use-password-policy 3.0.0 → 3.1.0

package/dist/core.js

@@ -23,14 +23,20 @@ __export(core_exports, {
   COMMON_PASSWORDS: () => COMMON_PASSWORDS,
   DEFAULT_MESSAGES: () => DEFAULT_MESSAGES,
   DEFAULT_OPTIONS: () => DEFAULT_OPTIONS,
+  applyBreachResult: () => applyBreachResult,
   checkPwnedPassword: () => checkPwnedPassword,
   fromZxcvbn: () => fromZxcvbn,
   isCommonPassword: () => isCommonPassword,
+  isPredictablePattern: () => isPredictablePattern,
+  passwordLength: () => passwordLength,
   passwordValidator: () => passwordValidator,
+  passwordValidatorAsync: () => passwordValidatorAsync,
   presets: () => presets,
   resolveOptions: () => resolveOptions,
   validatePassword: () => validatePassword,
-  zodPasswordRule: () => zodPasswordRule
+  validatePasswordAsync: () => validatePasswordAsync,
+  zodPasswordRule: () => zodPasswordRule,
+  zodPasswordRuleAsync: () => zodPasswordRuleAsync
 });
 module.exports = __toCommonJS(core_exports);
 
@@ -213,6 +219,25 @@ var COMMON_PASSWORDS = [
 
 // src/pwned.ts
 var HIBP_RANGE = "https://api.pwnedpasswords.com/range/";
+var CACHE_LIMIT = 100;
+var responseCache = /* @__PURE__ */ new WeakMap();
+var inflight = /* @__PURE__ */ new WeakMap();
+function inflightFor(fetchFn) {
+  let map = inflight.get(fetchFn);
+  if (!map) {
+    map = /* @__PURE__ */ new Map();
+    inflight.set(fetchFn, map);
+  }
+  return map;
+}
+function cacheFor(fetchFn) {
+  let cache = responseCache.get(fetchFn);
+  if (!cache) {
+    cache = /* @__PURE__ */ new Map();
+    responseCache.set(fetchFn, cache);
+  }
+  return cache;
+}
 async function sha1Hex(input) {
   var _a;
   const subtle = (_a = globalThis.crypto) == null ? void 0 : _a.subtle;
@@ -225,19 +250,33 @@ async function sha1Hex(input) {
   return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("").toUpperCase();
 }
 async function checkPwnedPassword(password, options = {}) {
-  var _a, _b;
+  var _a, _b, _c;
   if (!password) return 0;
   const doFetch = (_a = options.fetch) != null ? _a : globalThis.fetch;
   if (!doFetch) throw new Error("use-password-policy: no fetch implementation available.");
   const hash = await sha1Hex(password);
   const prefix = hash.slice(0, 5);
   const suffix = hash.slice(5);
-  const res = await doFetch(`${(_b = options.endpoint) != null ? _b : HIBP_RANGE}${prefix}`, {
-    signal: options.signal,
-    headers: options.padding ? { "Add-Padding": "true" } : void 0
-  });
-  if (!res.ok) throw new Error(`use-password-policy: breach check failed (HTTP ${res.status}).`);
-  const body = await res.text();
+  const url = `${(_b = options.endpoint) != null ? _b : HIBP_RANGE}${prefix}`;
+  const cache = cacheFor(doFetch);
+  let body = cache.get(url);
+  if (body === void 0) {
+    const pending = inflightFor(doFetch);
+    let request = pending.get(url);
+    if (!request) {
+      request = (async () => {
+        const res = await doFetch(url, { headers: options.padding ? { "Add-Padding": "true" } : void 0 });
+        if (!res.ok) throw new Error(`use-password-policy: breach check failed (HTTP ${res.status}).`);
+        const text = await res.text();
+        cache.set(url, text);
+        if (cache.size > CACHE_LIMIT) cache.delete(cache.keys().next().value);
+        return text;
+      })().finally(() => pending.delete(url));
+      pending.set(url, request);
+    }
+    body = await request;
+    if ((_c = options.signal) == null ? void 0 : _c.aborted) throw new DOMException("The check was cancelled.", "AbortError");
+  }
   for (const line of body.split("\n")) {
     const [lineSuffix, count] = line.trim().split(":");
     if (lineSuffix === suffix) return parseInt(count, 10) || 0;
@@ -255,6 +294,7 @@ var DEFAULT_OPTIONS = {
   specialCharCheck: true,
   commonPasswordCheck: false,
   commonPasswords: COMMON_PASSWORDS,
+  patternCheck: false,
   customRules: [],
   messages: {},
   lowercaseRegex: /[a-z]/,
@@ -273,7 +313,8 @@ var presets = {
   },
   /**
    * NIST SP 800-63B-4 (Aug 2025) for passwords used on their own:
-   * at least 15 characters, allow up to 64, no composition rules, block common passwords.
+   * at least 15 characters, allow up to 64, no composition rules, block common passwords
+   * and predictable patterns. Add `breachCheck: true` to also check known breaches.
    */
   nist: {
     minLength: 15,
@@ -282,7 +323,8 @@ var presets = {
     uppercaseCheck: false,
     numberCheck: false,
     specialCharCheck: false,
-    commonPasswordCheck: true
+    commonPasswordCheck: true,
+    patternCheck: true
   },
   /** NIST SP 800-63B-4 when the password is one factor of MFA: at least 8 characters. */
   nistMfa: {
@@ -292,7 +334,8 @@ var presets = {
     uppercaseCheck: false,
     numberCheck: false,
     specialCharCheck: false,
-    commonPasswordCheck: true
+    commonPasswordCheck: true,
+    patternCheck: true
   }
 };
 var DEFAULT_MESSAGES = {
@@ -303,6 +346,9 @@ var DEFAULT_MESSAGES = {
   number: "A number",
   specialChar: "A special character",
   notCommon: "Not a commonly used password",
+  noPattern: "No repeats, sequences or keyboard patterns",
+  notBreached: "Not found in known data breaches",
+  breachUnavailable: "Couldn't check known data breaches. Try again",
   match: "Passwords match",
   strength: "Hard to guess"
 };
@@ -328,6 +374,22 @@ function getCommonSet(list) {
   }
   return set;
 }
+var passwordLength = (password) => Array.from(password).length;
+function isCommonCombo(word, set) {
+  const n = word.length;
+  if (n < 6) return false;
+  const reachable = new Array(n + 1).fill(false);
+  reachable[0] = true;
+  for (let end = 3; end <= n; end++) {
+    for (let start = Math.max(0, end - 20); start <= end - 3; start++) {
+      if (reachable[start] && set.has(word.slice(start, end))) {
+        reachable[end] = true;
+        break;
+      }
+    }
+  }
+  return reachable[n];
+}
 function isCommonPassword(password, list = COMMON_PASSWORDS) {
   if (!password) return false;
   const set = getCommonSet(list);
@@ -336,7 +398,36 @@ function isCommonPassword(password, list = COMMON_PASSWORDS) {
   const trimmed = lower.replace(/[^a-z]+$/, "");
   const base = unleet(trimmed);
   const baseNoLeading = unleet(trimmed.replace(/^[^a-z]+/, ""));
-  return [lower, noTrailingSymbols, base, baseNoLeading].some((c) => c.length > 0 && set.has(c));
+  if ([lower, noTrailingSymbols, base, baseNoLeading].some((c) => c.length > 0 && set.has(c))) return true;
+  const lettersOnly = lower.replace(/[^a-z]/g, "");
+  const unleetedLetters = unleet(baseNoLeading).replace(/[^a-z]/g, "");
+  return isCommonCombo(lettersOnly, set) || isCommonCombo(unleetedLetters, set);
+}
+var KEYBOARD_ROWS = ["1234567890", "qwertyuiop", "asdfghjkl", "zxcvbnm", "abcdefghijklmnopqrstuvwxyz"];
+function isStep(a, b) {
+  if (a === b) return false;
+  for (const row of KEYBOARD_ROWS) {
+    const i = row.indexOf(a);
+    const j = row.indexOf(b);
+    if (i >= 0 && j >= 0 && (Math.abs(i - j) === 1 || Math.abs(i - j) === row.length - 1)) return true;
+  }
+  return false;
+}
+function isPredictablePattern(password) {
+  if (!password) return false;
+  if (password.trim() === "") return true;
+  const chars = Array.from(password.toLowerCase());
+  if (new Set(chars).size <= 3) return true;
+  const compact = chars.filter((c) => /[a-z0-9]/.test(c) || c.toUpperCase() !== c).join("");
+  for (const s of [compact, compact.replace(/\d+$/, "")]) {
+    if (s.length >= 6 && /^(.+?)\1+$/.test(s)) return true;
+  }
+  if (chars.length >= 4) {
+    let steps = 0;
+    for (let i = 1; i < chars.length; i++) if (isStep(chars[i - 1], chars[i])) steps++;
+    if (steps / (chars.length - 1) >= 0.75) return true;
+  }
+  return false;
 }
 var prettify = (name) => name.replace(/([A-Z])/g, " $1").replace(/^./, (s) => s.toUpperCase()).trim();
 function resolveMessage(rule, options) {
@@ -348,10 +439,10 @@ function resolveMessage(rule, options) {
 function builtInRules(options, estimate) {
   const rules = [];
   if (options.minLength > 0) {
-    rules.push({ name: "minLength", optionsKey: "minLength", test: (p, o) => p.length >= o.minLength });
+    rules.push({ name: "minLength", optionsKey: "minLength", test: (p, o) => passwordLength(p) >= o.minLength });
   }
   if (options.maxLength > 0) {
-    rules.push({ name: "maxLength", optionsKey: "maxLength", test: (p, o) => p.length <= o.maxLength });
+    rules.push({ name: "maxLength", optionsKey: "maxLength", test: (p, o) => passwordLength(p) <= o.maxLength });
   }
   if (options.uppercaseCheck) {
     rules.push({ name: "uppercase", optionsKey: "uppercaseCheck", test: (p, o) => o.uppercaseRegex.test(p) });
@@ -372,6 +463,13 @@ function builtInRules(options, estimate) {
       test: (p, o) => p.length > 0 && !isCommonPassword(p, o.commonPasswords)
     });
   }
+  if (options.patternCheck) {
+    rules.push({
+      name: "noPattern",
+      optionsKey: "patternCheck",
+      test: (p) => p.length > 0 && !isPredictablePattern(p)
+    });
+  }
   if (options.confirmPassword !== void 0) {
     rules.push({
       name: "match",
@@ -428,6 +526,49 @@ function validatePassword(password, options = {}) {
     ...estimate ? { estimate } : {}
   };
 }
+function breachOptions(option) {
+  if (!option) return null;
+  return option === true ? {} : option;
+}
+function applyBreachResult(result, breach, options = {}) {
+  var _a;
+  const failOpen = ((_a = breachOptions(options.breachCheck)) != null ? _a : {}).failOpen !== false;
+  const resolved = resolveOptions(options);
+  const message = resolveMessage({ name: "notBreached", test: () => true }, resolved);
+  const pending = breach.status === "idle" || breach.status === "checking";
+  const passed = breach.status === "safe" || breach.status === "error" && failOpen;
+  const requirement = pending ? { name: "notBreached", passed: false, message, pending: true } : { name: "notBreached", passed, message };
+  const errors = [...result.errors];
+  if (!pending && !passed) {
+    errors.push(
+      breach.status === "error" ? resolveMessage({ name: "breachUnavailable", test: () => true }, resolved) : message
+    );
+  }
+  const pwned = breach.status === "pwned";
+  return {
+    ...result,
+    isValid: result.isValid && passed,
+    policyState: { ...result.policyState, notBreached: passed },
+    requirements: [...result.requirements.filter((r) => r.name !== "notBreached"), requirement],
+    errors,
+    strengthScore: result.strengthScore + (passed ? 1 : 0),
+    strengthPercent: pwned ? 0 : result.strengthPercent,
+    strengthLabel: pwned ? "Very Weak" : result.strengthLabel,
+    breach
+  };
+}
+async function validatePasswordAsync(password, options = {}) {
+  const result = validatePassword(password, options);
+  const b = breachOptions(options.breachCheck);
+  if (!b) return result;
+  if (!result.isValid) return applyBreachResult(result, { status: "idle", count: 0 }, options);
+  try {
+    const count = await checkPwnedPassword(password != null ? password : "", { fetch: b.fetch, endpoint: b.endpoint, padding: b.padding });
+    return applyBreachResult(result, { status: count > 0 ? "pwned" : "safe", count }, options);
+  } catch {
+    return applyBreachResult(result, { status: "error", count: 0 }, options);
+  }
+}
 function fromZxcvbn(zxcvbn, userInputs) {
   const run = typeof zxcvbn === "function" ? zxcvbn : (pw, inputs) => zxcvbn.check(pw, inputs);
   return (password) => {
@@ -446,6 +587,20 @@ function zodPasswordRule(options = {}, { allErrors = true } = {}) {
     }
   };
 }
+function zodPasswordRuleAsync(options = {}, { allErrors = true } = {}) {
+  return async (value, ctx) => {
+    const { errors } = await validatePasswordAsync(value, options);
+    for (const message of allErrors ? errors : errors.slice(0, 1)) {
+      ctx.addIssue({ code: "custom", message });
+    }
+  };
+}
+function passwordValidatorAsync(options = {}) {
+  return async (value) => {
+    const { errors } = await validatePasswordAsync(value != null ? value : "", options);
+    return errors.length === 0 ? true : errors[0];
+  };
+}
 function passwordValidator(options = {}) {
   return (value) => {
     const { errors } = validatePassword(value != null ? value : "", options);
@@ -457,12 +612,18 @@ function passwordValidator(options = {}) {
   COMMON_PASSWORDS,
   DEFAULT_MESSAGES,
   DEFAULT_OPTIONS,
+  applyBreachResult,
   checkPwnedPassword,
   fromZxcvbn,
   isCommonPassword,
+  isPredictablePattern,
+  passwordLength,
   passwordValidator,
+  passwordValidatorAsync,
   presets,
   resolveOptions,
   validatePassword,
-  zodPasswordRule
+  validatePasswordAsync,
+  zodPasswordRule,
+  zodPasswordRuleAsync
 });

package/dist/core.mjs

@@ -177,6 +177,25 @@ var COMMON_PASSWORDS = [
 
 // src/pwned.ts
 var HIBP_RANGE = "https://api.pwnedpasswords.com/range/";
+var CACHE_LIMIT = 100;
+var responseCache = /* @__PURE__ */ new WeakMap();
+var inflight = /* @__PURE__ */ new WeakMap();
+function inflightFor(fetchFn) {
+  let map = inflight.get(fetchFn);
+  if (!map) {
+    map = /* @__PURE__ */ new Map();
+    inflight.set(fetchFn, map);
+  }
+  return map;
+}
+function cacheFor(fetchFn) {
+  let cache = responseCache.get(fetchFn);
+  if (!cache) {
+    cache = /* @__PURE__ */ new Map();
+    responseCache.set(fetchFn, cache);
+  }
+  return cache;
+}
 async function sha1Hex(input) {
   var _a;
   const subtle = (_a = globalThis.crypto) == null ? void 0 : _a.subtle;
@@ -189,19 +208,33 @@ async function sha1Hex(input) {
   return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("").toUpperCase();
 }
 async function checkPwnedPassword(password, options = {}) {
-  var _a, _b;
+  var _a, _b, _c;
   if (!password) return 0;
   const doFetch = (_a = options.fetch) != null ? _a : globalThis.fetch;
   if (!doFetch) throw new Error("use-password-policy: no fetch implementation available.");
   const hash = await sha1Hex(password);
   const prefix = hash.slice(0, 5);
   const suffix = hash.slice(5);
-  const res = await doFetch(`${(_b = options.endpoint) != null ? _b : HIBP_RANGE}${prefix}`, {
-    signal: options.signal,
-    headers: options.padding ? { "Add-Padding": "true" } : void 0
-  });
-  if (!res.ok) throw new Error(`use-password-policy: breach check failed (HTTP ${res.status}).`);
-  const body = await res.text();
+  const url = `${(_b = options.endpoint) != null ? _b : HIBP_RANGE}${prefix}`;
+  const cache = cacheFor(doFetch);
+  let body = cache.get(url);
+  if (body === void 0) {
+    const pending = inflightFor(doFetch);
+    let request = pending.get(url);
+    if (!request) {
+      request = (async () => {
+        const res = await doFetch(url, { headers: options.padding ? { "Add-Padding": "true" } : void 0 });
+        if (!res.ok) throw new Error(`use-password-policy: breach check failed (HTTP ${res.status}).`);
+        const text = await res.text();
+        cache.set(url, text);
+        if (cache.size > CACHE_LIMIT) cache.delete(cache.keys().next().value);
+        return text;
+      })().finally(() => pending.delete(url));
+      pending.set(url, request);
+    }
+    body = await request;
+    if ((_c = options.signal) == null ? void 0 : _c.aborted) throw new DOMException("The check was cancelled.", "AbortError");
+  }
   for (const line of body.split("\n")) {
     const [lineSuffix, count] = line.trim().split(":");
     if (lineSuffix === suffix) return parseInt(count, 10) || 0;
@@ -219,6 +252,7 @@ var DEFAULT_OPTIONS = {
   specialCharCheck: true,
   commonPasswordCheck: false,
   commonPasswords: COMMON_PASSWORDS,
+  patternCheck: false,
   customRules: [],
   messages: {},
   lowercaseRegex: /[a-z]/,
@@ -237,7 +271,8 @@ var presets = {
   },
   /**
    * NIST SP 800-63B-4 (Aug 2025) for passwords used on their own:
-   * at least 15 characters, allow up to 64, no composition rules, block common passwords.
+   * at least 15 characters, allow up to 64, no composition rules, block common passwords
+   * and predictable patterns. Add `breachCheck: true` to also check known breaches.
    */
   nist: {
     minLength: 15,
@@ -246,7 +281,8 @@ var presets = {
     uppercaseCheck: false,
     numberCheck: false,
     specialCharCheck: false,
-    commonPasswordCheck: true
+    commonPasswordCheck: true,
+    patternCheck: true
   },
   /** NIST SP 800-63B-4 when the password is one factor of MFA: at least 8 characters. */
   nistMfa: {
@@ -256,7 +292,8 @@ var presets = {
     uppercaseCheck: false,
     numberCheck: false,
     specialCharCheck: false,
-    commonPasswordCheck: true
+    commonPasswordCheck: true,
+    patternCheck: true
   }
 };
 var DEFAULT_MESSAGES = {
@@ -267,6 +304,9 @@ var DEFAULT_MESSAGES = {
   number: "A number",
   specialChar: "A special character",
   notCommon: "Not a commonly used password",
+  noPattern: "No repeats, sequences or keyboard patterns",
+  notBreached: "Not found in known data breaches",
+  breachUnavailable: "Couldn't check known data breaches. Try again",
   match: "Passwords match",
   strength: "Hard to guess"
 };
@@ -292,6 +332,22 @@ function getCommonSet(list) {
   }
   return set;
 }
+var passwordLength = (password) => Array.from(password).length;
+function isCommonCombo(word, set) {
+  const n = word.length;
+  if (n < 6) return false;
+  const reachable = new Array(n + 1).fill(false);
+  reachable[0] = true;
+  for (let end = 3; end <= n; end++) {
+    for (let start = Math.max(0, end - 20); start <= end - 3; start++) {
+      if (reachable[start] && set.has(word.slice(start, end))) {
+        reachable[end] = true;
+        break;
+      }
+    }
+  }
+  return reachable[n];
+}
 function isCommonPassword(password, list = COMMON_PASSWORDS) {
   if (!password) return false;
   const set = getCommonSet(list);
@@ -300,7 +356,36 @@ function isCommonPassword(password, list = COMMON_PASSWORDS) {
   const trimmed = lower.replace(/[^a-z]+$/, "");
   const base = unleet(trimmed);
   const baseNoLeading = unleet(trimmed.replace(/^[^a-z]+/, ""));
-  return [lower, noTrailingSymbols, base, baseNoLeading].some((c) => c.length > 0 && set.has(c));
+  if ([lower, noTrailingSymbols, base, baseNoLeading].some((c) => c.length > 0 && set.has(c))) return true;
+  const lettersOnly = lower.replace(/[^a-z]/g, "");
+  const unleetedLetters = unleet(baseNoLeading).replace(/[^a-z]/g, "");
+  return isCommonCombo(lettersOnly, set) || isCommonCombo(unleetedLetters, set);
+}
+var KEYBOARD_ROWS = ["1234567890", "qwertyuiop", "asdfghjkl", "zxcvbnm", "abcdefghijklmnopqrstuvwxyz"];
+function isStep(a, b) {
+  if (a === b) return false;
+  for (const row of KEYBOARD_ROWS) {
+    const i = row.indexOf(a);
+    const j = row.indexOf(b);
+    if (i >= 0 && j >= 0 && (Math.abs(i - j) === 1 || Math.abs(i - j) === row.length - 1)) return true;
+  }
+  return false;
+}
+function isPredictablePattern(password) {
+  if (!password) return false;
+  if (password.trim() === "") return true;
+  const chars = Array.from(password.toLowerCase());
+  if (new Set(chars).size <= 3) return true;
+  const compact = chars.filter((c) => /[a-z0-9]/.test(c) || c.toUpperCase() !== c).join("");
+  for (const s of [compact, compact.replace(/\d+$/, "")]) {
+    if (s.length >= 6 && /^(.+?)\1+$/.test(s)) return true;
+  }
+  if (chars.length >= 4) {
+    let steps = 0;
+    for (let i = 1; i < chars.length; i++) if (isStep(chars[i - 1], chars[i])) steps++;
+    if (steps / (chars.length - 1) >= 0.75) return true;
+  }
+  return false;
 }
 var prettify = (name) => name.replace(/([A-Z])/g, " $1").replace(/^./, (s) => s.toUpperCase()).trim();
 function resolveMessage(rule, options) {
@@ -312,10 +397,10 @@ function resolveMessage(rule, options) {
 function builtInRules(options, estimate) {
   const rules = [];
   if (options.minLength > 0) {
-    rules.push({ name: "minLength", optionsKey: "minLength", test: (p, o) => p.length >= o.minLength });
+    rules.push({ name: "minLength", optionsKey: "minLength", test: (p, o) => passwordLength(p) >= o.minLength });
   }
   if (options.maxLength > 0) {
-    rules.push({ name: "maxLength", optionsKey: "maxLength", test: (p, o) => p.length <= o.maxLength });
+    rules.push({ name: "maxLength", optionsKey: "maxLength", test: (p, o) => passwordLength(p) <= o.maxLength });
   }
   if (options.uppercaseCheck) {
     rules.push({ name: "uppercase", optionsKey: "uppercaseCheck", test: (p, o) => o.uppercaseRegex.test(p) });
@@ -336,6 +421,13 @@ function builtInRules(options, estimate) {
       test: (p, o) => p.length > 0 && !isCommonPassword(p, o.commonPasswords)
     });
   }
+  if (options.patternCheck) {
+    rules.push({
+      name: "noPattern",
+      optionsKey: "patternCheck",
+      test: (p) => p.length > 0 && !isPredictablePattern(p)
+    });
+  }
   if (options.confirmPassword !== void 0) {
     rules.push({
       name: "match",
@@ -392,6 +484,49 @@ function validatePassword(password, options = {}) {
     ...estimate ? { estimate } : {}
   };
 }
+function breachOptions(option) {
+  if (!option) return null;
+  return option === true ? {} : option;
+}
+function applyBreachResult(result, breach, options = {}) {
+  var _a;
+  const failOpen = ((_a = breachOptions(options.breachCheck)) != null ? _a : {}).failOpen !== false;
+  const resolved = resolveOptions(options);
+  const message = resolveMessage({ name: "notBreached", test: () => true }, resolved);
+  const pending = breach.status === "idle" || breach.status === "checking";
+  const passed = breach.status === "safe" || breach.status === "error" && failOpen;
+  const requirement = pending ? { name: "notBreached", passed: false, message, pending: true } : { name: "notBreached", passed, message };
+  const errors = [...result.errors];
+  if (!pending && !passed) {
+    errors.push(
+      breach.status === "error" ? resolveMessage({ name: "breachUnavailable", test: () => true }, resolved) : message
+    );
+  }
+  const pwned = breach.status === "pwned";
+  return {
+    ...result,
+    isValid: result.isValid && passed,
+    policyState: { ...result.policyState, notBreached: passed },
+    requirements: [...result.requirements.filter((r) => r.name !== "notBreached"), requirement],
+    errors,
+    strengthScore: result.strengthScore + (passed ? 1 : 0),
+    strengthPercent: pwned ? 0 : result.strengthPercent,
+    strengthLabel: pwned ? "Very Weak" : result.strengthLabel,
+    breach
+  };
+}
+async function validatePasswordAsync(password, options = {}) {
+  const result = validatePassword(password, options);
+  const b = breachOptions(options.breachCheck);
+  if (!b) return result;
+  if (!result.isValid) return applyBreachResult(result, { status: "idle", count: 0 }, options);
+  try {
+    const count = await checkPwnedPassword(password != null ? password : "", { fetch: b.fetch, endpoint: b.endpoint, padding: b.padding });
+    return applyBreachResult(result, { status: count > 0 ? "pwned" : "safe", count }, options);
+  } catch {
+    return applyBreachResult(result, { status: "error", count: 0 }, options);
+  }
+}
 function fromZxcvbn(zxcvbn, userInputs) {
   const run = typeof zxcvbn === "function" ? zxcvbn : (pw, inputs) => zxcvbn.check(pw, inputs);
   return (password) => {
@@ -410,6 +545,20 @@ function zodPasswordRule(options = {}, { allErrors = true } = {}) {
     }
   };
 }
+function zodPasswordRuleAsync(options = {}, { allErrors = true } = {}) {
+  return async (value, ctx) => {
+    const { errors } = await validatePasswordAsync(value, options);
+    for (const message of allErrors ? errors : errors.slice(0, 1)) {
+      ctx.addIssue({ code: "custom", message });
+    }
+  };
+}
+function passwordValidatorAsync(options = {}) {
+  return async (value) => {
+    const { errors } = await validatePasswordAsync(value != null ? value : "", options);
+    return errors.length === 0 ? true : errors[0];
+  };
+}
 function passwordValidator(options = {}) {
   return (value) => {
     const { errors } = validatePassword(value != null ? value : "", options);
@@ -420,12 +569,18 @@ export {
   COMMON_PASSWORDS,
   DEFAULT_MESSAGES,
   DEFAULT_OPTIONS,
+  applyBreachResult,
   checkPwnedPassword,
   fromZxcvbn,
   isCommonPassword,
+  isPredictablePattern,
+  passwordLength,
   passwordValidator,
+  passwordValidatorAsync,
   presets,
   resolveOptions,
   validatePassword,
-  zodPasswordRule
+  validatePasswordAsync,
+  zodPasswordRule,
+  zodPasswordRuleAsync
 };