{"prompt":"You are comparing an AI-suggested code fix with actual changes made in a commit.\n\nYour task: Determine if the commit contains the essence of the AI fix and provide a confidence level.\n\n## AI-Suggested Fix\n\n**What it fixes:** @forgerock/davinci-client:lint\n\n**Description:** fix(davinci-client): fix prettier indentation in conditional type\n\n**Reasoning:** The PR added a new `T extends 'ValidatedPasswordCollector'` branch to the `InferSingleValueCollectorType` conditional type, pushing the fallback block (the JSDoc comment and the two union members) one level deeper in the nesting hierarchy.\n\nEach level of nesting in this conditional type adds 2 spaces of indentation. The PR correctly re-indented `| SingleValueCollectorNoValue` (line 174) by +2 spaces, but omitted the same adjustment for the six lines immediately above it: the opening JSDoc commen\n\n**Suggested Changes (diff):**\n```diff\ndiff --git a/packages/davinci-client/src/lib/collector.types.ts b/packages/davinci-client/src/lib/collector.types.ts\nindex edc7424d1..413613e89 100644\n--- a/packages/davinci-client/src/lib/collector.types.ts\n+++ b/packages/davinci-client/src/lib/collector.types.ts\n@@ -165,12 +165,12 @@ export type InferSingleValueCollectorType =\n : T extends 'ValidatedPasswordCollector'\n ? ValidatedPasswordCollector\n : /**\n- * At this point, we have not passed in a collector type\n- * or we have explicitly passed in 'SingleValueCollector'\n- * So we can return either a SingleValueCollector with value\n- * or without a value.\n- **/\n- | SingleValueCollectorWithValue<'SingleValueCollector'>\n+ * At this point, we have not passed in a collector type\n+ * or we have explicitly passed in 'SingleValueCollector'\n+ * So we can return either a SingleValueCollector with value\n+ * or without a value.\n+ **/\n+ | SingleValueCollectorWithValue<'SingleValueCollector'>\n | SingleValueCollectorNoValue<'SingleValueCollector'>;\n \n /**\n\n```\n\n## Actual Commit Changes\n\n**Commit Diff:**\n```diff\ndiff --git a/.changeset/embed-password-policy-in-component.md b/.changeset/embed-password-policy-in-component.md\nnew file mode 100644\nindex 0000000000..72a4428d64\n--- /dev/null\n+++ b/.changeset/embed-password-policy-in-component.md\n@@ -0,0 +1,9 @@\n+---\n+'@forgerock/davinci-client': minor\n+---\n+\n+Add `ValidatedPasswordCollector` alongside `PasswordCollector`. The reducer routes by `field.type`: `PASSWORD` always produces a `PasswordCollector`, `PASSWORD_VERIFY` always produces a `ValidatedPasswordCollector`. `ValidatedPasswordCollector.output.passwordPolicy` carries the embedded policy from the field; when the field has no policy, an empty policy object is emitted and the validator treats it as no rules. Consumers can render password requirements directly from the collector.\n+\n+Both collectors now expose a `verify: boolean` on `output` (defaults to `false`), propagated from the field when the server sends `verify: true`.\n+\n+`store.validate(collector)` accepts a `ValidatedPasswordCollector` and returns a validator that enforces the policy's length, unique-character, repeated-character, and per-charset minimum rules. Passing a `PasswordCollector` returns the standard \"cannot be validated\" error.\ndiff --git a/e2e/davinci-app/components/password.ts b/e2e/davinci-app/components/password.ts\nindex 5b835478f8..1f9ec63405 100644\n--- a/e2e/davinci-app/components/password.ts\n+++ b/e2e/davinci-app/components/password.ts\n@@ -4,32 +4,109 @@\n * This software may be modified and distributed under the terms\n * of the MIT license. See the LICENSE file for details.\n */\n-import type { PasswordCollector, Updater } from '@forgerock/davinci-client/types';\n+import type {\n+ PasswordCollector,\n+ ValidatedPasswordCollector,\n+ Updater,\n+ Validator,\n+} from '@forgerock/davinci-client/types';\n import { dotToCamelCase } from '../helper.js';\n \n+const UPPERCASE_RE = /^[A-Z]+$/;\n+const LOWERCASE_RE = /^[a-z]+$/;\n+const DIGIT_RE = /^[0-9]+$/;\n+\n export default function passwordComponent(\n formEl: HTMLFormElement,\n- collector: PasswordCollector,\n- updater: Updater,\n+ collector: PasswordCollector | ValidatedPasswordCollector,\n+ updater: Updater,\n+ validator?: Validator,\n ) {\n+ const collectorKey = dotToCamelCase(collector.output.key);\n const label = document.createElement('label');\n const input = document.createElement('input');\n \n- label.htmlFor = dotToCamelCase(collector.output.key);\n+ label.htmlFor = collectorKey;\n label.innerText = collector.output.label;\n input.type = 'password';\n- input.id = dotToCamelCase(collector.output.key);\n- input.name = dotToCamelCase(collector.output.key);\n+ input.id = collectorKey;\n+ input.name = collectorKey;\n \n formEl?.appendChild(label);\n formEl?.appendChild(input);\n \n- formEl\n- ?.querySelector(`#${dotToCamelCase(collector.output.key)}`)\n- ?.addEventListener('blur', (event: Event) => {\n- const error = updater((event.target as HTMLInputElement).value);\n- if (error && 'error' in error) {\n- console.error(error.error.message);\n+ if (collector.type === 'ValidatedPasswordCollector') {\n+ const passwordPolicy = collector.output.passwordPolicy;\n+ const requirementsList = document.createElement('ul');\n+ requirementsList.className = 'password-requirements';\n+\n+ if (passwordPolicy.length) {\n+ const { min, max } = passwordPolicy.length;\n+ let lengthMessage: string | null = null;\n+ if (min != null && max != null) {\n+ lengthMessage = `${min}–${max} characters`;\n+ } else if (min != null) {\n+ lengthMessage = `At least ${min} characters`;\n+ } else if (max != null) {\n+ lengthMessage = `At most ${max} characters`;\n+ }\n+ if (lengthMessage) {\n+ const li = document.createElement('li');\n+ li.textContent = lengthMessage;\n+ requirementsList.appendChild(li);\n+ }\n+ }\n+\n+ if (passwordPolicy.minCharacters) {\n+ for (const [charset, count] of Object.entries(passwordPolicy.minCharacters)) {\n+ const li = document.createElement('li');\n+ if (UPPERCASE_RE.test(charset)) {\n+ li.textContent = `At least ${count} uppercase letter(s)`;\n+ } else if (LOWERCASE_RE.test(charset)) {\n+ li.textContent = `At least ${count} lowercase letter(s)`;\n+ } else if (DIGIT_RE.test(charset)) {\n+ li.textContent = `At least ${count} number(s)`;\n+ } else {\n+ li.textContent = `At least ${count} special character(s)`;\n+ }\n+ requirementsList.appendChild(li);\n }\n- });\n+ }\n+\n+ if (requirementsList.children.length > 0) {\n+ formEl?.appendChild(requirementsList);\n+ }\n+ }\n+\n+ const inputEl = formEl?.querySelector(`#${collectorKey}`);\n+ const shouldValidate = collector.type === 'ValidatedPasswordCollector' && !!validator;\n+\n+ inputEl?.addEventListener('input', (event: Event) => {\n+ const value = (event.target as HTMLInputElement).value;\n+\n+ if (shouldValidate) {\n+ const result = validator(value);\n+ if (Array.isArray(result) && result.length) {\n+ let errorEl = formEl?.querySelector(`.${collectorKey}-error`);\n+ if (!errorEl) {\n+ errorEl = document.createElement('ul');\n+ errorEl.className = `${collectorKey}-error`;\n+ inputEl.after(errorEl);\n+ }\n+ const items = result.map((msg) => {\n+ const li = document.createElement('li');\n+ li.textContent = msg;\n+ return li;\n+ });\n+ errorEl.replaceChildren(...items);\n+ return;\n+ }\n+ formEl?.querySelector(`.${collectorKey}-error`)?.remove();\n+ }\n+\n+ const error = updater(value);\n+ if (error && 'error' in error) {\n+ console.error(error.error.message);\n+ }\n+ });\n }\ndiff --git a/e2e/davinci-app/main.ts b/e2e/davinci-app/main.ts\nindex a1a93b54d4..2301a60703 100644\n--- a/e2e/davinci-app/main.ts\n+++ b/e2e/davinci-app/main.ts\n@@ -237,13 +237,17 @@ const urlParams = new URLSearchParams(window.location.search);\n davinciClient.update(collector), // Returns an update function for this collector\n davinciClient.validate(collector), // Returns a validate function for this collector\n );\n- } else if (collector.type === 'PasswordCollector') {\n- // eslint-disable-next-line @typescript-eslint/no-unused-expressions\n- collector;\n+ } else if (\n+ collector.type === 'PasswordCollector' ||\n+ collector.type === 'ValidatedPasswordCollector'\n+ ) {\n passwordComponent(\n formEl, // You can ignore this; it's just for rendering\n collector, // This is the plain object of the collector\n davinciClient.update(collector), // Returns an update function for this collector\n+ collector.type === 'ValidatedPasswordCollector'\n+ ? davinciClient.validate(collector)\n+ : undefined,\n );\n } else if (collector.type === 'SubmitCollector') {\n submitButtonComponent(\ndiff --git a/packages/davinci-client/api-report/davinci-client.api.md b/packages/davinci-client/api-report/davinci-client.api.md\nindex b2528bf664..96b0abb5b9 100644\n--- a/packages/davinci-client/api-report/davinci-client.api.md\n+++ b/packages/davinci-client/api-report/davinci-client.api.md\n@@ -178,11 +178,13 @@ export interface CollectorErrors {\n }\n \n // @public (undocumented)\n-export type Collectors = FlowCollector | PasswordCollector | TextCollector | SingleSelectCollector | IdpCollector | SubmitCollector | ActionCollector<'ActionCollector'> | SingleValueCollector<'SingleValueCollector'> | MultiSelectCollector | DeviceAuthenticationCollector | DeviceRegistrationCollector | PhoneNumberCollector | ReadOnlyCollector | ValidatedTextCollector | ProtectCollector | PollingCollector | FidoRegistrationCollector | FidoAuthenticationCollector | QrCodeCollector | AgreementCollector | UnknownCollector;\n+export type Collectors = FlowCollector | PasswordCollector | ValidatedPasswordCollector | TextCollector | SingleSelectCollector | IdpCollector | SubmitCollector | ActionCollector<'ActionCollector'> | SingleValueCollector<'SingleValueCollector'> | MultiSelectCollector | DeviceAuthenticationCollector | DeviceRegistrationCollector | PhoneNumberCollector | ReadOnlyCollector | ValidatedTextCollector | ProtectCollector | PollingCollector | FidoRegistrationCollector | FidoAuthenticationCollector | QrCodeCollector | AgreementCollector | UnknownCollector;\n \n // @public\n export type CollectorValueType = T extends {\n type: 'PasswordCollector';\n+} ? string : T extends {\n+ type: 'ValidatedPasswordCollector';\n } ? string : T extends {\n type: 'TextCollector';\n category: 'SingleValueCollector';\n@@ -1032,7 +1034,7 @@ export type InferMultiValueCollectorType = T\n export type InferNoValueCollectorType = T extends 'ReadOnlyCollector' ? NoValueCollectorBase<'ReadOnlyCollector'> : T extends 'QrCodeCollector' ? QrCodeCollectorBase : T extends 'AgreementCollector' ? AgreementCollector : NoValueCollectorBase<'NoValueCollector'>;\n \n // @public\n-export type InferSingleValueCollectorType = T extends 'TextCollector' ? TextCollector : T extends 'SingleSelectCollector' ? SingleSelectCollector : T extends 'ValidatedTextCollector' ? ValidatedTextCollector : T extends 'PasswordCollector' ? PasswordCollector : SingleValueCollectorWithValue<'SingleValueCollector'> | SingleValueCollectorNoValue<'SingleValueCollector'>;\n+export type InferSingleValueCollectorType = T extends 'TextCollector' ? TextCollector : T extends 'SingleSelectCollector' ? SingleSelectCollector : T extends 'ValidatedTextCollector' ? ValidatedTextCollector : T extends 'PasswordCollector' ? PasswordCollector : T extends 'ValidatedPasswordCollector' ? ValidatedPasswordCollector : SingleValueCollectorWithValue<'SingleValueCollector'> | SingleValueCollectorNoValue<'SingleValueCollector'>;\n \n // @public (undocumented)\n export type InferValueObjectCollectorType = T extends 'DeviceAuthenticationCollector' ? DeviceAuthenticationCollector : T extends 'DeviceRegistrationCollector' ? DeviceRegistrationCollector : T extends 'PhoneNumberCollector' ? PhoneNumberCollector : ObjectOptionsCollectorWithObjectValue<'ObjectValueCollector'> | ObjectOptionsCollectorWithStringValue<'ObjectValueCollector'>;\n@@ -1170,8 +1172,8 @@ value: Record;\n }, string>;\n \n // @public\n-export const nodeCollectorReducer: Reducer<(TextCollector | SingleSelectCollector | ValidatedTextCollector | PasswordCollector | MultiSelectCollector | DeviceAuthenticationCollector | DeviceRegistrationCollector | PhoneNumberCollector | IdpCollector | SubmitCollector | FlowCollector | QrCodeCollectorBase | AgreementCollector | ReadOnlyCollector | UnknownCollector | ProtectCollector | FidoRegistrationCollector | FidoAuthenticationCollector | PollingCollector | ActionCollector<\"ActionCollector\"> | SingleValueCollector<\"SingleValueCollector\">)[]> & {\n- getInitialState: () => (TextCollector | SingleSelectCollector | ValidatedTextCollector | PasswordCollector | MultiSelectCollector | DeviceAuthenticationCollector | DeviceRegistrationCollector | PhoneNumberCollector | IdpCollector | SubmitCollector | FlowCollector | QrCodeCollectorBase | AgreementCollector | ReadOnlyCollector | UnknownCollector | ProtectCollector | FidoRegistrationCollector | FidoAuthenticationCollector | PollingCollector | ActionCollector<\"ActionCollector\"> | SingleValueCollector<\"SingleValueCollector\">)[];\n+export const nodeCollectorReducer: Reducer<(TextCollector | SingleSelectCollector | PasswordCollector | ValidatedPasswordCollector | ValidatedTextCollector | ProtectCollector | PollingCollector | FidoRegistrationCollector | FidoAuthenticationCollector | DeviceAuthenticationCollector | DeviceRegistrationCollector | PhoneNumberCollector | QrCodeCollectorBase | AgreementCollector | UnknownCollector | IdpCollector | FlowCollector | SubmitCollector | ActionCollector<\"ActionCollector\"> | SingleValueCollector<\"SingleValueCollector\"> | MultiSelectCollector | ReadOnlyCollector)[]> & {\n+ getInitialState: () => (TextCollector | SingleSelectCollector | PasswordCollector | ValidatedPasswordCollector | ValidatedTextCollector | ProtectCollector | PollingCollector | FidoRegistrationCollector | FidoAuthenticationCollector | DeviceAuthenticationCollector | DeviceRegistrationCollector | PhoneNumberCollector | QrCodeCollectorBase | AgreementCollector | UnknownCollector | IdpCollector | FlowCollector | SubmitCollector | ActionCollector<\"ActionCollector\"> | SingleValueCollector<\"SingleValueCollector\"> | MultiSelectCollector | ReadOnlyCollector)[];\n };\n \n // @public (undocumented)\n@@ -1323,7 +1325,90 @@ export interface OutgoingQueryParams {\n }\n \n // @public (undocumented)\n-export type PasswordCollector = SingleValueCollectorNoValue<'PasswordCollector'>;\n+export interface PasswordCollector {\n+ // (undocumented)\n+ category: 'SingleValueCollector';\n+ // (undocumented)\n+ error: string | null;\n+ // (undocumented)\n+ id: string;\n+ // (undocumented)\n+ input: {\n+ key: string;\n+ value: string | number | boolean;\n+ type: string;\n+ };\n+ // (undocumented)\n+ name: string;\n+ // (undocumented)\n+ output: {\n+ key: string;\n+ label: string;\n+ type: string;\n+ verify: boolean;\n+ };\n+ // (undocumented)\n+ type: 'PasswordCollector';\n+}\n+\n+// @public\n+export type PasswordField = {\n+ type: 'PASSWORD' | 'PASSWORD_VERIFY';\n+ key: string;\n+ label: string;\n+ required?: boolean;\n+ verify?: boolean;\n+ passwordPolicy?: PasswordPolicy;\n+};\n+\n+// @public (undocumented)\n+export interface PasswordPolicy {\n+ // (undocumented)\n+ createdAt?: string;\n+ // (undocumented)\n+ default?: boolean;\n+ // (undocumented)\n+ description?: string;\n+ // (undocumented)\n+ excludesCommonlyUsed?: boolean;\n+ // (undocumented)\n+ excludesProfileData?: boolean;\n+ // (undocumented)\n+ history?: {\n+ count?: number;\n+ retentionDays?: number;\n+ };\n+ // (undocumented)\n+ id?: string;\n+ // (undocumented)\n+ length?: {\n+ min?: number;\n+ max?: number;\n+ };\n+ // (undocumented)\n+ lockout?: {\n+ failureCount?: number;\n+ durationSeconds?: number;\n+ };\n+ // (undocumented)\n+ maxAgeDays?: number;\n+ // (undocumented)\n+ maxRepeatedCharacters?: number;\n+ // (undocumented)\n+ minAgeDays?: number;\n+ // (undocumented)\n+ minCharacters?: Record;\n+ // (undocumented)\n+ minUniqueCharacters?: number;\n+ // (undocumented)\n+ name?: string;\n+ // (undocumented)\n+ notSimilarToCurrent?: boolean;\n+ // (undocumented)\n+ populationCount?: number;\n+ // (undocumented)\n+ updatedAt?: string;\n+}\n \n // @public (undocumented)\n export type PhoneNumberCollector = ObjectValueCollectorWithObjectValue<'PhoneNumberCollector', PhoneNumberInputValue, PhoneNumberOutputValue>;\n@@ -1588,10 +1673,10 @@ export interface SingleValueCollectorNoValue | SingleSelectCollectorWithValue<'SingleSelectCollector'> | SingleValueCollectorWithValue<'SingleValueCollector'> | SingleValueCollectorWithValue<'TextCollector'> | ValidatedSingleValueCollectorWithValue<'TextCollector'>;\n+export type SingleValueCollectors = PasswordCollector | ValidatedPasswordCollector | SingleSelectCollectorWithValue<'SingleSelectCollector'> | SingleValueCollectorWithValue<'SingleValueCollector'> | SingleValueCollectorWithValue<'TextCollector'> | ValidatedSingleValueCollectorWithValue<'TextCollector'>;\n \n // @public\n-export type SingleValueCollectorTypes = 'PasswordCollector' | 'SingleValueCollector' | 'SingleSelectCollector' | 'SingleSelectObjectCollector' | 'TextCollector' | 'ValidatedTextCollector';\n+export type SingleValueCollectorTypes = 'PasswordCollector' | 'ValidatedPasswordCollector' | 'SingleValueCollector' | 'SingleSelectCollector' | 'SingleSelectObjectCollector' | 'TextCollector' | 'ValidatedTextCollector';\n \n // @public (undocumented)\n export interface SingleValueCollectorWithValue {\n@@ -1621,11 +1706,11 @@ export interface SingleValueCollectorWithValue {\n // (undocumented)\ndiff --git a/packages/davinci-client/api-report/davinci-client.types.api.md b/packages/davinci-client/api-report/davinci-client.types.api.md\nindex 2321431a0a..0400f095db 100644\n--- a/packages/davinci-client/api-report/davinci-client.types.api.md\n+++ b/packages/davinci-client/api-report/davinci-client.types.api.md\n@@ -178,11 +178,13 @@ export interface CollectorErrors {\n }\n \n // @public (undocumented)\n-export type Collectors = FlowCollector | PasswordCollector | TextCollector | SingleSelectCollector | IdpCollector | SubmitCollector | ActionCollector<'ActionCollector'> | SingleValueCollector<'SingleValueCollector'> | MultiSelectCollector | DeviceAuthenticationCollector | DeviceRegistrationCollector | PhoneNumberCollector | ReadOnlyCollector | ValidatedTextCollector | ProtectCollector | PollingCollector | FidoRegistrationCollector | FidoAuthenticationCollector | QrCodeCollector | AgreementCollector | UnknownCollector;\n+export type Collectors = FlowCollector | PasswordCollector | ValidatedPasswordCollector | TextCollector | SingleSelectCollector | IdpCollector | SubmitCollector | ActionCollector<'ActionCollector'> | SingleValueCollector<'SingleValueCollector'> | MultiSelectCollector | DeviceAuthenticationCollector | DeviceRegistrationCollector | PhoneNumberCollector | ReadOnlyCollector | ValidatedTextCollector | ProtectCollector | PollingCollector | FidoRegistrationCollector | FidoAuthenticationCollector | QrCodeCollector | AgreementCollector | UnknownCollector;\n \n // @public\n export type CollectorValueType = T extends {\n type: 'PasswordCollector';\n+} ? string : T extends {\n+ type: 'ValidatedPasswordCollector';\n } ? string : T extends {\n type: 'TextCollector';\n category: 'SingleValueCollector';\n@@ -1029,7 +1031,7 @@ export type InferMultiValueCollectorType = T\n export type InferNoValueCollectorType = T extends 'ReadOnlyCollector' ? NoValueCollectorBase<'ReadOnlyCollector'> : T extends 'QrCodeCollector' ? QrCodeCollectorBase : T extends 'AgreementCollector' ? AgreementCollector : NoValueCollectorBase<'NoValueCollector'>;\n \n // @public\n-export type InferSingleValueCollectorType = T extends 'TextCollector' ? TextCollector : T extends 'SingleSelectCollector' ? SingleSelectCollector : T extends 'ValidatedTextCollector' ? ValidatedTextCollector : T extends 'PasswordCollector' ? PasswordCollector : SingleValueCollectorWithValue<'SingleValueCollector'> | SingleValueCollectorNoValue<'SingleValueCollector'>;\n+export type InferSingleValueCollectorType = T extends 'TextCollector' ? TextCollector : T extends 'SingleSelectCollector' ? SingleSelectCollector : T extends 'ValidatedTextCollector' ? ValidatedTextCollector : T extends 'PasswordCollector' ? PasswordCollector : T extends 'ValidatedPasswordCollector' ? ValidatedPasswordCollector : SingleValueCollectorWithValue<'SingleValueCollector'> | SingleValueCollectorNoValue<'SingleValueCollector'>;\n \n // @public (undocumented)\n export type InferValueObjectCollectorType = T extends 'DeviceAuthenticationCollector' ? DeviceAuthenticationCollector : T extends 'DeviceRegistrationCollector' ? DeviceRegistrationCollector : T extends 'PhoneNumberCollector' ? PhoneNumberCollector : ObjectOptionsCollectorWithObjectValue<'ObjectValueCollector'> | ObjectOptionsCollectorWithStringValue<'ObjectValueCollector'>;\n@@ -1167,8 +1169,8 @@ value: Record;\n }, string>;\n \n // @public\n-export const nodeCollectorReducer: Reducer<(TextCollector | SingleSelectCollector | ValidatedTextCollector | PasswordCollector | MultiSelectCollector | DeviceAuthenticationCollector | DeviceRegistrationCollector | PhoneNumberCollector | IdpCollector | SubmitCollector | FlowCollector | QrCodeCollectorBase | AgreementCollector | ReadOnlyCollector | UnknownCollector | ProtectCollector | FidoRegistrationCollector | FidoAuthenticationCollector | PollingCollector | ActionCollector<\"ActionCollector\"> | SingleValueCollector<\"SingleValueCollector\">)[]> & {\n- getInitialState: () => (TextCollector | SingleSelectCollector | ValidatedTextCollector | PasswordCollector | MultiSelectCollector | DeviceAuthenticationCollector | DeviceRegistrationCollector | PhoneNumberCollector | IdpCollector | SubmitCollector | FlowCollector | QrCodeCollectorBase | AgreementCollector | ReadOnlyCollector | UnknownCollector | ProtectCollector | FidoRegistrationCollector | FidoAuthenticationCollector | PollingCollector | ActionCollector<\"ActionCollector\"> | SingleValueCollector<\"SingleValueCollector\">)[];\n+export const nodeCollectorReducer: Reducer<(TextCollector | SingleSelectCollector | PasswordCollector | ValidatedPasswordCollector | ValidatedTextCollector | ProtectCollector | PollingCollector | FidoRegistrationCollector | FidoAuthenticationCollector | DeviceAuthenticationCollector | DeviceRegistrationCollector | PhoneNumberCollector | QrCodeCollectorBase | AgreementCollector | UnknownCollector | IdpCollector | FlowCollector | SubmitCollector | ActionCollector<\"ActionCollector\"> | SingleValueCollector<\"SingleValueCollector\"> | MultiSelectCollector | ReadOnlyCollector)[]> & {\n+ getInitialState: () => (TextCollector | SingleSelectCollector | PasswordCollector | ValidatedPasswordCollector | ValidatedTextCollector | ProtectCollector | PollingCollector | FidoRegistrationCollector | FidoAuthenticationCollector | DeviceAuthenticationCollector | DeviceRegistrationCollector | PhoneNumberCollector | QrCodeCollectorBase | AgreementCollector | UnknownCollector | IdpCollector | FlowCollector | SubmitCollector | ActionCollector<\"ActionCollector\"> | SingleValueCollector<\"SingleValueCollector\"> | MultiSelectCollector | ReadOnlyCollector)[];\n };\n \n // @public (undocumented)\n@@ -1320,7 +1322,90 @@ export interface OutgoingQueryParams {\n }\n \n // @public (undocumented)\n-export type PasswordCollector = SingleValueCollectorNoValue<'PasswordCollector'>;\n+export interface PasswordCollector {\n+ // (undocumented)\n+ category: 'SingleValueCollector';\n+ // (undocumented)\n+ error: string | null;\n+ // (undocumented)\n+ id: string;\n+ // (undocumented)\n+ input: {\n+ key: string;\n+ value: string | number | boolean;\n+ type: string;\n+ };\n+ // (undocumented)\n+ name: string;\n+ // (undocumented)\n+ output: {\n+ key: string;\n+ label: string;\n+ type: string;\n+ verify: boolean;\n+ };\n+ // (undocumented)\n+ type: 'PasswordCollector';\n+}\n+\n+// @public\n+export type PasswordField = {\n+ type: 'PASSWORD' | 'PASSWORD_VERIFY';\n+ key: string;\n+ label: string;\n+ required?: boolean;\n+ verify?: boolean;\n+ passwordPolicy?: PasswordPolicy;\n+};\n+\n+// @public (undocumented)\n+export interface PasswordPolicy {\n+ // (undocumented)\n+ createdAt?: string;\n+ // (undocumented)\n+ default?: boolean;\n+ // (undocumented)\n+ description?: string;\n+ // (undocumented)\n+ excludesCommonlyUsed?: boolean;\n+ // (undocumented)\n+ excludesProfileData?: boolean;\n+ // (undocumented)\n+ history?: {\n+ count?: number;\n+ retentionDays?: number;\n+ };\n+ // (undocumented)\n+ id?: string;\n+ // (undocumented)\n+ length?: {\n+ min?: number;\n+ max?: number;\n+ };\n+ // (undocumented)\n+ lockout?: {\n+ failureCount?: number;\n+ durationSeconds?: number;\n+ };\n+ // (undocumented)\n+ maxAgeDays?: number;\n+ // (undocumented)\n+ maxRepeatedCharacters?: number;\n+ // (undocumented)\n+ minAgeDays?: number;\n+ // (undocumented)\n+ minCharacters?: Record;\n+ // (undocumented)\n+ minUniqueCharacters?: number;\n+ // (undocumented)\n+ name?: string;\n+ // (undocumented)\n+ notSimilarToCurrent?: boolean;\n+ // (undocumented)\n+ populationCount?: number;\n+ // (undocumented)\n+ updatedAt?: string;\n+}\n \n // @public (undocumented)\n export type PhoneNumberCollector = ObjectValueCollectorWithObjectValue<'PhoneNumberCollector', PhoneNumberInputValue, PhoneNumberOutputValue>;\n@@ -1585,10 +1670,10 @@ export interface SingleValueCollectorNoValue | SingleSelectCollectorWithValue<'SingleSelectCollector'> | SingleValueCollectorWithValue<'SingleValueCollector'> | SingleValueCollectorWithValue<'TextCollector'> | ValidatedSingleValueCollectorWithValue<'TextCollector'>;\n+export type SingleValueCollectors = PasswordCollector | ValidatedPasswordCollector | SingleSelectCollectorWithValue<'SingleSelectCollector'> | SingleValueCollectorWithValue<'SingleValueCollector'> | SingleValueCollectorWithValue<'TextCollector'> | ValidatedSingleValueCollectorWithValue<'TextCollector'>;\n \n // @public\n-export type SingleValueCollectorTypes = 'PasswordCollector' | 'SingleValueCollector' | 'SingleSelectCollector' | 'SingleSelectObjectCollector' | 'TextCollector' | 'ValidatedTextCollector';\n+export type SingleValueCollectorTypes = 'PasswordCollector' | 'ValidatedPasswordCollector' | 'SingleValueCollector' | 'SingleSelectCollector' | 'SingleSelectObjectCollector' | 'TextCollector' | 'ValidatedTextCollector';\n \n // @public (undocumented)\n export interface SingleValueCollectorWithValue {\n@@ -1618,11 +1703,11 @@ export interface SingleValueCollectorWithValue {\n // (undocumented)\ndiff --git a/packages/davinci-client/src/lib/client.store.ts b/packages/davinci-client/src/lib/client.store.ts\nindex 3e2d3adcd8..805bc9da8f 100644\n--- a/packages/davinci-client/src/lib/client.store.ts\n+++ b/packages/davinci-client/src/lib/client.store.ts\n@@ -56,6 +56,7 @@ import type {\n Poller,\n } from './client.types.js';\n import { returnValidator } from './collector.utils.js';\n+import { returnPasswordPolicyValidator } from './password-policy.rules.js';\n import type { ContinueNode, StartNode } from './node.types.js';\n \n /**\n@@ -390,7 +391,16 @@ export async function davinci({\n return handleUpdateValidateError('Collector not found', 'state_error', log.error);\n }\n \n+ if (collectorToUpdate.type === 'PasswordCollector') {\n+ return handleUpdateValidateError(\n+ 'PasswordCollector cannot be validated; pass a ValidatedPasswordCollector',\n+ 'state_error',\n+ log.error,\n+ );\n+ }\n+\n if (\n+ collectorToUpdate.type !== 'ValidatedPasswordCollector' &&\n collectorToUpdate.category !== 'ValidatedSingleValueCollector' &&\n collectorToUpdate.category !== 'ObjectValueCollector' &&\n collectorToUpdate.category !== 'MultiValueCollector' &&\n@@ -403,7 +413,10 @@ export async function davinci({\n );\n }\n \n- if (!('validation' in collectorToUpdate.input)) {\n+ if (\n+ collectorToUpdate.type !== 'ValidatedPasswordCollector' &&\n+ !('validation' in collectorToUpdate.input)\n+ ) {\n return handleUpdateValidateError(\n 'Collector has no validation rules',\n 'state_error',\n@@ -411,6 +424,10 @@ export async function davinci({\n );\n }\n \n+ if (collectorToUpdate.type === 'ValidatedPasswordCollector') {\n+ return returnPasswordPolicyValidator(collectorToUpdate);\n+ }\n+\n return returnValidator(collectorToUpdate);\n },\n \ndiff --git a/packages/davinci-client/src/lib/client.types.ts b/packages/davinci-client/src/lib/client.types.ts\nindex 1830f6fd5c..c23cf6709f 100644\n--- a/packages/davinci-client/src/lib/client.types.ts\n+++ b/packages/davinci-client/src/lib/client.types.ts\n@@ -36,36 +36,38 @@ export type InitFlow = () => Promise;\n */\n export type CollectorValueType = T extends { type: 'PasswordCollector' }\n ? string\n- : T extends { type: 'TextCollector'; category: 'SingleValueCollector' }\n+ : T extends { type: 'ValidatedPasswordCollector' }\n ? string\n- : T extends { type: 'TextCollector'; category: 'ValidatedSingleValueCollector' }\n+ : T extends { type: 'TextCollector'; category: 'SingleValueCollector' }\n ? string\n- : T extends { type: 'SingleSelectCollector' }\n+ : T extends { type: 'TextCollector'; category: 'ValidatedSingleValueCollector' }\n ? string\n- : T extends { type: 'MultiSelectCollector' }\n- ? string[]\n- : T extends { type: 'DeviceRegistrationCollector' }\n- ? string\n- : T extends { type: 'DeviceAuthenticationCollector' }\n+ : T extends { type: 'SingleSelectCollector' }\n+ ? string\n+ : T extends { type: 'MultiSelectCollector' }\n+ ? string[]\n+ : T extends { type: 'DeviceRegistrationCollector' }\n ? string\n- : T extends { type: 'PhoneNumberCollector' }\n- ? PhoneNumberInputValue\n- : T extends { type: 'FidoRegistrationCollector' }\n- ? FidoRegistrationInputValue\n- : T extends { type: 'FidoAuthenticationCollector' }\n- ? FidoAuthenticationInputValue\n- : T extends { category: 'SingleValueCollector' }\n- ? string\n- : T extends { category: 'ValidatedSingleValueCollector' }\n+ : T extends { type: 'DeviceAuthenticationCollector' }\n+ ? string\n+ : T extends { type: 'PhoneNumberCollector' }\n+ ? PhoneNumberInputValue\n+ : T extends { type: 'FidoRegistrationCollector' }\n+ ? FidoRegistrationInputValue\n+ : T extends { type: 'FidoAuthenticationCollector' }\n+ ? FidoAuthenticationInputValue\n+ : T extends { category: 'SingleValueCollector' }\n ? string\n- : T extends { category: 'MultiValueCollector' }\n- ? string[]\n- :\n- | string\n- | string[]\n- | PhoneNumberInputValue\n- | FidoRegistrationInputValue\n- | FidoAuthenticationInputValue;\n+ : T extends { category: 'ValidatedSingleValueCollector' }\n+ ? string\n+ : T extends { category: 'MultiValueCollector' }\n+ ? string[]\n+ :\n+ | string\n+ | string[]\n+ | PhoneNumberInputValue\n+ | FidoRegistrationInputValue\n+ | FidoAuthenticationInputValue;\n \n /**\n * Generic updater function that accepts values appropriate for the collector type.\ndiff --git a/packages/davinci-client/src/lib/collector.types.test-d.ts b/packages/davinci-client/src/lib/collector.types.test-d.ts\nindex 5fe63303ad..3cc81e518c 100644\n--- a/packages/davinci-client/src/lib/collector.types.test-d.ts\n+++ b/packages/davinci-client/src/lib/collector.types.test-d.ts\n@@ -14,6 +14,7 @@ import type {\n ActionCollectorNoUrl,\n TextCollector,\n PasswordCollector,\n+ ValidatedPasswordCollector,\n FlowCollector,\n IdpCollector,\n SubmitCollector,\n@@ -28,6 +29,7 @@ import type {\n QrCodeCollector,\n AgreementCollector,\n } from './collector.types.js';\n+import type { PasswordPolicy } from './davinci.types.js';\n \n describe('Collector Types', () => {\n describe('SingleValueCollector Types', () => {\n@@ -42,20 +44,37 @@ describe('Collector Types', () => {\n });\n \n it('should validate PasswordCollector structure', () => {\n- expectTypeOf().toMatchTypeOf<\n- SingleValueCollectorNoValue<'PasswordCollector'>\n- >();\n expectTypeOf()\n .toHaveProperty('category')\n .toEqualTypeOf<'SingleValueCollector'>();\n- expectTypeOf().toHaveProperty('type');\n+ expectTypeOf().toHaveProperty('type').toEqualTypeOf<'PasswordCollector'>();\n expectTypeOf().toEqualTypeOf<{\n key: string;\n label: string;\n type: string;\n+ verify: boolean;\n }>();\n });\n \n+ it('should validate ValidatedPasswordCollector structure', () => {\n+ expectTypeOf()\n+ .toHaveProperty('category')\n+ .toEqualTypeOf<'SingleValueCollector'>();\n+ expectTypeOf()\n+ .toHaveProperty('type')\n+ .toEqualTypeOf<'ValidatedPasswordCollector'>();\n+ expectTypeOf()\n+ .toHaveProperty('verify')\n+ .toEqualTypeOf();\n+ expectTypeOf()\n+ .toHaveProperty('passwordPolicy')\n+ .toEqualTypeOf();\n+ });\n+\n+ it('should validate PasswordCollector output does NOT have passwordPolicy', () => {\n+ expectTypeOf().not.toHaveProperty('passwordPolicy');\n+ });\n+\n it('should validate SingleCollector structure', () => {\n expectTypeOf().toMatchTypeOf<\n SingleValueCollectorWithValue<'SingleSelectCollector'>\n@@ -266,11 +285,35 @@ describe('Collector Types', () => {\n key: '',\n label: '',\n type: '',\n+ verify: false,\n },\n };\n \n expectTypeOf(tCollector).toMatchTypeOf();\n });\n+ it('should correctly infer ValidatedPasswordCollector Type', () => {\n+ const tCollector: InferSingleValueCollectorType<'ValidatedPasswordCollector'> = {\n+ category: 'SingleValueCollector',\n+ error: null,\n+ type: 'ValidatedPasswordCollector',\n+ id: '',\n+ name: '',\n+ input: {\n+ key: '',\n+ value: '',\n+ type: '',\n+ },\n+ output: {\n+ key: '',\n+ label: '',\n+ type: '',\n+ verify: false,\n+ passwordPolicy: {},\n+ },\n+ };\n+\n+ expectTypeOf(tCollector).toMatchTypeOf();\n+ });\n it('should correctly infer SingleValueCollector Type', () => {\n const tCollector: InferSingleValueCollectorType<'SingleValueCollector'> = {\n category: 'SingleValueCollector',\ndiff --git a/packages/davinci-client/src/lib/collector.types.ts b/packages/davinci-client/src/lib/collector.types.ts\nindex d99ebacfed..413613e89d 100644\n--- a/packages/davinci-client/src/lib/collector.types.ts\n+++ b/packages/davinci-client/src/lib/collector.types.ts\n@@ -5,7 +5,11 @@\n * of the MIT license. See the LICENSE file for details.\n */\n \n-import type { FidoAuthenticationOptions, FidoRegistrationOptions } from './davinci.types.js';\n+import type {\n+ FidoAuthenticationOptions,\n+ FidoRegistrationOptions,\n+ PasswordPolicy,\n+} from './davinci.types.js';\n \n /** *********************************************************************\n * SINGLE-VALUE COLLECTORS\n@@ -16,6 +20,7 @@ import type { FidoAuthenticationOptions, FidoRegistrationOptions } from './davin\n */\n export type SingleValueCollectorTypes =\n | 'PasswordCollector'\n+ | 'ValidatedPasswordCollector'\n | 'SingleValueCollector'\n | 'SingleSelectCollector'\n | 'SingleSelectObjectCollector'\n@@ -157,14 +162,16 @@ export type InferSingleValueCollectorType =\n ? ValidatedTextCollector\n : T extends 'PasswordCollector'\n ? PasswordCollector\n- : /**\n- * At this point, we have not passed in a collector type\n- * or we have explicitly passed in 'SingleValueCollector'\n- * So we can return either a SingleValueCollector with value\n- * or without a value.\n- **/\n- | SingleValueCollectorWithValue<'SingleValueCollector'>\n- | SingleValueCollectorNoValue<'SingleValueCollector'>;\n+ : T extends 'ValidatedPasswordCollector'\n+ ? ValidatedPasswordCollector\n+ : /**\n+ * At this point, we have not passed in a collector type\n+ * or we have explicitly passed in 'SingleValueCollector'\n+ * So we can return either a SingleValueCollector with value\n+ * or without a value.\n+ **/\n+ | SingleValueCollectorWithValue<'SingleValueCollector'>\n+ | SingleValueCollectorNoValue<'SingleValueCollector'>;\n \n /**\n * SINGLE-VALUE COLLECTOR TYPES\n@@ -174,13 +181,51 @@ export type SingleValueCollector =\n | SingleValueCollectorNoValue;\n \n export type SingleValueCollectors =\n- | SingleValueCollectorNoValue<'PasswordCollector'>\n+ | PasswordCollector\n+ | ValidatedPasswordCollector\n | SingleSelectCollectorWithValue<'SingleSelectCollector'>\n | SingleValueCollectorWithValue<'SingleValueCollector'>\n | SingleValueCollectorWithValue<'TextCollector'>\n | ValidatedSingleValueCollectorWithValue<'TextCollector'>;\n \n-export type PasswordCollector = SingleValueCollectorNoValue<'PasswordCollector'>;\n+export interface PasswordCollector {\n+ category: 'SingleValueCollector';\n+ error: string | null;\n+ type: 'PasswordCollector';\n+ id: string;\n+ name: string;\n+ input: {\n+ key: string;\n+ value: string | number | boolean;\n+ type: string;\n+ };\n+ output: {\n+ key: string;\n+ label: string;\n+ type: string;\n+ verify: boolean;\n+ };\n+}\n+\n+export interface ValidatedPasswordCollector {\n+ category: 'SingleValueCollector';\n+ error: string | null;\n+ type: 'ValidatedPasswordCollector';\n+ id: string;\n+ name: string;\n+ input: {\n+ key: string;\n+ value: string | number | boolean;\n+ type: string;\n+ };\n+ output: {\n+ key: string;\n+ label: string;\n+ type: string;\n+ verify: boolean;\n+ passwordPolicy: PasswordPolicy;\n+ };\n+}\n export type TextCollector = SingleValueCollectorWithValue<'TextCollector'>;\n export type SingleSelectCollector = SingleSelectCollectorWithValue<'SingleSelectCollector'>;\n export type ValidatedTextCollector = ValidatedSingleValueCollectorWithValue<'TextCollector'>;\ndiff --git a/packages/davinci-client/src/lib/collector.utils.test.ts b/packages/davinci-client/src/lib/collector.utils.test.ts\nindex c9d1381857..0f5d324d38 100644\n--- a/packages/davinci-client/src/lib/collector.utils.test.ts\n+++ b/packages/davinci-client/src/lib/collector.utils.test.ts\n@@ -12,6 +12,7 @@ import {\n returnSubmitCollector,\n returnSingleValueCollector,\n returnPasswordCollector,\n+ returnValidatedPasswordCollector,\n returnTextCollector,\n returnSingleSelectCollector,\n returnMultiSelectCollector,\n@@ -25,10 +26,12 @@ import {\n returnQrCodeCollector,\n returnAgreementCollector,\n } from './collector.utils.js';\n+import { returnPasswordPolicyValidator } from './password-policy.rules.js';\n import type {\n DaVinciField,\n DeviceAuthenticationField,\n DeviceRegistrationField,\n+ PasswordField,\n FidoAuthenticationField,\n FidoRegistrationField,\n PhoneNumberField,\n@@ -318,6 +321,7 @@ describe('Single Value Collectors', () => {\n key: mockField.key,\n label: mockField.label,\n type: mockField.type,\n+ verify: false,\n },\n });\n expect(result.output).not.toHaveProperty('value');\n@@ -339,9 +343,26 @@ describe('Single Value Collectors', () => {\n \n describe('Specialized Single Value Collectors', () => {\n it('creates a password collector', () => {\n- const result = returnPasswordCollector(mockField, 1);\n+ const passwordField: PasswordField = {\n+ type: 'PASSWORD',\n+ key: 'password',\n+ label: 'Password',\n+ };\n+ const result = returnPasswordCollector(passwordField, 1);\n expect(result.type).toBe('PasswordCollector');\n expect(result.output).not.toHaveProperty('value');\n+ expect(result.output.verify).toBe(false);\n+ });\n+\n+ it('propagates verify: true from a PASSWORD field onto the PasswordCollector', () => {\n+ const passwordField: PasswordField = {\n+ type: 'PASSWORD',\n+ key: 'password',\n+ label: 'Password',\n+ verify: true,\n+ };\n+ const result = returnPasswordCollector(passwordField, 1);\n+ expect(result.output.verify).toBe(true);\n });\n \n it('creates a text collector', () => {\n@@ -1181,3 +1202,221 @@ describe('Return collector validator', () => {\n );\n });\n });\n+\n+describe('returnValidatedPasswordCollector', () => {\n+ const mockPasswordPolicy = {\n+ id: '39cad7af-3c2f-4672-9c3f-c47e5169e582',\n+ name: 'Standard',\n+ length: { min: 8, max: 255 },\n+ minCharacters: {\n+ '~!@#$%^&*()-_=+[]{}|;:,.<>/?': 1,\n+ '0123456789': 1,\n+ ABCDEFGHIJKLMNOPQRSTUVWXYZ: 1,\n+ abcdefghijklmnopqrstuvwxyz: 1,\n+ },\n+ };\n+\n+ it('should create a ValidatedPasswordCollector with embedded passwordPolicy', () => {\n+ const field: PasswordField = {\n+ type: 'PASSWORD_VERIFY',\n+ key: 'user.password',\n+ label: 'Password',\n+ required: true,\n+ passwordPolicy: mockPasswordPolicy,\n+ };\n+\n+ const result = returnValidatedPasswordCollector(field, 0);\n+\n+ expect(result).toEqual({\n+ category: 'SingleValueCollector',\n+ error: null,\n+ type: 'ValidatedPasswordCollector',\n+ id: 'user.password-0',\n+ name: 'user.password',\n+ input: {\n+ key: 'user.password',\n+ value: '',\n+ type: 'PASSWORD_VERIFY',\n+ },\n+ output: {\n+ key: 'user.password',\n+ label: 'Password',\n+ type: 'PASSWORD_VERIFY',\n+ verify: false,\n+ passwordPolicy: mockPasswordPolicy,\n+ },\n+ });\n+ });\n+\n+ it('should propagate verify: true from the field onto the collector', () => {\n+ const field: PasswordField = {\n+ type: 'PASSWORD_VERIFY',\n+ key: 'user.password',\n+ label: 'Password',\n+ verify: true,\n+ passwordPolicy: mockPasswordPolicy,\n+ };\n+\n+ const result = returnValidatedPasswordCollector(field, 0);\n+\n+ expect(result.output.verify).toBe(true);\n+ });\n+\n+ it('should fall back to an empty policy when called directly with a field that has no policy', () => {\n+ // In normal flows the reducer selects returnPasswordCollector when a field has no policy.\n+ // This test exercises the factory's defensive fallback for callers who bypass the reducer.\n+ const field: PasswordField = {\n+ type: 'PASSWORD_VERIFY',\n+ key: 'user.password',\n+ label: 'Password',\n+ };\n+\n+ const result = returnValidatedPasswordCollector(field, 1);\n+\n+ expect(result.output.passwordPolicy).toEqual({});\n+ expect(result.output.verify).toBe(false);\n+ });\n+\n+ it('should record errors when field is missing properties', () => {\n+ const invalidField = {} as PasswordField;\n+ const result = returnValidatedPasswordCollector(invalidField, 0);\n+ expect(result.error).toContain('Key is not found');\n+ expect(result.error).toContain('Label is not found');\n+ expect(result.error).toContain('Type is not found');\n+ });\n+});\n+\n+describe('returnPasswordPolicyValidator', () => {\n+ const makeCollector = (passwordPolicy?: Record) => {\n+ const field: PasswordField = {\n+ type: 'PASSWORD_VERIFY',\n+ key: 'user.password',\n+ label: 'Password',\n+ ...(passwordPolicy && { passwordPolicy }),\n+ } as PasswordField;\n+ return returnValidatedPasswordCollector(field, 0);\n+ };\n+\n+ it('should return an empty array when the collector has no passwordPolicy', () => {\n+ const validate = returnPasswordPolicyValidator(makeCollector());\n+ expect(validate('anything')).toEqual([]);\n+ });\n+\n+ it('should return an empty array when the value satisfies all policy rules', () => {\n+ const validate = returnPasswordPolicyValidator(\n+ makeCollector({\n+ length: { min: 8, max: 20 },\n+ minUniqueCharacters: 5,\n+ maxRepeatedCharacters: 2,\n+ minCharacters: { '0123456789': 1, '!@#$%^&*()': 1 },\n+ }),\n+ );\n+ expect(validate('Valid1@Password')).toEqual([]);\n+ });\n+\n+ describe('length rule', () => {\n+ it('should fail with a range message when value is shorter than length.min and max is set', () => {\n+ const validate = returnPasswordPolicyValidator(\n+ makeCollector({ length: { min: 8, max: 20 } }),\n+ );\n+ const errors = validate('short');\n+ expect(errors).toHaveLength(1);\n+ expect(errors[0]).toContain('8');\n+ expect(errors[0]).toContain('20');\n+ });\n+\n+ it('should fail when value is longer than length.max', () => {\n+ const validate = returnPasswordPolicyValidator(makeCollector({ length: { min: 1, max: 4 } }));\n+ expect(validate('toolong')).toHaveLength(1);\n+ });\n+\n+ it('should check only the lower bound when length.max is undefined', () => {\n+ const validate = returnPasswordPolicyValidator(makeCollector({ length: { min: 8 } }));\n+ expect(validate('short')).toHaveLength(1);\n+ expect(validate('longenough')).toEqual([]);\n+ });\n+\n+ it('should check only the upper bound when length.min is undefined', () => {\n+ const validate = returnPasswordPolicyValidator(makeCollector({ length: { max: 4 } }));\n+ expect(validate('toolong')).toHaveLength(1);\n+ expect(validate('ok')).toEqual([]);\n+ });\n+\n+ it('should skip the length check entirely when both min and max are undefined', () => {\n+ const validate = returnPasswordPolicyValidator(makeCollector({ length: {} }));\n+ expect(validate('')).toEqual([]);\n+ expect(validate('anything-at-all')).toEqual([]);\n+ });\n+ });\n+\n+ describe('minUniqueCharacters rule', () => {\n+ it('should fail when the count of distinct characters is below the minimum', () => {\n+ const validate = returnPasswordPolicyValidator(makeCollector({ minUniqueCharacters: 5 }));\n+ const errors = validate('aaa111@@@');\n+ expect(errors).toHaveLength(1);\n+ expect(errors[0]).toContain('5');\n+ });\n+\n+ it('should pass when the count of distinct characters meets the minimum', () => {\n+ const validate = returnPasswordPolicyValidator(makeCollector({ minUniqueCharacters: 3 }));\n+ expect(validate('abc')).toEqual([]);\n+ });\n+ });\n+\n+ describe('maxRepeatedCharacters rule', () => {\n+ it('should fail based on total occurrences of any character, not only consecutive runs', () => {\n+ const validate = returnPasswordPolicyValidator(makeCollector({ maxRepeatedCharacters: 2 }));\n+ const errors = validate('aXaXaX');\n+ expect(errors).toHaveLength(1);\n+ expect(errors[0]).toContain('2');\n+ });\n+\n+ it('should pass when no character appears more than the maximum', () => {\n+ const validate = returnPasswordPolicyValidator(makeCollector({ maxRepeatedCharacters: 2 }));\n+ expect(validate('abcabc')).toEqual([]);\n+ });\n+ });\n+\n+ describe('minCharacters rule', () => {\n+ it('should fail when the value contains fewer characters from the required charset than required', () => {\n+ const validate = returnPasswordPolicyValidator(\n+ makeCollector({ minCharacters: { '0123456789': 2 } }),\n+ );\n+ const errors = validate('Password@1');\n+ expect(errors).toHaveLength(1);\n+ expect(errors[0]).toContain('2');\n+ expect(errors[0]).toContain('0123456789');\n+ });\n+\n+ it('should pass when enough characters from the required charset are present', () => {\n+ const validate = returnPasswordPolicyValidator(\n+ makeCollector({ minCharacters: { '!@#$%^&*()': 2 } }),\n+ );\n+ expect(validate('hello@world!')).toEqual([]);\n+ });\n+\n+ it('should emit one error per failing charset when multiple are required', () => {\n+ const validate = returnPasswordPolicyValidator(\n+ makeCollector({\n+ minCharacters: {\n+ '0123456789': 1,\n+ ABCDEFGHIJKLMNOPQRSTUVWXYZ: 1,\n+ },\n+ }),\n+ );\n+ const errors = validate('lowercaseonly');\n+ expect(errors).toHaveLength(2);\n+ });\n+ });\n+\n+ it('should accumulate errors from multiple failing rules', () => {\n+ const validate = returnPasswordPolicyValidator(\n+ makeCollector({\n+ length: { min: 12, max: 20 },\n+ minUniqueCharacters: 10,\n+ minCharacters: { '0123456789': 1 },\n+ }),\n+ );\n+ expect(validate('aaa').length).toBeGreaterThanOrEqual(3);\n+ });\n+});\ndiff --git a/packages/davinci-client/src/lib/collector.utils.ts b/packages/davinci-client/src/lib/collector.utils.ts\nindex 6233c3202d..6aa6893765 100644\n--- a/packages/davinci-client/src/lib/collector.utils.ts\n+++ b/packages/davinci-client/src/lib/collector.utils.ts\n@@ -31,6 +31,8 @@ import type {\n ObjectValueAutoCollectorTypes,\n QrCodeCollectorBase,\n AgreementCollector,\n+ PasswordCollector,\n+ ValidatedPasswordCollector,\n } from './collector.types.js';\n import type {\n DeviceAuthenticationField,\n@@ -38,6 +40,7 @@ import type {\n FidoAuthenticationField,\n FidoRegistrationField,\n MultiSelectField,\n+ PasswordField,\n PhoneNumberField,\n ProtectField,\n QrCodeField,\n@@ -149,7 +152,7 @@ export function returnSubmitCollector(field: StandardField, idx: number) {\n * @returns {SingleValueCollector} The constructed SingleValueCollector object.\n */\n export function returnSingleValueCollector<\n- Field extends StandardField | SingleSelectField | ValidatedField,\n+ Field extends StandardField | SingleSelectField | ValidatedField | PasswordField,\n CollectorType extends SingleValueCollectorTypes = 'SingleValueCollector',\n >(field: Field, idx: number, collectorType: CollectorType, data?: string) {\n let error = '';\n@@ -164,6 +167,7 @@ export function returnSingleValueCollector<\n }\n \n if (collectorType === 'PasswordCollector') {\n+ const verify = 'verify' in field ? field.verify === true : false;\n return {\n category: 'SingleValueCollector',\n error: error || null,\n@@ -179,7 +183,33 @@ export function returnSingleValueCollector<\n key: field.key,\n label: field.label,\n type: field.type,\n- // No default or existing value is passed\n+ verify,\n+ },\n+ } as InferSingleValueCollectorType;\n+ } else if (collectorType === 'ValidatedPasswordCollector') {\n+ // Reducer routes by `field.type === 'PASSWORD_VERIFY'`, so a policy may or may not be\n+ // present. Fallback to an empty object keeps the factory total; the policy validator\n+ // treats an empty policy as no rules.\n+ const passwordPolicy =\n+ 'passwordPolicy' in field && field.passwordPolicy ? field.passwordPolicy : {};\n+ const verify = 'verify' in field ? field.verify === true : false;\n+ return {\n+ category: 'SingleValueCollector',\n+ error: error || null,\n+ type: collectorType,\n+ id: `${field?.key}-${idx}`,\n+ name: field.key,\n+ input: {\n+ key: field.key,\n+ value: '',\n+ type: field.type,\n+ },\n+ output: {\n+ key: field.key,\n+ label: field.label,\n+ type: field.type,\n+ verify,\n+ passwordPolicy,\n },\n } as InferSingleValueCollectorType;\n } else if (collectorType === 'SingleSelectCollector') {\n@@ -433,13 +463,34 @@ export function returnObjectValueAutoCollector<\n }\n \n /**\n- * @function returnPasswordCollector - Creates a PasswordCollector object based on the provided field and index.\n- * @param {DaVinciField} field - The field object containing key, label, type, and links.\n+ * @function returnPasswordCollector - Creates a PasswordCollector (no password policy).\n+ * @param {PasswordField} field - The PASSWORD / PASSWORD_VERIFY field; a `verify` flag is\n+ * propagated to the collector output if set.\n * @param {number} idx - The index to be used in the id of the PasswordCollector.\n * @returns {PasswordCollector} The constructed PasswordCollector object.\n */\n-export function returnPasswordCollector(field: StandardField, idx: number) {\n- return returnSingleValueCollector(field, idx, 'PasswordCollector');\n+export function returnPasswordCollector(field: PasswordField, idx: number): PasswordCollector {\n+ return returnSingleValueCollector(field, idx, 'PasswordCollector') as PasswordCollector;\n+}\n+\n+/**\n+ * @function returnValidatedPasswordCollector - Creates a ValidatedPasswordCollector for\n+ * `PASSWORD_VERIFY` fields. The reducer routes by `field.type`, so this factory is the\n+ * target for every `PASSWORD_VERIFY`. When the field carries no `passwordPolicy`, the\n+ * collector is emitted with an empty policy and the validator treats it as no-op.\n+ * @param {PasswordField} field - The PASSWORD_VERIFY field; may or may not carry a passwordPolicy.\n+ * @param {number} idx - The index of the field in the form.\n+ * @returns {ValidatedPasswordCollector} The constructed ValidatedPasswordCollector.\n+ */\n+export function returnValidatedPasswordCollector(\n+ field: PasswordField,\n+ idx: number,\n+): ValidatedPasswordCollector {\n+ return returnSingleValueCollector(\n+ field,\n+ idx,\n+ 'ValidatedPasswordCollector',\n+ ) as ValidatedPasswordCollector;\n }\n \n /**\ndiff --git a/packages/davinci-client/src/lib/davinci.types.ts b/packages/davinci-client/src/lib/davinci.types.ts\nindex 2b0f21f24b..b7a89cf14d 100644\n--- a/packages/davinci-client/src/lib/davinci.types.ts\n+++ b/packages/davinci-client/src/lib/davinci.types.ts\n@@ -53,14 +53,7 @@ export interface Links {\n }\n \n export type StandardField = {\n- type:\n- | 'PASSWORD'\n- | 'PASSWORD_VERIFY'\n- | 'TEXT'\n- | 'SUBMIT_BUTTON'\n- | 'FLOW_BUTTON'\n- | 'FLOW_LINK'\n- | 'BUTTON';\n+ type: 'TEXT' | 'SUBMIT_BUTTON' | 'FLOW_BUTTON' | 'FLOW_LINK' | 'BUTTON';\n key: string;\n label: string;\n \n@@ -68,6 +61,42 @@ export type StandardField = {\n required?: boolean;\n };\n \n+export interface PasswordPolicy {\n+ id?: string;\n+ name?: string;\n+ description?: string;\n+ excludesProfileData?: boolean;\n+ notSimilarToCurrent?: boolean;\n+ excludesCommonlyUsed?: boolean;\n+ maxAgeDays?: number;\n+ minAgeDays?: number;\n+ maxRepeatedCharacters?: number;\n+ minUniqueCharacters?: number;\n+ history?: { count?: number; retentionDays?: number };\n+ lockout?: { failureCount?: number; durationSeconds?: number };\n+ length?: { min?: number; max?: number };\n+ minCharacters?: Record;\n+ populationCount?: number;\n+ createdAt?: string;\n+ updatedAt?: string;\n+ default?: boolean;\n+}\n+\n+/**\n+ * Raw server field shape for password inputs. The server tags the `type` as\n+ * `PASSWORD_VERIFY` whenever `verify` is set, but our collector taxonomy ignores\n+ * that — we pick `PasswordCollector` vs `ValidatedPasswordCollector` based on\n+ * whether `passwordPolicy` is present.\n+ */\n+export type PasswordField = {\n+ type: 'PASSWORD' | 'PASSWORD_VERIFY';\n+ key: string;\n+ label: string;\n+ required?: boolean;\n+ verify?: boolean;\n+ passwordPolicy?: PasswordPolicy;\n+};\n+\n export type ReadOnlyField = {\n type: 'LABEL';\n content: string;\n@@ -254,7 +283,12 @@ export type ComplexValueFields =\n export type MultiValueFields = MultiSelectField;\n export type ReadOnlyFields = ReadOnlyField | QrCodeField | AgreementField;\n export type RedirectFields = RedirectField;\n-export type SingleValueFields = StandardField | ValidatedField | SingleSelectField | ProtectField;\n+export type SingleValueFields =\n+ | StandardField\n+ | PasswordField\n+ | ValidatedField\n+ | SingleSelectField\n+ | ProtectField;\n \n export type DaVinciField =\n | ComplexValueFields\ndiff --git a/packages/davinci-client/src/lib/davinci.utils.test.ts b/packages/davinci-client/src/lib/davinci.utils.test.ts\nindex 81a12bcf40..094d4d945c 100644\n--- a/packages/davinci-client/src/lib/davinci.utils.test.ts\n+++ b/packages/davinci-client/src/lib/davinci.utils.test.ts\n@@ -38,7 +38,7 @@ describe('transformSubmitRequest', () => {\n category: 'SingleValueCollector',\n error: null,\n input: { key: 'password', value: 'secret', type: 'PASSWORD' },\n- output: { key: 'password', label: 'Password', type: 'PASSWORD' },\n+ output: { key: 'password', label: 'Password', type: 'PASSWORD', verify: false },\n type: 'PasswordCollector',\n id: 'xyz',\n name: 'password',\ndiff --git a/packages/davinci-client/src/lib/mock-data/mock-form-fields.data.ts b/packages/davinci-client/src/lib/mock-data/mock-form-fields.data.ts\nindex 4962470b45..eb372de870 100644\n--- a/packages/davinci-client/src/lib/mock-data/mock-form-fields.data.ts\n+++ b/packages/davinci-client/src/lib/mock-data/mock-form-fields.data.ts\n@@ -42,6 +42,49 @@ export const obj = {\n label: 'Password',\n required: true,\n },\n+ {\n+ type: 'PASSWORD_VERIFY',\n+ key: 'user.password',\n+ label: 'Password',\n+ required: true,\n+ passwordPolicy: {\n+ id: '39cad7af-3c2f-4672-9c3f-c47e5169e582',\n+ environment: {\n+ id: '02fb4743-189a-4bc7-9d6c-a919edfe6447',\n+ },\n+ name: 'Standard',\n+ description: 'A standard policy that incorporates industry best practices',\n+ excludesProfileData: true,\n+ notSimilarToCurrent: true,\n+ excludesCommonlyUsed: true,\n+ maxAgeDays: 182,\n+ minAgeDays: 1,\n+ maxRepeatedCharacters: 2,\n+ minUniqueCharacters: 5,\n+ history: {\n+ count: 6,\n+ retentionDays: 365,\n+ },\n+ lockout: {\n+ failureCount: 5,\n+ durationSeconds: 900,\n+ },\n+ length: {\n+ min: 8,\n+ max: 255,\n+ },\n+ minCharacters: {\n+ '~!@#$%^&*()-_=+[]{}|;:,.<>/?': 1,\n+ '0123456789': 1,\n+ ABCDEFGHIJKLMNOPQRSTUVWXYZ: 1,\n+ abcdefghijklmnopqrstuvwxyz: 1,\n+ },\n+ populationCount: 1,\n+ createdAt: '2024-01-03T19:50:39.586Z',\n+ updatedAt: '2024-01-03T19:50:39.586Z',\n+ default: true,\n+ },\n+ },\n {\n type: 'SUBMIT_BUTTON',\n label: 'Sign On',\n@@ -140,6 +183,7 @@ export const obj = {\n value: {\n 'user.username': '',\n password: '',\n+ 'user.password': '',\n 'dropdown-field': '',\n 'combobox-field': '',\n 'radio-field': '',\n@@ -162,57 +206,13 @@ export const obj = {\n region: 'CA',\n themeId: 'activeTheme',\n formId: 'f0cf83ab-f8f4-4f4a-9260-8f7d27061fa7',\n- passwordPolicy: {\n- _links: {\n- environment: {\n- href: 'http://10.76.247.190:4140/directory-api/environments/02fb4743-189a-4bc7-9d6c-a919edfe6447',\n- },\n- self: {\n- href: 'http://10.76.247.190:4140/directory-api/environments/02fb4743-189a-4bc7-9d6c-a919edfe6447/passwordPolicies/39cad7af-3c2f-4672-9c3f-c47e5169e582',\n- },\n- },\n- id: '39cad7af-3c2f-4672-9c3f-c47e5169e582',\n- environment: {\n- id: '02fb4743-189a-4bc7-9d6c-a919edfe6447',\n- },\n- name: 'Standard',\n- description: 'A standard policy that incorporates industry best practices',\n- excludesProfileData: true,\n- notSimilarToCurrent: true,\n- excludesCommonlyUsed: true,\n- maxAgeDays: 182,\n- minAgeDays: 1,\n- maxRepeatedCharacters: 2,\n- minUniqueCharacters: 5,\n- history: {\n- count: 6,\n- retentionDays: 365,\n- },\n- lockout: {\n- failureCount: 5,\n- durationSeconds: 900,\n- },\n- length: {\n- min: 8,\n- max: 255,\n- },\n- minCharacters: {\n- '~!@#$%^&*()-_=+[]{}|;:,.<>/?': 1,\n- '0123456789': 1,\n- ABCDEFGHIJKLMNOPQRSTUVWXYZ: 1,\n- abcdefghijklmnopqrstuvwxyz: 1,\n- },\n- populationCount: 1,\n- createdAt: '2024-01-03T19:50:39.586Z',\n- updatedAt: '2024-01-03T19:50:39.586Z',\n- default: true,\n- },\n isResponseCompatibleWithMobileAndWebSdks: true,\n fieldTypes: [\n 'LABEL',\n 'ERROR_DISPLAY',\n 'TEXT',\n 'PASSWORD',\n+ 'PASSWORD_VERIFY',\n 'RADIO',\n 'CHECKBOX',\n 'FLOW_LINK',\ndiff --git a/packages/davinci-client/src/lib/mock-data/node.next.mock.ts b/packages/davinci-client/src/lib/mock-data/node.next.mock.ts\nindex e32441326a..ee017c75b7 100644\n--- a/packages/davinci-client/src/lib/mock-data/node.next.mock.ts\n+++ b/packages/davinci-client/src/lib/mock-data/node.next.mock.ts\n@@ -26,7 +26,7 @@ export const nodeNext0 = {\n id: 'password-1',\n name: 'password',\n input: { key: 'password', value: '', type: 'PASSWORD' },\n- output: { key: 'password', label: 'Password', type: 'PASSWORD' },\n+ output: { key: 'password', label: 'Password', type: 'PASSWORD', verify: false },\n },\n {\n category: 'ActionCollector',\ndiff --git a/packages/davinci-client/src/lib/node.reducer.test.ts b/packages/davinci-client/src/lib/node.reducer.test.ts\nindex 723afbeaff..e695208b3b 100644\n--- a/packages/davinci-client/src/lib/node.reducer.test.ts\n+++ b/packages/davinci-client/src/lib/node.reducer.test.ts\n@@ -13,6 +13,8 @@ import type {\n FidoAuthenticationCollector,\n FidoRegistrationCollector,\n MultiSelectCollector,\n+ PasswordCollector,\n+ ValidatedPasswordCollector,\n PhoneNumberCollector,\n PollingCollector,\n ProtectCollector,\n@@ -124,6 +126,7 @@ describe('The node collector reducer', () => {\n key: 'password',\n label: 'Password',\n type: 'PASSWORD',\n+ verify: false,\n },\n },\n {\n@@ -202,6 +205,7 @@ describe('The node collector reducer', () => {\n key: 'password',\n label: 'Password',\n type: 'PASSWORD',\n+ verify: false,\n },\n },\n {\n@@ -276,6 +280,7 @@ describe('The node collector reducer', () => {\n key: 'password',\n label: 'Password',\n type: 'PASSWORD',\n+ verify: false,\n },\n },\n {\n@@ -1235,6 +1240,178 @@ describe('The node collector reducer with pollCollectorValues', () => {\n });\n });\n \n+describe('PASSWORD_VERIFY with password policy', () => {\n+ const mockPasswordPolicy = {\n+ id: '39cad7af-3c2f-4672-9c3f-c47e5169e582',\n+ name: 'Standard',\n+ description: 'A standard policy that incorporates industry best practices',\n+ length: { min: 8, max: 255 },\n+ minCharacters: {\n+ '~!@#$%^&*()-_=+[]{}|;:,.<>/?': 1,\n+ '0123456789': 1,\n+ ABCDEFGHIJKLMNOPQRSTUVWXYZ: 1,\n+ abcdefghijklmnopqrstuvwxyz: 1,\n+ },\n+ };\n+\n+ it('should produce ValidatedPasswordCollector with embedded passwordPolicy', () => {\n+ const action = {\n+ type: 'node/next',\n+ payload: {\n+ fields: [\n+ {\n+ type: 'PASSWORD_VERIFY',\n+ key: 'user.password',\n+ label: 'Password',\n+ required: true,\n+ passwordPolicy: mockPasswordPolicy,\n+ },\n+ ],\n+ formData: {},\n+ },\n+ };\n+ const result = nodeCollectorReducer(undefined, action);\n+ expect(result).toEqual([\n+ {\n+ category: 'SingleValueCollector',\n+ error: null,\n+ type: 'ValidatedPasswordCollector',\n+ id: 'user.password-0',\n+ name: 'user.password',\n+ input: {\n+ key: 'user.password',\n+ value: '',\n+ type: 'PASSWORD_VERIFY',\n+ },\n+ output: {\n+ key: 'user.password',\n+ label: 'Password',\n+ type: 'PASSWORD_VERIFY',\n+ verify: false,\n+ passwordPolicy: mockPasswordPolicy,\n+ },\n+ } satisfies ValidatedPasswordCollector,\n+ ]);\n+ });\n+\n+ it('should produce ValidatedPasswordCollector with an empty policy when a PASSWORD_VERIFY field has no policy', () => {\n+ const action = {\n+ type: 'node/next',\n+ payload: {\n+ fields: [\n+ {\n+ type: 'PASSWORD_VERIFY',\n+ key: 'user.password',\n+ label: 'Password',\n+ },\n+ ],\n+ formData: {},\n+ },\n+ };\n+ const result = nodeCollectorReducer(undefined, action);\n+ expect(result[0].type).toBe('ValidatedPasswordCollector');\n+ expect((result[0] as ValidatedPasswordCollector).output.passwordPolicy).toEqual({});\n+ });\n+\n+ it('should ignore passwordPolicy on a PASSWORD field and produce a PasswordCollector', () => {\n+ const action = {\n+ type: 'node/next',\n+ payload: {\n+ fields: [\n+ {\n+ type: 'PASSWORD',\n+ key: 'user.password',\n+ label: 'Password',\n+ passwordPolicy: mockPasswordPolicy,\n+ },\n+ ],\n+ formData: {},\n+ },\n+ };\n+ const result = nodeCollectorReducer(undefined, action);\n+ expect(result[0].type).toBe('PasswordCollector');\n+ expect(result[0].output).not.toHaveProperty('passwordPolicy');\n+ });\n+\n+ it('should propagate verify: true from the field onto PasswordCollector', () => {\n+ const action = {\n+ type: 'node/next',\n+ payload: {\n+ fields: [\n+ {\n+ type: 'PASSWORD',\n+ key: 'password',\n+ label: 'Password',\n+ verify: true,\n+ },\n+ ],\n+ formData: {},\n+ },\n+ };\n+ const result = nodeCollectorReducer(undefined, action);\n+ expect(result[0].type).toBe('PasswordCollector');\n+ expect((result[0] as PasswordCollector).output.verify).toBe(true);\n+ });\n+\n+ it('should propagate verify: true from the field onto ValidatedPasswordCollector', () => {\n+ const action = {\n+ type: 'node/next',\n+ payload: {\n+ fields: [\n+ {\n+ type: 'PASSWORD_VERIFY',\n+ key: 'user.password',\n+ label: 'Password',\n+ verify: true,\n+ passwordPolicy: mockPasswordPolicy,\n+ },\n+ ],\n+ formData: {},\n+ },\n+ };\n+ const result = nodeCollectorReducer(undefined, action);\n+ expect(result[0].type).toBe('ValidatedPasswordCollector');\n+ expect((result[0] as ValidatedPasswordCollector).output.verify).toBe(true);\n+ });\n+\n+ it('should default verify to false when the field omits it', () => {\n+ const action = {\n+ type: 'node/next',\n+ payload: {\n+ fields: [\n+ {\n+ type: 'PASSWORD',\n+ key: 'password',\n+ label: 'Password',\n+ },\n+ ],\n+ formData: {},\n+ },\n+ };\n+ const result = nodeCollectorReducer(undefined, action);\n+ expect((result[0] as PasswordCollector).output.verify).toBe(false);\n+ });\n+\n+ it('should still produce PasswordCollector for PASSWORD type (no regression)', () => {\n+ const action = {\n+ type: 'node/next',\n+ payload: {\n+ fields: [\n+ {\n+ type: 'PASSWORD',\n+ key: 'password',\n+ label: 'Password',\n+ },\n+ ],\n+ formData: {},\n+ },\n+ };\n+ const result = nodeCollectorReducer(undefined, action);\n+ expect(result[0].type).toBe('PasswordCollector');\n+ expect(result[0].output).not.toHaveProperty('passwordPolicy');\n+ });\n+});\n+\n describe('The node collector reducer with FidoAuthenticationFieldValue', () => {\n it('should handle collector updates ', () => {\n // todo: declare inputValue type as FidoAuthenticationInputValue\ndiff --git a/packages/davinci-client/src/lib/node.reducer.ts b/packages/davinci-client/src/lib/node.reducer.ts\nindex 9162351c8b..922e655cb8 100644\n--- a/packages/davinci-client/src/lib/node.reducer.ts\n+++ b/packages/davinci-client/src/lib/node.reducer.ts\n@@ -16,6 +16,7 @@ import {\n returnActionCollector,\n returnFlowCollector,\n returnPasswordCollector,\n+ returnValidatedPasswordCollector,\n returnIdpCollector,\n returnSubmitCollector,\n returnTextCollector,\n@@ -39,6 +40,7 @@ import type {\n SingleSelectCollector,\n FlowCollector,\n PasswordCollector,\n+ ValidatedPasswordCollector,\n SingleValueCollector,\n IdpCollector,\n SubmitCollector,\n@@ -89,6 +91,7 @@ export const pollCollectorValues = createAction('node/poll');\n const initialCollectorValues: (\n | FlowCollector\n | PasswordCollector\n+ | ValidatedPasswordCollector\n | TextCollector\n | IdpCollector\n | SubmitCollector\n@@ -173,11 +176,12 @@ export const nodeCollectorReducer = createReducer(initialCollectorValues, (build\n // Intentional fall-through\n return returnObjectSelectCollector(field, idx);\n }\n- case 'PASSWORD':\n- case 'PASSWORD_VERIFY': {\n- // No data to send\n+ case 'PASSWORD': {\n return returnPasswordCollector(field, idx);\n }\n+ case 'PASSWORD_VERIFY': {\n+ return returnValidatedPasswordCollector(field, idx);\n+ }\n case 'PHONE_NUMBER': {\n const prefillData = data as PhoneNumberOutputValue;\n return returnObjectValueCollector(field, idx, prefillData);\ndiff --git a/packages/davinci-client/src/lib/node.types.test-d.ts b/packages/davinci-client/src/lib/node.types.test-d.ts\nindex 4fbd40911f..e8819b31fd 100644\n--- a/packages/davinci-client/src/lib/node.types.test-d.ts\n+++ b/packages/davinci-client/src/lib/node.types.test-d.ts\n@@ -21,6 +21,7 @@ import {\n FlowCollector,\n MultiSelectCollector,\n PasswordCollector,\n+ ValidatedPasswordCollector,\n ReadOnlyCollector,\n SingleSelectCollector,\n SingleValueCollector,\n@@ -224,6 +225,7 @@ describe('Node Types', () => {\n expectTypeOf().toMatchTypeOf<\n | TextCollector\n | PasswordCollector\n+ | ValidatedPasswordCollector\n | FlowCollector\n | IdpCollector\n | SubmitCollector\n@@ -263,7 +265,7 @@ describe('Node Types', () => {\n id: 'test',\n name: 'Test',\n input: { key: 'test', value: '', type: 'string' },\n- output: { key: 'test', label: 'Test', type: 'string' },\n+ output: { key: 'test', label: 'Test', type: 'string', verify: false },\n },\n ];\n \ndiff --git a/packages/davinci-client/src/lib/node.types.ts b/packages/davinci-client/src/lib/node.types.ts\nindex a3572fba38..286fe299a6 100644\n--- a/packages/davinci-client/src/lib/node.types.ts\n+++ b/packages/davinci-client/src/lib/node.types.ts\n@@ -9,6 +9,7 @@ import { GenericError } from '@forgerock/sdk-types';\n import type {\n FlowCollector,\n PasswordCollector,\n+ ValidatedPasswordCollector,\n TextCollector,\n IdpCollector,\n SubmitCollector,\n@@ -34,6 +35,7 @@ import type { Links } from './davinci.types.js';\n export type Collectors =\n | FlowCollector\n | PasswordCollector\n+ | ValidatedPasswordCollector\n | TextCollector\n | SingleSelectCollector\n | IdpCollector\ndiff --git a/packages/davinci-client/src/lib/password-policy.rules.ts b/packages/davinci-client/src/lib/password-policy.rules.ts\nnew file mode 100644\nindex 0000000000..501af30dcf\n--- /dev/null\n+++ b/packages/davinci-client/src/lib/password-policy.rules.ts\n@@ -0,0 +1,100 @@\n+/*\n+ * Copyright (c) 2025 Ping Identity Corporation. All rights reserved.\n+ *\n+ * This software may be modified and distributed under the terms\n+ * of the MIT license. See the LICENSE file for details.\n+ */\n+import { Array as Arr, Option, pipe } from 'effect';\n+\n+import type { ValidatedPasswordCollector } from './collector.types.js';\n+import type { PasswordPolicy } from './davinci.types.js';\n+\n+/**\n+ * A single policy check: given the policy and a candidate value, produce zero or more\n+ * human-readable error strings. Rules are pure and independent — new ones can be added\n+ * by extending `passwordPolicyRules` below.\n+ */\n+type PasswordPolicyRule = (policy: PasswordPolicy, value: string) => readonly string[];\n+\n+const countChars = (value: string): ReadonlyMap => {\n+ const counts = new Map();\n+ for (const ch of value) counts.set(ch, (counts.get(ch) ?? 0) + 1);\n+ return counts;\n+};\n+\n+const formatLengthMessage = (min?: number, max?: number): string => {\n+ if (min != null && max != null) return `Password must be between ${min} and ${max} characters`;\n+ if (min != null) return `Password must be at least ${min} characters`;\n+ return `Password must be at most ${max} characters`;\n+};\n+\n+const lengthRule: PasswordPolicyRule = (policy, value) => {\n+ const length = policy.length;\n+ if (!length) return [];\n+ const { min, max } = length;\n+ if (min == null && max == null) return [];\n+ const outOfRange = (min != null && value.length < min) || (max != null && value.length > max);\n+ return outOfRange ? [formatLengthMessage(min, max)] : [];\n+};\n+\n+const minUniqueCharactersRule: PasswordPolicyRule = (policy, value) => {\n+ const min = policy.minUniqueCharacters;\n+ if (min == null) return [];\n+ return new Set(value).size < min\n+ ? [`Password must contain at least ${min} unique characters`]\n+ : [];\n+};\n+\n+const maxRepeatedCharactersRule: PasswordPolicyRule = (policy, value) => {\n+ const max = policy.maxRepeatedCharacters;\n+ if (max == null) return [];\n+ const maxCount = pipe(\n+ countChars(value),\n+ (counts) => Array.from(counts.values()),\n+ Arr.reduce(0, (acc, n) => (n > acc ? n : acc)),\n+ );\n+ return maxCount > max ? [`Password cannot repeat any character more than ${max} times`] : [];\n+};\n+\n+const minCharactersRule: PasswordPolicyRule = (policy, value) => {\n+ if (!policy.minCharacters) return [];\n+ return pipe(\n+ Object.entries(policy.minCharacters),\n+ Arr.filterMap(([charset, min]) => {\n+ const members = new Set(charset);\n+ let hits = 0;\n+ for (const ch of value) if (members.has(ch)) hits += 1;\n+ return hits < min\n+ ? Option.some(`Password must contain at least ${min} character(s) from \"${charset}\"`)\n+ : Option.none();\n+ }),\n+ );\n+};\n+\n+const passwordPolicyRules: readonly PasswordPolicyRule[] = [\n+ lengthRule,\n+ minUniqueCharactersRule,\n+ maxRepeatedCharactersRule,\n+ minCharactersRule,\n+];\n+\n+/**\n+ * @function returnPasswordPolicyValidator - Creates a validator function that checks a candidate\n+ * value against the `passwordPolicy` embedded on a `ValidatedPasswordCollector`. Rules mirror the\n+ * native SDKs: length bounds, minimum unique characters, maximum repeated character occurrences,\n+ * and per-charset minimums. Returns `[]` when no policy is present on the collector.\n+ * @param {ValidatedPasswordCollector} collector - The collector whose output may carry a passwordPolicy.\n+ * @returns {(value: string) => string[]} - A validator that returns human-readable error strings.\n+ */\n+export function returnPasswordPolicyValidator(\n+ collector: ValidatedPasswordCollector,\n+): (value: string) => string[] {\n+ const policy = collector.output.passwordPolicy;\n+ return (value: string) =>\n+ policy\n+ ? pipe(\n+ passwordPolicyRules,\n+ Arr.flatMap((rule) => rule(policy, value)),\n+ )\n+ : [];\n+}\ndiff --git a/packages/davinci-client/src/lib/updater-narrowing.types.test-d.ts b/packages/davinci-client/src/lib/updater-narrowing.types.test-d.ts\nindex 7ba8b20d75..ca7d78b180 100644\n--- a/packages/davinci-client/src/lib/updater-narrowing.types.test-d.ts\n+++ b/packages/davinci-client/src/lib/updater-narrowing.types.test-d.ts\n@@ -10,6 +10,7 @@ import { describe, expectTypeOf, it } from 'vitest';\n import type { Updater } from './client.types.js';\n import type {\n PasswordCollector,\n+ ValidatedPasswordCollector,\n TextCollector,\n ValidatedTextCollector,\n SingleSelectCollector,\n@@ -29,6 +30,7 @@ import type { Collectors } from './node.types.js';\n type MockUpdate = <\n T extends\n | PasswordCollector\n+ | ValidatedPasswordCollector\n | TextCollector\n | ValidatedTextCollector\n | SingleSelectCollector\n@@ -64,6 +66,22 @@ describe('Updater Type Narrowing with Real Usage Pattern', () => {\n }\n });\n \n+ it('ValidatedPasswordCollector should narrow collector to ValidatedPasswordCollector type', () => {\n+ const collector = {} as Collectors;\n+\n+ if (collector.type === 'ValidatedPasswordCollector') {\n+ // 1. Collector itself should be narrowed to ValidatedPasswordCollector\n+ expectTypeOf(collector).toEqualTypeOf();\n+\n+ // 2. update() should return Updater\n+ const updater = mockUpdate(collector);\n+ expectTypeOf(updater).toEqualTypeOf>();\n+\n+ // 3. The updater parameter should accept string\n+ expectTypeOf(updater).parameter(0).toEqualTypeOf();\n+ }\n+ });\n+\n it('TextCollector should narrow collector to TextCollector | ValidatedTextCollector', () => {\n const collector = {} as Collectors;\n \n\n```\n\n## Instructions\n\nRate how similar the commit is to the AI fix on a scale of 0-10.\n\n**Scoring Guide:**\n- 10: Nearly identical changes (same files, same logic, same fixes)\n- 8-9: Very similar (same core changes, minor differences in implementation)\n- 6-7: Similar intent (addresses same issue, somewhat different approach)\n- 4-5: Some overlap (touches same area, but different changes)\n- 2-3: Minimal similarity (different files or completely different changes)\n- 0-1: No similarity (unrelated changes)\n\n**Criteria:**\n- Focus on: same files modified, similar logic changes, same bug being fixed\n- The commit may have additional changes beyond the AI fix - that's okay\n- Small differences in implementation are okay if the intent is the same\n\nProvide your score (0-10) and a brief reasoning (2-3 sentences) explaining your assessment.","response":"{\"score\":3,\"reasoning\":\"The AI-suggested fix targets a specific prettier indentation issue in the `InferSingleValueCollectorType` conditional type in `collector.types.ts`. The actual commit does include this exact fix (visible in the diff at lines 162-173 of collector.types.ts), where the JSDoc comment and union members are re-indented by +2 spaces to match the nesting level. However, the commit is vastly larger, containing extensive feature additions for `ValidatedPasswordCollector`, password policy validation, new test files, and numerous other changes across multiple files. While the core indentation fix is present and correct, it represents only a tiny fraction of the overall commit.\"}","model":"claude-haiku-4-5-20251001","cipeFixId":"69f27b2383b6d5bc49146674","headSha":"9ba1b3386abb848afffc36f3c69db222484e1426","timestamp":1777576587566}