use-password-policy 2.0.0 → 3.0.0

package/dist/index.js

@@ -1,3 +1,4 @@
+'use client';
 "use strict";
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -28,251 +29,695 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
-var index_exports = {};
-__export(index_exports, {
+var src_exports = {};
+__export(src_exports, {
+  COMMON_PASSWORDS: () => COMMON_PASSWORDS,
+  DEFAULT_MESSAGES: () => DEFAULT_MESSAGES,
+  DEFAULT_OPTIONS: () => DEFAULT_OPTIONS,
   PasswordPolicyInput: () => PasswordPolicyInput,
-  usePasswordPolicy: () => usePasswordPolicy
+  checkPwnedPassword: () => checkPwnedPassword,
+  fromZxcvbn: () => fromZxcvbn,
+  isCommonPassword: () => isCommonPassword,
+  passwordPolicyInputCss: () => passwordPolicyInputCss,
+  passwordValidator: () => passwordValidator,
+  presets: () => presets,
+  resolveOptions: () => resolveOptions,
+  usePasswordPolicy: () => usePasswordPolicy,
+  usePwnedPassword: () => usePwnedPassword,
+  validatePassword: () => validatePassword,
+  zodPasswordRule: () => zodPasswordRule
 });
-module.exports = __toCommonJS(index_exports);
+module.exports = __toCommonJS(src_exports);
 
 // src/use-password-policy.ts
 var import_react = require("react");
-var DEFAULT_POLICIES = [
-  {
-    name: "minLength",
-    optionsKey: "minLength",
-    test: (password, options) => password.length >= options.minLength
-  },
-  {
-    name: "uppercase",
-    optionsKey: "uppercaseCheck",
-    test: (password, options) => options.uppercaseRegex.test(password)
-  },
-  {
-    name: "lowercase",
-    optionsKey: "lowercaseCheck",
-    test: (password, options) => options.lowercaseRegex.test(password)
-  },
-  {
-    name: "number",
-    optionsKey: "numberCheck",
-    test: (password, options) => options.numberRegex.test(password)
-  },
-  {
-    name: "specialChar",
-    optionsKey: "specialCharCheck",
-    test: (password, options) => options.specialCharRegex.test(password)
-  }
+
+// src/common-passwords.ts
+var COMMON_PASSWORDS = [
+  // number sequences & repeats
+  "123456",
+  "1234567",
+  "12345678",
+  "123456789",
+  "1234567890",
+  "0123456789",
+  "111111",
+  "1111111",
+  "11111111",
+  "000000",
+  "00000000",
+  "123123",
+  "123321",
+  "654321",
+  "666666",
+  "777777",
+  "7777777",
+  "888888",
+  "88888888",
+  "999999",
+  "121212",
+  "112233",
+  "123654",
+  "987654321",
+  "147258369",
+  "159753",
+  "12341234",
+  "1q2w3e",
+  "1q2w3e4r",
+  "1q2w3e4r5t",
+  "1qaz2wsx",
+  "1qazxsw2",
+  "zaq12wsx",
+  // keyboard walks
+  "qwerty",
+  "qwertyu",
+  "qwertyuiop",
+  "qwe",
+  "qweasd",
+  "qweasdzxc",
+  "qwer",
+  "qazwsx",
+  "asdf",
+  "asdfgh",
+  "asdfghjkl",
+  "zxcvbn",
+  "zxcvbnm",
+  "azerty",
+  "qwertz",
+  "abc",
+  "abcd",
+  "abcde",
+  "abcdef",
+  "abcdefg",
+  "abcdefgh",
+  "aaaaaa",
+  // the classics
+  "password",
+  "pass",
+  "passwort",
+  "passpass",
+  "secret",
+  "letmein",
+  "welcome",
+  "admin",
+  "administrator",
+  "root",
+  "login",
+  "user",
+  "guest",
+  "test",
+  "default",
+  "changeme",
+  "access",
+  "master",
+  "trustno",
+  "whatever",
+  "nothing",
+  "unknown",
+  "iloveyou",
+  "loveme",
+  "love",
+  "lovely",
+  "hello",
+  "hellokitty",
+  "freedom",
+  "monkey",
+  "dragon",
+  "shadow",
+  "sunshine",
+  "princess",
+  "superman",
+  "batman",
+  "spiderman",
+  "starwars",
+  "pokemon",
+  "naruto",
+  "matrix",
+  "ninja",
+  "killer",
+  "football",
+  "baseball",
+  "basketball",
+  "soccer",
+  "hockey",
+  "golf",
+  "tennis",
+  "liverpool",
+  "arsenal",
+  "chelsea",
+  "barcelona",
+  "realmadrid",
+  "juventus",
+  "mustang",
+  "ferrari",
+  "porsche",
+  "harley",
+  "corvette",
+  "mercedes",
+  "computer",
+  "internet",
+  "google",
+  "apple",
+  "samsung",
+  "facebook",
+  "linkedin",
+  "myspace",
+  "youtube",
+  "twitter",
+  "instagram",
+  "microsoft",
+  "windows",
+  "summer",
+  "winter",
+  "spring",
+  "autumn",
+  "monday",
+  "friday",
+  "sunday",
+  "flower",
+  "cheese",
+  "cookie",
+  "chocolate",
+  "pepper",
+  "ginger",
+  "banana",
+  "orange",
+  "purple",
+  "silver",
+  "golden",
+  "diamond",
+  "money",
+  "angel",
+  "michael",
+  "jennifer",
+  "jessica",
+  "ashley",
+  "jordan",
+  "hunter",
+  "ranger",
+  "buster",
+  "tigger",
+  "charlie",
+  "robert",
+  "thomas",
+  "daniel",
+  "andrew",
+  "joshua",
+  "maggie",
+  "bailey",
+  "matthew",
+  "anthony"
 ];
+
+// src/pwned.ts
+var HIBP_RANGE = "https://api.pwnedpasswords.com/range/";
+async function sha1Hex(input) {
+  var _a2;
+  const subtle = (_a2 = globalThis.crypto) == null ? void 0 : _a2.subtle;
+  if (!subtle) {
+    throw new Error(
+      "use-password-policy: crypto.subtle is not available. It needs a secure context (https or localhost) in browsers, or Node 20+."
+    );
+  }
+  const digest = await subtle.digest("SHA-1", new TextEncoder().encode(input));
+  return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("").toUpperCase();
+}
+async function checkPwnedPassword(password, options = {}) {
+  var _a2, _b;
+  if (!password) return 0;
+  const doFetch = (_a2 = options.fetch) != null ? _a2 : globalThis.fetch;
+  if (!doFetch) throw new Error("use-password-policy: no fetch implementation available.");
+  const hash = await sha1Hex(password);
+  const prefix = hash.slice(0, 5);
+  const suffix = hash.slice(5);
+  const res = await doFetch(`${(_b = options.endpoint) != null ? _b : HIBP_RANGE}${prefix}`, {
+    signal: options.signal,
+    headers: options.padding ? { "Add-Padding": "true" } : void 0
+  });
+  if (!res.ok) throw new Error(`use-password-policy: breach check failed (HTTP ${res.status}).`);
+  const body = await res.text();
+  for (const line of body.split("\n")) {
+    const [lineSuffix, count] = line.trim().split(":");
+    if (lineSuffix === suffix) return parseInt(count, 10) || 0;
+  }
+  return 0;
+}
+
+// src/core.ts
 var DEFAULT_OPTIONS = {
   minLength: 8,
+  maxLength: 0,
   lowercaseCheck: true,
   uppercaseCheck: true,
   numberCheck: true,
   specialCharCheck: true,
+  commonPasswordCheck: false,
+  commonPasswords: COMMON_PASSWORDS,
   customRules: [],
+  messages: {},
   lowercaseRegex: /[a-z]/,
   uppercaseRegex: /[A-Z]/,
   numberRegex: /\d/,
-  specialCharRegex: /[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?`~]/
+  specialCharRegex: /[!@#$%^&*()_+\-=[\]{};':"\\|,.<>/?`~]/
 };
-var usePasswordPolicy = (options = {}) => {
-  const { password = "" } = options;
-  const mergedOptions = (0, import_react.useMemo)(
-    () => ({ ...DEFAULT_OPTIONS, ...options }),
-    [options]
-  );
-  const activePolicies = (0, import_react.useMemo)(() => {
-    const activeDefaultPolicies = DEFAULT_POLICIES.filter(
-      (policy) => policy.optionsKey && mergedOptions[policy.optionsKey]
-    );
-    return [...activeDefaultPolicies, ...mergedOptions.customRules];
-  }, [mergedOptions]);
-  const policyState = (0, import_react.useMemo)(() => {
-    const state = {};
-    for (const policy of activePolicies) {
-      state[policy.name] = policy.test(password, mergedOptions);
-    }
-    return state;
-  }, [password, activePolicies, mergedOptions]);
-  const { score, label, isValid } = (0, import_react.useMemo)(() => {
-    const passedPolicies = Object.values(policyState).filter(Boolean);
-    const score2 = passedPolicies.length;
-    const totalPolicies = activePolicies.length;
-    const strengthPercentage = totalPolicies > 0 ? score2 / totalPolicies : 0;
-    let label2 = "Very Weak";
-    if (strengthPercentage >= 1) {
-      label2 = "Very Strong";
-    } else if (strengthPercentage >= 0.75) {
-      label2 = "Strong";
-    } else if (strengthPercentage >= 0.5) {
-      label2 = "Medium";
-    } else if (strengthPercentage > 0) {
-      label2 = "Weak";
-    }
-    return {
-      score: score2,
-      label: label2,
-      isValid: score2 === totalPolicies && totalPolicies > 0
-    };
-  }, [policyState, activePolicies]);
+var presets = {
+  /** The classic checklist (these are also the defaults): 8+ chars, upper, lower, number, symbol. */
+  classic: {
+    minLength: 8,
+    lowercaseCheck: true,
+    uppercaseCheck: true,
+    numberCheck: true,
+    specialCharCheck: true
+  },
+  /**
+   * NIST SP 800-63B-4 (Aug 2025) for passwords used on their own:
+   * at least 15 characters, allow up to 64, no composition rules, block common passwords.
+   */
+  nist: {
+    minLength: 15,
+    maxLength: 64,
+    lowercaseCheck: false,
+    uppercaseCheck: false,
+    numberCheck: false,
+    specialCharCheck: false,
+    commonPasswordCheck: true
+  },
+  /** NIST SP 800-63B-4 when the password is one factor of MFA: at least 8 characters. */
+  nistMfa: {
+    minLength: 8,
+    maxLength: 64,
+    lowercaseCheck: false,
+    uppercaseCheck: false,
+    numberCheck: false,
+    specialCharCheck: false,
+    commonPasswordCheck: true
+  }
+};
+var DEFAULT_MESSAGES = {
+  minLength: (o) => `At least ${o.minLength} characters`,
+  maxLength: (o) => `At most ${o.maxLength} characters`,
+  uppercase: "An uppercase letter",
+  lowercase: "A lowercase letter",
+  number: "A number",
+  specialChar: "A special character",
+  notCommon: "Not a commonly used password",
+  match: "Passwords match",
+  strength: "Hard to guess"
+};
+var STRENGTH_LABELS = ["Very Weak", "Weak", "Medium", "Strong", "Very Strong"];
+function resolveOptions(options = {}) {
+  const merged = { ...DEFAULT_OPTIONS };
+  for (const [key, value] of Object.entries(options)) {
+    if (key !== "password" && value !== void 0) merged[key] = value;
+  }
+  return merged;
+}
+var LEET = { "@": "a", "4": "a", "8": "b", "3": "e", "1": "i", "!": "i", "0": "o", "$": "s", "5": "s", "7": "t" };
+var unleet = (s) => s.replace(/[@483!1$057]/g, (c) => {
+  var _a2;
+  return (_a2 = LEET[c]) != null ? _a2 : c;
+});
+var commonSetCache = /* @__PURE__ */ new WeakMap();
+function getCommonSet(list) {
+  let set = commonSetCache.get(list);
+  if (!set) {
+    set = new Set(list.map((p) => p.toLowerCase()));
+    commonSetCache.set(list, set);
+  }
+  return set;
+}
+function isCommonPassword(password, list = COMMON_PASSWORDS) {
+  if (!password) return false;
+  const set = getCommonSet(list);
+  const lower = password.toLowerCase();
+  const noTrailingSymbols = lower.replace(/[^a-z0-9]+$/, "");
+  const trimmed = lower.replace(/[^a-z]+$/, "");
+  const base = unleet(trimmed);
+  const baseNoLeading = unleet(trimmed.replace(/^[^a-z]+/, ""));
+  return [lower, noTrailingSymbols, base, baseNoLeading].some((c) => c.length > 0 && set.has(c));
+}
+var prettify = (name) => name.replace(/([A-Z])/g, " $1").replace(/^./, (s) => s.toUpperCase()).trim();
+function resolveMessage(rule, options) {
+  var _a2, _b;
+  const msg = (_b = (_a2 = options.messages[rule.name]) != null ? _a2 : rule.message) != null ? _b : DEFAULT_MESSAGES[rule.name];
+  if (typeof msg === "function") return msg(options);
+  return msg != null ? msg : prettify(rule.name);
+}
+function builtInRules(options, estimate) {
+  const rules = [];
+  if (options.minLength > 0) {
+    rules.push({ name: "minLength", optionsKey: "minLength", test: (p, o) => p.length >= o.minLength });
+  }
+  if (options.maxLength > 0) {
+    rules.push({ name: "maxLength", optionsKey: "maxLength", test: (p, o) => p.length <= o.maxLength });
+  }
+  if (options.uppercaseCheck) {
+    rules.push({ name: "uppercase", optionsKey: "uppercaseCheck", test: (p, o) => o.uppercaseRegex.test(p) });
+  }
+  if (options.lowercaseCheck) {
+    rules.push({ name: "lowercase", optionsKey: "lowercaseCheck", test: (p, o) => o.lowercaseRegex.test(p) });
+  }
+  if (options.numberCheck) {
+    rules.push({ name: "number", optionsKey: "numberCheck", test: (p, o) => o.numberRegex.test(p) });
+  }
+  if (options.specialCharCheck) {
+    rules.push({ name: "specialChar", optionsKey: "specialCharCheck", test: (p, o) => o.specialCharRegex.test(p) });
+  }
+  if (options.commonPasswordCheck) {
+    rules.push({
+      name: "notCommon",
+      optionsKey: "commonPasswordCheck",
+      test: (p, o) => p.length > 0 && !isCommonPassword(p, o.commonPasswords)
+    });
+  }
+  if (options.confirmPassword !== void 0) {
+    rules.push({
+      name: "match",
+      optionsKey: "confirmPassword",
+      test: (p, o) => p.length > 0 && p === o.confirmPassword
+    });
+  }
+  if (estimate && options.minStrength !== void 0) {
+    const min = options.minStrength;
+    rules.push({ name: "strength", optionsKey: "minStrength", test: () => estimate.score >= min });
+  }
+  return rules;
+}
+function validatePassword(password, options = {}) {
+  const pw = password != null ? password : "";
+  const resolved = resolveOptions(options);
+  const estimate = resolved.strengthEstimator ? resolved.strengthEstimator(pw) : void 0;
+  const rules = [...builtInRules(resolved, estimate), ...resolved.customRules];
+  const policyState = {};
+  const requirements = [];
+  const errors = [];
+  let passedCount = 0;
+  for (const rule of rules) {
+    const passed = Boolean(rule.test(pw, resolved));
+    const message = resolveMessage(rule, resolved);
+    policyState[rule.name] = passed;
+    requirements.push({ name: rule.name, passed, message });
+    if (passed) passedCount++;
+    else errors.push(message);
+  }
+  const total = rules.length;
+  let strengthPercent;
+  let strengthLabel;
+  if (estimate) {
+    const score = Math.max(0, Math.min(4, Math.round(estimate.score)));
+    strengthPercent = pw.length === 0 ? 0 : score / 4;
+    strengthLabel = STRENGTH_LABELS[score];
+  } else {
+    strengthPercent = total > 0 ? passedCount / total : 0;
+    if (strengthPercent >= 1) strengthLabel = "Very Strong";
+    else if (strengthPercent >= 0.75) strengthLabel = "Strong";
+    else if (strengthPercent >= 0.5) strengthLabel = "Medium";
+    else if (strengthPercent > 0) strengthLabel = "Weak";
+    else strengthLabel = "Very Weak";
+  }
   return {
-    password,
+    isValid: total > 0 && passedCount === total,
     policyState,
-    isValid,
-    strengthScore: score,
-    strengthLabel: label
+    requirements,
+    errors,
+    strengthScore: passedCount,
+    strengthPercent,
+    strengthLabel,
+    ...estimate ? { estimate } : {}
+  };
+}
+function fromZxcvbn(zxcvbn, userInputs) {
+  const run = typeof zxcvbn === "function" ? zxcvbn : (pw, inputs) => zxcvbn.check(pw, inputs);
+  return (password) => {
+    var _a2, _b, _c;
+    const result = run(password, userInputs);
+    const score = Math.max(0, Math.min(4, Math.round(result.score)));
+    const feedback = ((_a2 = result.feedback) == null ? void 0 : _a2.warning) || ((_c = (_b = result.feedback) == null ? void 0 : _b.suggestions) == null ? void 0 : _c[0]) || void 0;
+    return feedback ? { score, feedback } : { score };
+  };
+}
+function zodPasswordRule(options = {}, { allErrors = true } = {}) {
+  return (value, ctx) => {
+    const { errors } = validatePassword(value, options);
+    for (const message of allErrors ? errors : errors.slice(0, 1)) {
+      ctx.addIssue({ code: "custom", message });
+    }
   };
+}
+function passwordValidator(options = {}) {
+  return (value) => {
+    const { errors } = validatePassword(value != null ? value : "", options);
+    return errors.length === 0 ? true : errors[0];
+  };
+}
+
+// src/use-password-policy.ts
+var usePasswordPolicy = (options = {}) => {
+  const { password = "" } = options;
+  const result = (0, import_react.useMemo)(() => validatePassword(password, options), [password, options]);
+  return { password, ...result };
 };
+function usePwnedPassword(password, options = {}) {
+  const { enabled = true, debounceMs = 500, fetch: customFetch, endpoint, padding } = options;
+  const [state, setState] = (0, import_react.useState)({ status: "idle", count: 0, isPwned: false });
+  (0, import_react.useEffect)(() => {
+    if (!enabled || !password) {
+      setState({ status: "idle", count: 0, isPwned: false });
+      return;
+    }
+    const controller = new AbortController();
+    setState((s) => s.status === "checking" ? s : { status: "checking", count: 0, isPwned: false });
+    const timer = setTimeout(() => {
+      checkPwnedPassword(password, { signal: controller.signal, fetch: customFetch, endpoint, padding }).then((count) => {
+        if (!controller.signal.aborted) {
+          setState({ status: count > 0 ? "pwned" : "safe", count, isPwned: count > 0 });
+        }
+      }).catch((error) => {
+        if (!controller.signal.aborted) setState({ status: "error", count: 0, isPwned: false, error });
+      });
+    }, debounceMs);
+    return () => {
+      clearTimeout(timer);
+      controller.abort();
+    };
+  }, [password, enabled, debounceMs, customFetch, endpoint, padding]);
+  return state;
+}
 
 // src/PasswordPolicyInput.tsx
+var React = __toESM(require("react"));
 var import_react2 = require("react");
-var import_styled_components = __toESM(require("styled-components"));
-var import_jsx_runtime = require("react/jsx-runtime");
-var STRENGTH_COLOR_MAP = {
-  "Very Weak": "var(--rpp-weak)",
-  "Weak": "var(--rpp-weak)",
-  "Medium": "var(--rpp-medium)",
-  "Strong": "var(--rpp-success)",
-  "Very Strong": "var(--rpp-success)"
-};
-var Container = import_styled_components.default.div`
-  /* CSS variables define the component's internal theme */
+
+// src/styles.ts
+var passwordPolicyInputCss = `
+:where(.rpp-root) {
   --rpp-accent: #646cff;
-  --rpp-success: #27ae60;
+  --rpp-success: #1e8449;
   --rpp-danger: #c0392b;
-  --rpp-weak: #f39c12;
-  --rpp-medium: #d35400;
-  --rpp-bg: #f9f9f9;
-  --rpp-border: #e0e0e0;
-  --rpp-text: #333;
-  
-  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+  --rpp-weak: #d35400;
+  --rpp-medium: #b8860b;
+  --rpp-bg: #ffffff;
+  --rpp-border: #d0d0d0;
+  --rpp-text: #222222;
+  --rpp-muted: #6b6b6b;
+  --rpp-radius: 6px;
+  font-family: inherit;
+  color: var(--rpp-text);
   display: flex;
   flex-direction: column;
   gap: 0.75rem;
-`;
-var InputWrapper = import_styled_components.default.div`
-  position: relative;
-`;
-var Input = import_styled_components.default.input`
+}
+:where(.rpp-root) .rpp-field { position: relative; }
+:where(.rpp-root) .rpp-input {
   box-sizing: border-box;
   width: 100%;
-  padding: 0.75rem;
+  padding: 0.75rem 2.75rem 0.75rem 0.75rem;
   border: 1px solid var(--rpp-border);
-  border-radius: 6px;
+  border-radius: var(--rpp-radius);
+  background: var(--rpp-bg);
+  color: var(--rpp-text);
+  font: inherit;
   font-size: 1rem;
-  
-  &:focus {
-    border-color: var(--rpp-accent);
-    outline: none;
-  }
-`;
-var ToggleButton = import_styled_components.default.button`
+}
+:where(.rpp-root) .rpp-input:focus-visible {
+  outline: 2px solid var(--rpp-accent);
+  outline-offset: 1px;
+  border-color: var(--rpp-accent);
+}
+:where(.rpp-root) .rpp-toggle {
   position: absolute;
   top: 50%;
-  right: 0.5rem;
+  right: 0.375rem;
   transform: translateY(-50%);
-  background: none;
-  border: none;
-  cursor: pointer;
-  padding: 0.5rem;
-  color: #888;
   display: flex;
   align-items: center;
-`;
-var StrengthMeter = import_styled_components.default.div`
-  display: flex;
-  gap: 0.25rem;
-  height: 6px;
-`;
-var StrengthMeterSegment = import_styled_components.default.div`
+  padding: 0.375rem;
+  border: 0;
+  border-radius: var(--rpp-radius);
+  background: none;
+  color: var(--rpp-muted);
+  cursor: pointer;
+}
+:where(.rpp-root) .rpp-toggle:focus-visible { outline: 2px solid var(--rpp-accent); }
+:where(.rpp-root) .rpp-toggle:focus:not(:focus-visible) { outline: none; }
+:where(.rpp-root) .rpp-meter { display: flex; gap: 0.25rem; height: 6px; }
+:where(.rpp-root) .rpp-segment {
   flex: 1;
-  background-color: var(--rpp-border);
   border-radius: 3px;
-  transition: background-color 0.3s;
-  
-  ${({ isFilled, strengthLabel }) => (
-  // FIX: Explicitly type props
-  isFilled && import_styled_components.css`
-      background-color: ${STRENGTH_COLOR_MAP[strengthLabel]};
-    `
-)}
-`;
-var RequirementsList = import_styled_components.default.ul`
+  background: var(--rpp-border);
+  transition: background-color 0.25s;
+}
+:where(.rpp-root[data-strength="very-weak"]) .rpp-segment[data-filled] { background: var(--rpp-danger); }
+:where(.rpp-root[data-strength="weak"]) .rpp-segment[data-filled] { background: var(--rpp-weak); }
+:where(.rpp-root[data-strength="medium"]) .rpp-segment[data-filled] { background: var(--rpp-medium); }
+:where(.rpp-root[data-strength="strong"]) .rpp-segment[data-filled],
+:where(.rpp-root[data-strength="very-strong"]) .rpp-segment[data-filled] { background: var(--rpp-success); }
+:where(.rpp-root) .rpp-strength-label,
+:where(.rpp-root) .rpp-feedback { margin: 0; font-size: 0.8125rem; color: var(--rpp-muted); }
+:where(.rpp-root) .rpp-requirements {
   list-style: none;
-  padding: 0;
   margin: 0;
+  padding: 0;
   display: flex;
   flex-direction: column;
-  gap: 0.5rem;
+  gap: 0.375rem;
   font-size: 0.875rem;
-`;
-var RequirementItem = import_styled_components.default.li`
-  display: flex;
-  align-items: center;
-  gap: 0.5rem;
-  transition: color 0.2s;
-  /* FIX: Explicitly type props */
-  color: ${({ passed }) => passed ? "var(--rpp-success)" : "var(--rpp-danger)"};
-`;
-var EyeIcon = () => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("svg", { xmlns: "http://www.w3.org/2000/svg", width: "18", height: "18", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round", children: [
+}
+:where(.rpp-root) .rpp-requirement { display: flex; align-items: center; gap: 0.5rem; color: var(--rpp-danger); }
+:where(.rpp-root) .rpp-requirement[data-passed] { color: var(--rpp-success); }
+:where(.rpp-root) .rpp-icon { width: 1em; text-align: center; font-weight: 700; }
+:where(.rpp-root) .rpp-sr-only {
+  position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px;
+  overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; border: 0;
+}
+`.trim();
+
+// src/PasswordPolicyInput.tsx
+var import_jsx_runtime = require("react/jsx-runtime");
+var idCounter = 0;
+var useFallbackId = () => {
+  const [id] = (0, import_react2.useState)(() => `rpp-${++idCounter}`);
+  return id;
+};
+var _a;
+var useStableId = (_a = React.useId) != null ? _a : useFallbackId;
+var EyeIcon = () => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("svg", { "aria-hidden": "true", focusable: "false", width: "18", height: "18", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round", children: [
   /* @__PURE__ */ (0, import_jsx_runtime.jsx)("path", { d: "M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z" }),
   /* @__PURE__ */ (0, import_jsx_runtime.jsx)("circle", { cx: "12", cy: "12", r: "3" })
 ] });
-var EyeOffIcon = () => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("svg", { xmlns: "http://www.w3.org/2000/svg", width: "18", height: "18", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round", children: [
+var EyeOffIcon = () => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("svg", { "aria-hidden": "true", focusable: "false", width: "18", height: "18", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round", children: [
   /* @__PURE__ */ (0, import_jsx_runtime.jsx)("path", { d: "M17.94 17.94A10.07 10.07 0 0 1 12 20c-7 0-11-8-11-8a18.45 18.45 0 0 1 5.06-5.94M9.9 4.24A9.12 9.12 0 0 1 12 4c7 0 11 8 11 8a18.5 18.5 0 0 1-2.16 3.19m-6.72-1.07a3 3 0 1 1-4.24-4.24" }),
   /* @__PURE__ */ (0, import_jsx_runtime.jsx)("line", { x1: "1", y1: "1", x2: "23", y2: "23" })
 ] });
-var PasswordPolicyInput = ({
-  policyOptions,
-  onPasswordChange,
-  showStrengthMeter = true,
-  showRequirementsList = true,
-  showToggleButton = true,
-  className,
-  ...restInputProps
-}) => {
-  const [password, setPassword] = (0, import_react2.useState)("");
-  const [showPassword, setShowPassword] = (0, import_react2.useState)(false);
-  const validation = usePasswordPolicy({ ...policyOptions, password });
-  const { policyState, strengthScore, strengthLabel } = validation;
-  (0, import_react2.useEffect)(() => {
-    onPasswordChange?.(password, validation);
-  }, [password, validation, onPasswordChange]);
-  const formatPolicyName = (name) => name.replace(/([A-Z])/g, " $1").replace(/^./, (s) => s.toUpperCase());
-  const handlePasswordChange = (e) => {
-    setPassword(e.target.value);
-  };
-  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Container, { className, children: [
-    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(InputWrapper, { children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
-        Input,
+var strengthKey = (label) => label.toLowerCase().replace(/\s+/g, "-");
+var PasswordPolicyInput = (0, import_react2.forwardRef)(
+  function PasswordPolicyInput2({
+    value,
+    defaultValue,
+    policyOptions,
+    onPasswordChange,
+    onChange,
+    showStrengthMeter = true,
+    showStrengthLabel = false,
+    showRequirementsList = true,
+    showToggleButton = true,
+    toggleLabels = { show: "Show password", hide: "Hide password" },
+    unstyled = false,
+    className,
+    inputClassName,
+    id,
+    "aria-describedby": ariaDescribedBy,
+    ...inputProps
+  }, ref) {
+    const generatedId = useStableId();
+    const inputId = id != null ? id : `${generatedId}-input`;
+    const listId = `${generatedId}-requirements`;
+    const feedbackId = `${generatedId}-feedback`;
+    const isControlled = value !== void 0;
+    const [internalValue, setInternalValue] = (0, import_react2.useState)(defaultValue != null ? defaultValue : "");
+    const password = isControlled ? value : internalValue;
+    const [visible, setVisible] = (0, import_react2.useState)(false);
+    const validation = validatePassword(password, policyOptions);
+    const { requirements, strengthPercent, strengthLabel, isValid, estimate } = validation;
+    const handleChange = (e) => {
+      const next = e.target.value;
+      if (!isControlled) setInternalValue(next);
+      onChange == null ? void 0 : onChange(e);
+      onPasswordChange == null ? void 0 : onPasswordChange(next, { password: next, ...validatePassword(next, policyOptions) });
+    };
+    const segments = 5;
+    const filled = strengthPercent > 0 ? Math.max(1, Math.round(strengthPercent * segments)) : 0;
+    const feedback = password && (estimate == null ? void 0 : estimate.feedback);
+    const describedBy = [ariaDescribedBy, showRequirementsList ? listId : null, feedback ? feedbackId : null].filter(Boolean).join(" ") || void 0;
+    const rootClass = className ? `rpp-root ${className}` : "rpp-root";
+    return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: rootClass, "data-strength": strengthKey(strengthLabel), "data-valid": isValid || void 0, children: [
+      !unstyled && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("style", { children: passwordPolicyInputCss }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "rpp-field", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          "input",
+          {
+            ...inputProps,
+            ref,
+            id: inputId,
+            className: inputClassName ? `rpp-input ${inputClassName}` : "rpp-input",
+            type: visible ? "text" : "password",
+            value: password,
+            onChange: handleChange,
+            "aria-describedby": describedBy,
+            "aria-invalid": password.length > 0 && !isValid ? true : void 0
+          }
+        ),
+        showToggleButton && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          "button",
+          {
+            type: "button",
+            className: "rpp-toggle",
+            onClick: () => setVisible((v) => !v),
+            "aria-label": visible ? toggleLabels.hide : toggleLabels.show,
+            "aria-pressed": visible,
+            "aria-controls": inputId,
+            children: visible ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(EyeOffIcon, {}) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(EyeIcon, {})
+          }
+        )
+      ] }),
+      showStrengthMeter && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+        "div",
         {
-          type: showPassword ? "text" : "password",
-          value: password,
-          onChange: handlePasswordChange,
-          ...restInputProps
+          className: "rpp-meter",
+          role: "meter",
+          "aria-label": "Password strength",
+          "aria-valuemin": 0,
+          "aria-valuemax": 100,
+          "aria-valuenow": Math.round(strengthPercent * 100),
+          "aria-valuetext": strengthLabel,
+          children: Array.from({ length: segments }, (_, i) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "rpp-segment", "data-filled": i < filled || void 0 }, i))
         }
       ),
-      showToggleButton && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ToggleButton, { type: "button", onClick: () => setShowPassword(!showPassword), children: showPassword ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(EyeOffIcon, {}) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(EyeIcon, {}) })
-    ] }),
-    showStrengthMeter && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(StrengthMeter, { children: Array.from({ length: 5 }).map((_, index) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
-      StrengthMeterSegment,
-      {
-        isFilled: strengthScore > index,
-        strengthLabel
-      },
-      index
-    )) }),
-    showRequirementsList && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(RequirementsList, { children: Object.entries(policyState).map(([name, passed]) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(RequirementItem, { passed, children: [
-      passed ? "\u2713" : "\u2717",
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: formatPolicyName(name) })
-    ] }, name)) })
-  ] });
-};
+      showStrengthMeter && showStrengthLabel && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "rpp-strength-label", children: strengthLabel }),
+      showStrengthMeter && feedback && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "rpp-feedback", id: feedbackId, children: feedback }),
+      showRequirementsList && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("ul", { className: "rpp-requirements", id: listId, "aria-label": "Password requirements", children: requirements.map(({ name, passed, message }) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { className: "rpp-requirement", "data-passed": passed || void 0, "data-rule": name, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "rpp-icon", "aria-hidden": "true", children: passed ? "\u2713" : "\u2717" }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: message }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "rpp-sr-only", children: passed ? " (met)" : " (not met)" })
+      ] }, name)) })
+    ] });
+  }
+);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  COMMON_PASSWORDS,
+  DEFAULT_MESSAGES,
+  DEFAULT_OPTIONS,
   PasswordPolicyInput,
-  usePasswordPolicy
+  checkPwnedPassword,
+  fromZxcvbn,
+  isCommonPassword,
+  passwordPolicyInputCss,
+  passwordValidator,
+  presets,
+  resolveOptions,
+  usePasswordPolicy,
+  usePwnedPassword,
+  validatePassword,
+  zodPasswordRule
 });