return matchesNumberBounds(raw, bounds) ? raw : fallback;\n}\n","/** What {@link ListenerSet.add} passes on besides the signal it supplies itself. */\nexport type ListenerOptions = Omit<AddEventListenerOptions, \"signal\">;\n\n/**\n * The event map a target's own `addEventListener` types its handlers with: the\n * window's, a document's, an HTML or SVG element's, any other element's, or a\n * media query list's. Other targets name none.\n */\ntype EventMapOf<T extends EventTarget> = T extends Window\n  ? WindowEventMap\n  : T extends Document\n    ? DocumentEventMap\n    : T extends HTMLElement\n      ? HTMLElementEventMap\n      : T extends SVGElement\n        ? SVGElementEventMap\n        : T extends Element\n          ? ElementEventMap\n          : T extends MediaQueryList\n            ? MediaQueryListEventMap\n            : Record<never, never>;\n\n/**\n * Owns every listener a controller attaches for one connected lifetime and\n * releases them together, so an event name is spelled once and the release\n * cannot drift from the registration.\n *\n * Detaching by hand repeats three things at the release site — the type, the\n * handler reference and the capture flag — and any one of them drifting leaves\n * a listener alive on an element the controller no longer drives. Aborting the\n * signal a registration was created with releases it whatever it was made of,\n * so the release site names nothing.\n *\n * One set per lifetime, held as a field and never rebuilt.\n * {@link ListenerSet.dispose} is the only thing that closes a generation, and it opens\n * the next one in the same step, so the lifecycle hooks can call `add` and\n * `dispose` in any order any number of times, and no `add` ever meets an\n * already aborted signal — a DOM that registers a listener on such a signal\n * would keep it forever. Rebuilding the set instead would leak:\n * `addEventListener` matches an existing registration on target, type, callback\n * and capture alone, so re-adding the same handler while the first registration\n * is live is discarded, and that live registration keeps the signal it was\n * attached with — a set built by a second `connect()` can never release what it\n * appears to own.\n *\n * Scope is the registration only. Timers, observers, leases and the order they\n * are unwound in stay with the controller, which places `dispose()` in its\n * cleanup sequence. A receiver that changes at runtime (a\n * swapped target) is rebound by calling `dispose()` and then `add()` again from\n * the rebind, not by a second set.\n *\n * A lifetime shorter than the connection — while a Value holds, until a first\n * load, while a subscription is open — gets a set of its own, which the end of\n * that lifetime disposes. A controller therefore holds one set per lifetime: the\n * connection's, and one for each swapped receiver or shorter span.\n *\n * The set must own every registration of a tuple it holds: a listener the same\n * target already carries for the same type, callback and capture flag keeps the\n * right to remove it, and this set's `add` for that tuple is discarded. A\n * subscription shared between instances behind a participant count, listeners of\n * several elements that come and go one at a time, and those one gesture holds\n * keep their own pair of calls or a signal of their own.\n *\n * @example\n * ```ts\n * readonly #listeners = new ListenerSet();\n *\n * connect(): void {\n *   this.#listeners.add(this.element, \"submit\", this.#onNativeSubmit, { capture: true });\n *   this.#listeners.add(this.element, \"turbo:submit-start\", this.#onSubmitStart);\n *   this.#listeners.add(this.element, \"turbo:submit-end\", this.#onSubmitEnd);\n * }\n *\n * disconnect(): void {\n *   this.#listeners.dispose();\n * }\n * ```\n */\nexport class ListenerSet {\n  /** The generation every `add` joins until the next `dispose()`. */\n  #abort = new AbortController();\n\n  /**\n   * Attaches `handler` to the open generation, exactly as the caller spelled it.\n   *\n   * The set supplies the signal, so `options` carries everything else the DOM\n   * accepts — `capture` included. A removal by hand would have to repeat that\n   * flag; aborting the signal releases the listener without it.\n   *\n   * A `type` the target's own event map names types `handler` with that event,\n   * as the target's `addEventListener` does, so a handler written for a\n   * `KeyboardEvent` is passed as it is; any other `type` takes an\n   * `EventListener`.\n   */\n  add<T extends EventTarget, K extends keyof EventMapOf<T> & string>(\n    target: T,\n    type: K,\n    handler: (event: EventMapOf<T>[K]) => void,\n    options?: ListenerOptions,\n  ): void;\n  add(target: EventTarget, type: string, handler: EventListener, options?: ListenerOptions): void;\n  add(target: EventTarget, type: string, handler: EventListener, options?: ListenerOptions): void {\n    target.addEventListener(type, handler, { ...options, signal: this.#abort.signal });\n  }\n\n  /**\n   * Releases every listener of the open generation, synchronously, and opens the\n   * next one. Idempotent, and safe before anything has been added.\n   */\n  dispose(): void {\n    this.#abort.abort();\n    this.#abort = new AbortController();\n  }\n}\n","/**\n * Collapses many Stimulus lifecycle callbacks from one DOM mutation into a\n * single pass.\n *\n * Stimulus fires `<name>TargetConnected` / `Disconnected` once per element and\n * `<name>ValueChanged` once per changed attribute. Replacing a list of N options\n * or morphing several render Values therefore delivers N callbacks — but the\n * useful unit of work is \"reconcile against the resulting declarative input\",\n * once, after the batch has settled. Every controller with reconcilable targets\n * or render Values needs the same shape: a `queued` flag plus `queueMicrotask`.\n *\n * **A microtask is the right horizon, and the reason is specific.** Stimulus\n * drives these callbacks from a `MutationObserver`, whose own callback already\n * runs as a microtask with the whole batch in hand; scheduling one more lands\n * after the last sibling callback of that batch and still before paint or any\n * event handler. A timer would be later than it needs to be, and reconciling\n * synchronously would run once per element against a half-applied DOM.\n *\n * **The two guards are not the same guard.** Scheduling is refused before the\n * controller connects, and running is refused after it disconnects:\n *\n * - **Before `connect()`** — Stimulus delivers initial target and Value callbacks\n *   ahead of `connect()`. Reconciling there would compute output against a\n *   controller whose own state has not been initialised, and `connect()` is\n *   about to do a full pass anyway.\n * - **After `disconnect()`** — Stimulus fires a callback for **every** target\n *   during teardown, and a microtask queued just before it would otherwise run\n *   against a detached tree. {@link MicrotaskCoalescer.cancel} exists for the\n *   teardown path to drop the pending pass outright.\n *\n * Both guards are part of one contract here rather than something each consumer\n * has to remember separately.\n *\n * Scope is the scheduling only. *What* to reconcile — keep the surviving active\n * option, fall back to the next / previous / first visible one, rebuild derived\n * chips or hidden fields — stays in the controller, because no two consumers\n * answer it the same way.\n *\n * @example\n * ```ts\n * readonly #reconcile = new MicrotaskCoalescer(() => this.#reconcileOptions());\n *\n * connect()    { this.#reconcile.activate(); }\n * disconnect() { this.#reconcile.cancel(); }\n *\n * optionTargetConnected()    { this.#reconcile.schedule(); }\n * optionTargetDisconnected() { this.#reconcile.schedule(); }\n * ```\n */\nexport class MicrotaskCoalescer {\n  readonly #run: () => void;\n  #queued = false;\n  #active = false;\n  #generation = 0;\n\n  /** @param run - the single reconciliation pass, invoked at most once per batch. */\n  constructor(run: () => void) {\n    this.#run = run;\n  }\n\n  /** Opens the window in which {@link schedule} is honoured; call from `connect()`. */\n  activate(): void {\n    this.#active = true;\n  }\n\n  /** Closes the window and drops any pending pass; call from `disconnect()`. */\n  cancel(): void {\n    this.#active = false;\n    this.#queued = false;\n    this.#generation += 1;\n  }\n\n  /** Whether a requested pass has yet to run. */\n  get pending(): boolean {\n    return this.#queued;\n  }\n\n  /** Requests one pass after the batch settles. Idempotent; inert outside the window. */\n  schedule(): void {\n    if (!this.#active || this.#queued) return;\n    this.#queued = true;\n    const generation = this.#generation;\n    queueMicrotask(() => {\n      // A cancelled callback must not consume a pass queued after reconnect.\n      if (generation !== this.#generation || !this.#queued || !this.#active) return;\n      this.#queued = false;\n      this.#run();\n    });\n  }\n}\n","import { ListenerSet } from \"./listener_set\";\nimport { MicrotaskCoalescer } from \"./microtask_coalescer\";\n\n/**\n * Coalesces retained-element morphs and explicit lifecycle requests into one pass.\n *\n * Observe the controller's element after its initial state is settled. Morphs on\n * that element and bubbling morphs on its descendants share the same microtask\n * as {@link schedule}. The callback repairs derived output; the controller owns\n * any logical transition reporting. {@link disconnect} releases the listener and\n * cancels pending work, including work from an earlier connected lifetime.\n */\nexport class MorphRenderWatcher {\n  readonly #listeners = new ListenerSet();\n  readonly #pass: MicrotaskCoalescer;\n  #element: Element | null = null;\n  readonly #onMorph = (): void => this.#pass.schedule();\n\n  /** @param run - the single pass that repairs the settled controller's output. */\n  constructor(run: () => void) {\n    this.#pass = new MicrotaskCoalescer(run);\n  }\n\n  /** Opens observation; observing the same element again preserves queued work. */\n  observe(element: Element): void {\n    if (this.#element === element) return;\n    this.disconnect();\n    this.#element = element;\n    this.#pass.activate();\n    this.#listeners.add(element, \"turbo:morph-element\", this.#onMorph);\n  }\n\n  /** Requests one pass; requests outside an observed lifetime are ignored. */\n  schedule(): void {\n    this.#pass.schedule();\n  }\n\n  /** Whether a pass requested by a morph or {@link schedule} has yet to run. */\n  get pending(): boolean {\n    return this.#pass.pending;\n  }\n\n  /** Releases observation and pending work synchronously; safe to repeat. */\n  disconnect(): void {\n    this.#listeners.dispose();\n    this.#pass.cancel();\n    this.#element = null;\n  }\n}\n","import { readNumber } from \"./coerce\";\nimport { matchesNumberBounds, type NumberBounds } from \"./number_bounds\";\n\n/** The instance identity carried by a Number Value read. */\nexport interface NumberValueOwner {\n  readonly identifier: string;\n  readonly element: Element;\n}\n\n/** Reads current declarations at the point of use without rewriting their attributes. */\nexport class NumberValueReader {\n  /** The last rejected literal per Value; no history grows for an unchanged instance. */\n  readonly #lastRejected = new Map<string, string>();\n\n  /** Resolves the declared number using its own fallback and shared class contract. */\n  read(\n    owner: NumberValueOwner,\n    name: string,\n    raw: number,\n    fallback: number,\n    bounds: NumberBounds,\n  ): number {\n    const resolved = readNumber(raw, fallback, bounds);\n    if (matchesNumberBounds(raw, bounds)) {\n      this.#lastRejected.delete(name);\n      return resolved;\n    }\n    const attribute = `data-${owner.identifier}-${name.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`)}-value`;\n    const literal = owner.element.getAttribute(attribute);\n    if (literal === null) {\n      this.#lastRejected.delete(name);\n      return resolved;\n    }\n    if (this.#lastRejected.get(name) !== literal) {\n      this.#lastRejected.set(name, literal);\n      console.warn(\n        `Stimeo UI: \"${owner.identifier}\" has an invalid number Value \"${name}\" declaration ${JSON.stringify(literal)}; using ${fallback}.`,\n      );\n    }\n    return resolved;\n  }\n}\n","/**\n * Self-cleaning timer registries shared by Stimeo controllers.\n *\n * Stimulus controllers frequently schedule `setTimeout` / `setInterval` work\n * (auto-dismiss, debouncing, polling). When the element leaves the DOM — a\n * Turbo Drive navigation, a Turbo Stream replacement, or any `disconnect()` —\n * orphaned timers keep firing against a detached controller, leaking memory and\n * mutating stale state. {@link SafeTimeout} and {@link SafeInterval} track every\n * timer they create so a single {@link TimerRegistry.clearAll | clearAll()} call\n * in `disconnect()` tears them all down.\n *\n * These are intentionally low-level primitives: they own *registration and\n * cleanup only*. One pending timer per key is `KeyedTimers`\n * (`keyed_timers.ts`), and a timer a person can hold open, with its remaining-time\n * accounting, is `PausableTimers` (`pausable_timers.ts`).\n */\n\nexport { MAX_TIMER_DELAY_MS } from \"./timer_bounds\";\n\n/**\n * Shared registry bookkeeping for the timeout/interval variants.\n *\n * Subclasses provide the scheduling primitive ({@link schedule}) and its matching\n * canceller ({@link cancel}); this base owns the set of live ids plus the\n * per-id and bulk teardown shared by both.\n */\nabstract class TimerRegistry {\n  /** Live timer ids that have not yet been cleared (or, for timeouts, fired). */\n  protected readonly ids = new Set<number>();\n\n  /** Schedules the underlying platform timer and returns its id. */\n  protected abstract schedule(callback: () => void, delay: number): number;\n\n  /** Cancels the underlying platform timer for `id`. */\n  protected abstract cancel(id: number): void;\n\n  /**\n   * Cancels a single tracked timer.\n   *\n   * No-ops if the id is unknown (already cleared, fired, or never owned by this\n   * registry), so callers can clear defensively without guarding.\n   */\n  clear(id: number): void {\n    if (this.ids.delete(id)) {\n      this.cancel(id);\n    }\n  }\n\n  /**\n   * Cancels every tracked timer. Call this from a controller's `disconnect()`\n   * to guarantee no timer outlives the element.\n   */\n  clearAll(): void {\n    for (const id of this.ids) {\n      this.cancel(id);\n    }\n    this.ids.clear();\n  }\n\n  /** Number of timers currently tracked (pending). */\n  get size(): number {\n    return this.ids.size;\n  }\n}\n\n/**\n * `setTimeout` wrapper that auto-forgets each timer once it fires and supports\n * bulk teardown on disconnect.\n *\n * @example\n * ```ts\n * #timers = new SafeTimeout();\n *\n * connect() {\n *   this.#timers.set(() => this.dismiss(), 5000);\n * }\n *\n * disconnect() {\n *   this.#timers.clearAll();\n * }\n * ```\n */\nexport class SafeTimeout extends TimerRegistry {\n  /**\n   * Schedules `callback` after `delay` ms and returns the timer id.\n   *\n   * The id is removed from the registry automatically when the timeout fires,\n   * so {@link TimerRegistry.size | size} reflects only still-pending timers.\n   */\n  set(callback: () => void, delay: number): number {\n    const id = this.schedule(() => {\n      this.ids.delete(id);\n      callback();\n    }, delay);\n    this.ids.add(id);\n    return id;\n  }\n\n  protected schedule(callback: () => void, delay: number): number {\n    return window.setTimeout(callback, delay);\n  }\n\n  protected cancel(id: number): void {\n    window.clearTimeout(id);\n  }\n}\n\n/**\n * `setInterval` wrapper that tracks every interval for bulk teardown on\n * disconnect. Unlike {@link SafeTimeout}, intervals are retained until they are\n * explicitly cleared because they fire repeatedly.\n *\n * @example\n * ```ts\n * #intervals = new SafeInterval();\n *\n * connect() {\n *   this.#intervals.set(() => this.tick(), 1000);\n * }\n *\n * disconnect() {\n *   this.#intervals.clearAll();\n * }\n * ```\n */\nexport class SafeInterval extends TimerRegistry {\n  /** Schedules a repeating `callback` every `delay` ms and returns the timer id. */\n  set(callback: () => void, delay: number): number {\n    const id = this.schedule(callback, delay);\n    this.ids.add(id);\n    return id;\n  }\n\n  protected schedule(callback: () => void, delay: number): number {\n    return window.setInterval(callback, delay);\n  }\n\n  protected cancel(id: number): void {\n    window.clearInterval(id);\n  }\n}\n","/**\n * JSON string-list parsing for the controllers that take a list as a Value.\n *\n * Stimulus offers an `Array` Value type, but its reader runs `JSON.parse` inside\n * the value observer — **before** the `<name>ValueChanged` callback — and\n * rethrows on malformed text. The throw propagates out of the observer that runs\n * during connection, so a single unparseable attribute stops the controller from\n * connecting at all: no lifecycle callback runs and the element is left inert\n * rather than degraded. A consumer cannot guard against it either, because the\n * callback that would hold the `try` never runs.\n *\n * Declaring the attribute as a `String` Value and parsing it here keeps a\n * malformed declaration local to the value it declares. The attribute text is\n * identical either way (`'[\"a\", \"b\"]'`), so markup does not change with the\n * declaration.\n */\n\n/**\n * Parses `raw` as a JSON array of strings.\n *\n * Returns `fallback` when the text is absent, unparseable, or not an array, so a\n * malformed declaration behaves like an omitted one. A parsed array keeps only\n * its string entries: every caller indexes or compares strings, and a stray\n * number would otherwise sit in the list without ever matching.\n *\n * An explicit `\"[]\"` is honoured as an empty list rather than falling back — it\n * is the only way to declare \"none\" against a non-empty default.\n *\n * @param raw - the attribute text, e.g. `'[\"password\"]'`.\n * @param fallback - the list to use when `raw` declares nothing usable.\n */\nexport function parseStringList(raw: string, fallback: readonly string[] = []): string[] {\n  // The common case is an undeclared attribute, and `JSON.parse(\"\")` answers it\n  // by throwing. Reaching the same fallback without building an exception keeps\n  // the callers that ask per element off that path.\n  const text = raw.trim();\n  if (text.length === 0) return [...fallback];\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(text);\n  } catch {\n    return [...fallback];\n  }\n\n  if (!Array.isArray(parsed)) return [...fallback];\n  return parsed.filter((entry): entry is string => typeof entry === \"string\");\n}\n","import { Controller } from \"@hotwired/stimulus\";\nimport { announce, fillTemplate } from \"../utils/announce\";\nimport { toFiniteNumber } from \"../utils/coerce\";\nimport { MorphRenderWatcher } from \"../utils/morph_render_watcher\";\nimport { NUMBER_BOUNDS, type NumberValueConstraints } from \"../utils/number_bounds\";\nimport { NumberValueReader } from \"../utils/number_value\";\nimport { SafeTimeout } from \"../utils/safe_timeout\";\nimport { parseStringList } from \"../utils/string_list\";\n\n/**\n * Event shape {@link PasswordStrengthController.setScore} accepts: an action param\n * `score` or a `detail.score`. Both are typed `number | string` because, while\n * Stimulus coerces numeric action params to numbers, a `CustomEvent` (or a\n * non-numeric-looking param) may carry a string.\n */\ntype SetScoreEvent = Event & {\n  params?: { score?: number | string };\n  detail?: { score?: number | string };\n};\n\n/** One scoring pass: the level it lands on plus everything drawn from it. */\ninterface StrengthReading {\n  readonly score: number;\n  readonly level: string;\n  readonly max: number;\n  readonly meetsMin: boolean;\n  readonly band: string;\n}\n\n/** The public derived state `change` and `reconcile` both carry. */\ntype PasswordStrengthDetail = Pick<StrengthReading, \"score\" | \"level\" | \"max\" | \"meetsMin\">;\n\n/** Character classes that contribute to password variety (one point each beyond the first). */\nconst CLASS_PATTERNS: readonly RegExp[] = [/[a-z]/, /[A-Z]/, /[0-9]/, /[^A-Za-z0-9]/];\n\n/** Strength labels used unless the consumer declares its own scale. */\nconst DEFAULT_LEVELS = [\"weak\", \"fair\", \"good\", \"strong\"];\n\n/** Length milestones that each add a strength point. */\nconst LENGTH_MILESTONES: readonly number[] = [8, 12, 16];\n\n/** Upper bound of the raw heuristic points, used to bucket into the level scale. */\nconst MAX_POINTS = LENGTH_MILESTONES.length + (CLASS_PATTERNS.length - 1);\n\n/**\n * Fixed, locale-independent styling bands `data-strength` is drawn from. Kept\n * separate from the (localizable) `levels` labels so `data-strength` stays a\n * stable CSS hook (e.g. `[data-strength=\"weak\"]`) even when `levels` is\n * translated. Ascending: weakest → strongest.\n */\nconst STRENGTH_BANDS = [\"weak\", \"fair\", \"good\", \"strong\"] as const;\n\n/**\n * Fewest labels an ordered scale can carry. One label orders nothing and none\n * leaves the meter a zero-width range, so a shorter declaration resolves to\n * {@link DEFAULT_LEVELS} — which also makes `max >= 2` an invariant every\n * consumer of the scale can rely on.\n */\nconst MIN_LEVELS = 2;\n\n/**\n * Headless password-strength behavior: scores the field with a lightweight\n * zero-dependency heuristic and drives a meter plus a visible level readout. No\n * dedicated APG pattern; the meter display follows `stimeo--meter`.\n *\n * Markup contract (identifier: `stimeo--password-strength`):\n *   <div data-controller=\"stimeo--password-strength\"\n *        data-stimeo--password-strength-announce-text-value=\"Password strength: {level}\">\n *     <input type=\"password\" data-stimeo--password-strength-target=\"input\"\n *            data-action=\"input->stimeo--password-strength#evaluate\" aria-describedby=\"pw\">\n *     <div data-stimeo--password-strength-target=\"meter\" role=\"meter\"\n *          aria-label=\"Password strength\" aria-valuemin=\"0\" aria-valuemax=\"4\"></div>\n *     <span id=\"pw\" data-stimeo--password-strength-target=\"label\"></span>\n *   </div>\n *\n * On each input the controller scores the password (length milestones + character\n * variety, capped for trivial repetition), syncs the meter's `aria-valuenow`,\n * reflects a stable band on `data-strength`, the `0–1` fill on\n * `--stimeo--password-strength`, and (when `minScore` is set) `data-below-min`,\n * and writes the level label into the label target.\n *\n * `change` and `reconcile` dispatch `{ score, level, max, meetsMin }`.\n *\n * @remarks\n * Behavior only — the meter/bar look is the consumer's, keyed off the data hooks.\n * `data-strength` is one of the fixed bands `weak` / `fair` / `good` / `strong`\n * (not the localizable\n * `levels` text), so consumers can style by it regardless of locale; the visible\n * label receives the matching `levels` entry. Every visible and non-text output\n * updates on the keystroke that caused it, so the readout never trails the meter.\n *\n * Assistive notification is opt-in and i18n-neutral: `announceText` accepts\n * `{level}`, `{score}`, `{max}` and `{band}`, and one settled message is handed to\n * the page's shared `stimeo--announcer` after a short debounce. Only a level the\n * reader has not already heard is sent, so typing inside one level stays quiet.\n * The label target is plain visible output and is not itself a live region.\n *\n * The score is a pure function of the field value (no module-scope state), so\n * `connect()` re-evaluates idempotently; the initial reflection never dispatches\n * or announces. Runtime Value and target changes repaint on a microtask and\n * dispatch `reconcile` only when the public derived state actually moves; so does\n * the reading `connect()` takes again once the batch that connected it has settled,\n * which a controller connecting later may have changed by rewriting the field. Turbo\n * empties a password field in the copy it caches, and the connection that adopts a\n * restored copy derives the reading from the field as it comes back, so\n * `turbo:before-cache`, which Turbo also dispatches on pages that stay, changes\n * nothing. The estimator is intentionally not a dictionary/zxcvbn-grade\n * one (kept zero-dep); a consumer that needs a stronger one computes the score\n * itself and hands it over through {@link setScore}.\n */\nexport class PasswordStrengthController extends Controller<HTMLElement> {\n  /** Numeric read boundaries share one reader for this controller instance. */\n  readonly #numbers = new NumberValueReader();\n\n  static override targets = [\"input\", \"meter\", \"label\"];\n  static override values = {\n    minScore: { type: Number, default: 0 },\n    // A JSON list read through `parseStringList` rather than Stimulus's `Array`\n    // type: that reader throws out of the value observer before any callback\n    // runs, so one malformed attribute would stop the meter connecting.\n    levels: { type: String, default: \"\" },\n    announceText: { type: String, default: \"\" },\n  };\n\n  static valueConstraints = {\n    minScore: NUMBER_BOUNDS.nonNegative,\n  } satisfies NumberValueConstraints<typeof PasswordStrengthController.values>;\n  static actions = [\"evaluate\", \"setScore\"] as const;\n  static events = [\"change\", \"reconcile\"] as const;\n\n  declare readonly inputTarget: HTMLInputElement;\n  declare readonly meterTarget: HTMLElement;\n  declare readonly labelTarget: HTMLElement;\n  declare readonly hasInputTarget: boolean;\n  declare readonly hasMeterTarget: boolean;\n  declare readonly hasLabelTarget: boolean;\n\n  declare minScoreValue: number;\n  declare levelsValue: string;\n  declare announceTextValue: string;\n\n  /** Delay (ms) before one settled level is sent to the shared announcer. */\n  static readonly #announceDelay = 200;\n\n  readonly #timers = new SafeTimeout();\n  readonly #repaint = new MorphRenderWatcher(() => this.#reconcile());\n  #levels: string[] = [...DEFAULT_LEVELS];\n  #announceId: number | null = null;\n  #announcedLevel: string | null = null;\n  #externalScore: number | null = null;\n  #lastDetail: PasswordStrengthDetail | null = null;\n\n  /** Reflects the current DOM state and opens the reconciliation window. */\n  override connect(): void {\n    this.#repaint.observe(this.element);\n    // Reflect the current value synchronously (no event, no announcement): an\n    // autofilled or cache-restored field shows the right strength without\n    // queuing a screen-reader message.\n    this.#lastDetail = this.#detail(this.#render());\n    // A controller connecting after this one in the same batch may rewrite the field\n    // without an input event, as a password reveal empties a revealed field that a\n    // restored copy carries: the field is read again once the batch has settled.\n    this.#repaint.schedule();\n  }\n\n  /** Releases the reconciliation window and the debounce. */\n  override disconnect(): void {\n    this.#repaint.disconnect();\n    this.#cancelAnnouncement();\n    this.#announcedLevel = null;\n    this.#externalScore = null;\n    this.#lastDetail = null;\n  }\n\n  /** Re-evaluates strength from the input. Bound via `data-action` (`input`). */\n  evaluate(): void {\n    this.#externalScore = null;\n    this.#commit();\n  }\n\n  /**\n   * Adopts a score computed outside the built-in heuristic, clamped into the\n   * declared scale. An unreadable value leaves the current score standing, and\n   * the next `evaluate` hands scoring back to the heuristic.\n   */\n  setScore(event: SetScoreEvent): void {\n    const next = toFiniteNumber(event.params?.score ?? event.detail?.score);\n    if (next === null) return;\n    this.#externalScore = next;\n    this.#commit();\n  }\n\n  /** Re-reads the scale when application code or a Turbo morph changes `levels`. */\n  levelsValueChanged(): void {\n    this.#levels = this.#readLevels();\n    this.#repaint.schedule();\n  }\n\n  /** Repaints when application code or a Turbo morph changes `minScore`. */\n  minScoreValueChanged(): void {\n    this.#repaint.schedule();\n  }\n\n  /** Repaints when application code or a Turbo morph changes `announceText`. */\n  announceTextValueChanged(): void {\n    this.#repaint.schedule();\n  }\n\n  /** Scores the field added or replaced at runtime. */\n  inputTargetConnected(): void {\n    this.#repaint.schedule();\n  }\n\n  /** Falls back to the pristine state after the scored field is removed. */\n  inputTargetDisconnected(): void {\n    this.#repaint.schedule();\n  }\n\n  /** Syncs a meter added or replaced at runtime, which carries no value yet. */\n  meterTargetConnected(): void {\n    this.#repaint.schedule();\n  }\n\n  /** Repaints the remaining output after a meter is removed. */\n  meterTargetDisconnected(): void {\n    this.#repaint.schedule();\n  }\n\n  /** Fills a readout added or replaced at runtime. */\n  labelTargetConnected(): void {\n    this.#repaint.schedule();\n  }\n\n  /** Repaints the remaining output after a readout is removed. */\n  labelTargetDisconnected(): void {\n    this.#repaint.schedule();\n  }\n\n  /** Reflects one confirmed scoring pass and offers its level to the reader. */\n  #commit(): void {\n    const reading = this.#render();\n    this.#lastDetail = this.#detail(reading);\n    this.dispatch(\"change\", { detail: this.#lastDetail });\n    this.#scheduleAnnouncement(reading);\n  }\n\n  /** Repaints one mutation batch and reports a changed controller-derived state. */\n  #reconcile(): void {\n    const previous = this.#lastDetail;\n    // An edit inside the debounce window has already earned an announcement.\n    // Reconciliation never originates one, but it must not carry a stale one\n    // through either: the pending message is built from the level and the\n    // template that held when it was queued, and both can move here. It is\n    // retargeted at the settled reading so the reader hears what ends up shown.\n    const owed = this.#announceId !== null;\n    const reading = this.#render();\n    const detail = this.#detail(reading);\n    this.#lastDetail = detail;\n    // A blank readout has no level left to have been heard, here as much as on\n    // the keystroke that empties the field, so the next level typed is news.\n    if (reading.score === 0) this.#announcedLevel = null;\n    if (owed) this.#scheduleAnnouncement(reading);\n    if (previous && this.#detailsDiffer(previous, detail)) {\n      this.dispatch(\"reconcile\", { detail });\n    }\n  }\n\n  /**\n   * Synchronizes the meter ARIA, the root state hooks, the fill custom property\n   * and the visible level readout.\n   *\n   * @stimeoRenderRoot\n   */\n  #render(): StrengthReading {\n    const max = this.#levels.length;\n    const score = this.#currentScore(max);\n    const level = this.#levels[score - 1] ?? \"\";\n    const meetsMin = score > 0 && score >= this.#minScore;\n    const band = this.#band(score, max);\n\n    this.#reflectMeter(score, max);\n    this.#reflectRoot(score, max, band, meetsMin);\n    this.#writeLabel(level);\n    return { score, level, max, meetsMin, band };\n  }\n\n  /**\n   * The declared minimum, or the Value's default (`0`, an inert gate) when the\n   * declaration cannot be read as a number. Every comparison against an unread\n   * number answers false, which would fail even the strongest password instead\n   * of leaving the gate off, so the unreadable declaration is confined to its\n   * own Value the way an unreadable scale is.\n   */\n  get #minScore(): number {\n    return this.#safeMinScore;\n  }\n\n  /** The externally supplied score when one stands, else the heuristic's. */\n  #currentScore(max: number): number {\n    if (this.#externalScore !== null) {\n      return Math.min(max, Math.max(0, Math.round(this.#externalScore)));\n    }\n    return this.#score(this.hasInputTarget ? this.inputTarget.value : \"\", max);\n  }\n\n  /** Syncs the meter target's ARIA value attributes (`0..levels.length`). */\n  #reflectMeter(score: number, max: number): void {\n    if (!this.hasMeterTarget) return;\n    this.meterTarget.setAttribute(\"aria-valuemin\", \"0\");\n    this.meterTarget.setAttribute(\"aria-valuemax\", String(max));\n    this.meterTarget.setAttribute(\"aria-valuenow\", String(score));\n  }\n\n  /**\n   * Reflects the level onto the root: the stable `data-strength` band (absent when\n   * empty), the `data-below-min` hook when the score is under `minScore`, and the\n   * `0–1` fill the consumer's CSS turns into the bar width.\n   */\n  #reflectRoot(score: number, max: number, band: string, meetsMin: boolean): void {\n    this.#toggle(\"data-strength\", band, band.length > 0);\n    // Empty/pristine input (`score === 0`) is never \"below min\": that would let CSS\n    // flag an untouched field as failing. The hook mirrors the event's `meetsMin`,\n    // so it only marks a *non-empty* password under the threshold. `minScore`\n    // defaults to 0, leaving the hook inert until set positive.\n    this.#toggle(\"data-below-min\", \"true\", score > 0 && !meetsMin);\n    this.element.style.setProperty(\"--stimeo--password-strength\", String(score / max));\n  }\n\n  /** Writes the visible readout only when its text actually changed. */\n  #writeLabel(text: string): void {\n    if (!this.hasLabelTarget || this.labelTarget.textContent === text) return;\n    this.labelTarget.textContent = text;\n  }\n\n  /**\n   * Locale-independent styling band (one of {@link STRENGTH_BANDS}) for `score`\n   * out of `max`. Empty input → `\"\"`. Maps the position within the declared scale\n   * onto the position within the fixed bands, so both ends stay anchored on any\n   * level count: the weakest score is always `weak` and the strongest `strong`,\n   * and only the middle collapses when the scales differ in size.\n   */\n  #band(score: number, max: number): string {\n    if (score <= 0) return \"\";\n    const index = Math.round(((score - 1) / (max - 1)) * (STRENGTH_BANDS.length - 1));\n    // A scored password always lands inside the band list; an unplaceable one\n    // takes the weakest rather than claiming strength it was not measured to have.\n    return STRENGTH_BANDS[index] ?? STRENGTH_BANDS[0];\n  }\n\n  /** Sets `name` to `value` when `on`, else removes it (value/presence data hook). */\n  #toggle(name: string, value: string, on: boolean): void {\n    if (on) {\n      this.element.setAttribute(name, value);\n    } else {\n      this.element.removeAttribute(name);\n    }\n  }\n\n  /** The declared level labels, or the defaults when the scale cannot order. */\n  #readLevels(): string[] {\n    const declared = parseStringList(this.levelsValue, DEFAULT_LEVELS);\n    return declared.length >= MIN_LEVELS ? declared : [...DEFAULT_LEVELS];\n  }\n\n  /**\n   * Lightweight zero-dependency strength heuristic returning an integer in\n   * `[0, max]` (`max` = number of levels). Empty input is `0` (no level); any\n   * non-empty password is at least `1`. Points accrue from length milestones and\n   * character-class variety, then bucket into the level scale. A tiny alphabet\n   * (≤ 2 distinct characters, e.g. \"aaaa\") is capped as the weakest, so length\n   * alone cannot mask trivial repetition.\n   */\n  #score(password: string, max: number): number {\n    if (password.length === 0) return 0;\n\n    let points = 0;\n    for (const milestone of LENGTH_MILESTONES) {\n      if (password.length >= milestone) points += 1;\n    }\n    // The first present character class is free; each additional one adds a point.\n    points += CLASS_PATTERNS.filter((re) => re.test(password)).length - 1;\n\n    if (new Set(password).size <= 2) points = 0; // trivial repetition → weakest\n\n    const bucketed = Math.round((points / MAX_POINTS) * max);\n    return Math.min(max, Math.max(1, bucketed));\n  }\n\n  /** Debounces one i18n-neutral message for a level transition into the announcer. */\n  #scheduleAnnouncement(reading: StrengthReading): void {\n    this.#cancelAnnouncement();\n    if (reading.score === 0) {\n      // An emptied field has no level to read, and the next one typed is news.\n      this.#announcedLevel = null;\n      return;\n    }\n    if (reading.level === this.#announcedLevel) return;\n\n    const message = fillTemplate(this.announceTextValue, {\n      level: reading.level,\n      score: reading.score,\n      max: reading.max,\n      band: reading.band,\n    });\n    if (message.trim().length === 0) return;\n\n    this.#announceId = this.#timers.set(() => {\n      this.#announcedLevel = reading.level;\n      announce(message);\n      this.#announceId = null;\n    }, PasswordStrengthController.#announceDelay);\n  }\n\n  /** Cancels the one outstanding message without touching visible output. */\n  #cancelAnnouncement(): void {\n    if (this.#announceId !== null) this.#timers.clear(this.#announceId);\n    this.#announceId = null;\n  }\n\n  /** Selects the public event state from the richer internal reading. */\n  #detail(reading: StrengthReading): PasswordStrengthDetail {\n    return {\n      score: reading.score,\n      level: reading.level,\n      max: reading.max,\n      meetsMin: reading.meetsMin,\n    };\n  }\n\n  /** Compares exactly the state carried by `change` and `reconcile`. */\n  #detailsDiffer(left: PasswordStrengthDetail, right: PasswordStrengthDetail): boolean {\n    return (\n      left.score !== right.score ||\n      left.level !== right.level ||\n      left.max !== right.max ||\n      left.meetsMin !== right.meetsMin\n    );\n  }\n  /** Current `minScore` declaration resolved against its numeric contract. */\n  get #safeMinScore(): number {\n    return this.#numbers.read(\n      this,\n      \"minScore\",\n      this.minScoreValue,\n      PasswordStrengthController.values.minScore.default,\n      PasswordStrengthController.valueConstraints.minScore,\n    );\n  }\n}\n"]}

package/dist/controllers/persist_controller.d.ts

@@ -13,8 +13,10 @@ import { Controller } from '@hotwired/stimulus';
  *
  * The optional `field` targets restrict persistence to explicitly targeted
  * controls. The public `clear` action removes the active draft. `key`,
- * `debounce`, `exclude`, and `clearOn` Values can change while connected;
- * `clearOn` is an event name whose occurrence invokes `clear`.
+ * `exclude`, and `clearOn` Values can change while connected; `clearOn` is an
+ * event name whose occurrence invokes `clear`. `debounce` is read as each edit
+ * schedules its save: a pending save keeps the deadline its edit gave it, and
+ * the next edit takes the new value.
  *
  * `restore`, `save`, and `clear` dispatch `{ key: string }`. `error` dispatches
  * `{ key: string, operation: "read" | "write" | "remove", reason:
@@ -52,6 +54,13 @@ declare class PersistController extends Controller<HTMLElement> {
             default: string;
         };
     };
+    static valueConstraints: {
+        debounce: {
+            readonly finite: true;
+            readonly min: 0;
+            readonly max: 2147483647;
+        };
+    };
     static actions: readonly ["clear"];
     static events: readonly ["restore", "save", "clear", "error"];
     readonly fieldTargets: Element[];
@@ -68,8 +77,6 @@ declare class PersistController extends Controller<HTMLElement> {
     clearOnValueChanged(): void;
     /** Switches storage namespaces without writing old edits under the new key. */
     keyValueChanged(): void;
-    /** Reschedules a pending write against the current debounce delay. */
-    debounceValueChanged(): void;
     /** Restores every field the new exclusion list makes eligible. */
     excludeValueChanged(): void;
 }