{"prompt":"You are comparing an AI-suggested code fix with actual changes made in a commit.\n\nYour task: Determine if the commit contains the essence of the AI fix and provide a confidence level.\n\n## AI-Suggested Fix\n\n**What it fixes:** @forgerock/davinci-client:test\n\n**Description:** fix(davinci-client): route PASSWORD_VERIFY by field.type not policy presence\n\n**Reasoning:** The PR description explicitly states the routing rule:\n\"Routes by `field.type`: `PASSWORD` → `PasswordCollector`; `PASSWORD_VERIFY` → `ValidatedPasswordCollector`.\"\n\nHowever, the reducer implementation used a shared fall-through case with `field.passwordPolicy` as the discriminator:\n\n```\ncase 'PASSWORD':\ncase 'PASSWORD_VERIFY': {\n return field.passwordPolicy\n ? returnValidatedPasswordCollector(field, idx)\n : returnPasswordCollector(field, idx);\n}\n```\n\nThis produced two incorrect outcomes:\n\n**Suggested Changes (diff):**\n```diff\ndiff --git a/packages/davinci-client/src/lib/node.reducer.ts b/packages/davinci-client/src/lib/node.reducer.ts\nindex 310d915..40755c3 100644\n--- a/packages/davinci-client/src/lib/node.reducer.ts\n+++ b/packages/davinci-client/src/lib/node.reducer.ts\n@@ -181,11 +181,11 @@ export const nodeCollectorReducer = createReducer(initialCollectorValues, (build\n // Intentional fall-through\n return returnObjectSelectCollector(field, idx);\n }\n- case 'PASSWORD':\n+ case 'PASSWORD': {\n+ return returnPasswordCollector(field, idx);\n+ }\n case 'PASSWORD_VERIFY': {\n- return field.passwordPolicy\n- ? returnValidatedPasswordCollector(field, idx)\n- : returnPasswordCollector(field, idx);\n+ return returnValidatedPasswordCollector(field, idx);\n }\n case 'PHONE_NUMBER': {\n const prefillData = data as\n\n```\n\n## Actual Commit Changes\n\n**Commit Diff:**\n```diff\ndiff --git a/.changeset/embed-password-policy-in-component.md b/.changeset/embed-password-policy-in-component.md\nnew file mode 100644\nindex 0000000000..72a4428d64\n--- /dev/null\n+++ b/.changeset/embed-password-policy-in-component.md\n@@ -0,0 +1,9 @@\n+---\n+'@forgerock/davinci-client': minor\n+---\n+\n+Add `ValidatedPasswordCollector` alongside `PasswordCollector`. The reducer routes by `field.type`: `PASSWORD` always produces a `PasswordCollector`, `PASSWORD_VERIFY` always produces a `ValidatedPasswordCollector`. `ValidatedPasswordCollector.output.passwordPolicy` carries the embedded policy from the field; when the field has no policy, an empty policy object is emitted and the validator treats it as no rules. Consumers can render password requirements directly from the collector.\n+\n+Both collectors now expose a `verify: boolean` on `output` (defaults to `false`), propagated from the field when the server sends `verify: true`.\n+\n+`store.validate(collector)` accepts a `ValidatedPasswordCollector` and returns a validator that enforces the policy's length, unique-character, repeated-character, and per-charset minimum rules. Passing a `PasswordCollector` returns the standard \"cannot be validated\" error.\ndiff --git a/e2e/davinci-app/components/password.ts b/e2e/davinci-app/components/password.ts\nindex 5b835478f8..1f9ec63405 100644\n--- a/e2e/davinci-app/components/password.ts\n+++ b/e2e/davinci-app/components/password.ts\n@@ -4,32 +4,109 @@\n * This software may be modified and distributed under the terms\n * of the MIT license. See the LICENSE file for details.\n */\n-import type { PasswordCollector, Updater } from '@forgerock/davinci-client/types';\n+import type {\n+ PasswordCollector,\n+ ValidatedPasswordCollector,\n+ Updater,\n+ Validator,\n+} from '@forgerock/davinci-client/types';\n import { dotToCamelCase } from '../helper.js';\n \n+const UPPERCASE_RE = /^[A-Z]+$/;\n+const LOWERCASE_RE = /^[a-z]+$/;\n+const DIGIT_RE = /^[0-9]+$/;\n+\n export default function passwordComponent(\n formEl: HTMLFormElement,\n- collector: PasswordCollector,\n- updater: Updater,\n+ collector: PasswordCollector | ValidatedPasswordCollector,\n+ updater: Updater,\n+ validator?: Validator,\n ) {\n+ const collectorKey = dotToCamelCase(collector.output.key);\n const label = document.createElement('label');\n const input = document.createElement('input');\n \n- label.htmlFor = dotToCamelCase(collector.output.key);\n+ label.htmlFor = collectorKey;\n label.innerText = collector.output.label;\n input.type = 'password';\n- input.id = dotToCamelCase(collector.output.key);\n- input.name = dotToCamelCase(collector.output.key);\n+ input.id = collectorKey;\n+ input.name = collectorKey;\n \n formEl?.appendChild(label);\n formEl?.appendChild(input);\n \n- formEl\n- ?.querySelector(`#${dotToCamelCase(collector.output.key)}`)\n- ?.addEventListener('blur', (event: Event) => {\n- const error = updater((event.target as HTMLInputElement).value);\n- if (error && 'error' in error) {\n- console.error(error.error.message);\n+ if (collector.type === 'ValidatedPasswordCollector') {\n+ const passwordPolicy = collector.output.passwordPolicy;\n+ const requirementsList = document.createElement('ul');\n+ requirementsList.className = 'password-requirements';\n+\n+ if (passwordPolicy.length) {\n+ const { min, max } = passwordPolicy.length;\n+ let lengthMessage: string | null = null;\n+ if (min != null && max != null) {\n+ lengthMessage = `${min}–${max} characters`;\n+ } else if (min != null) {\n+ lengthMessage = `At least ${min} characters`;\n+ } else if (max != null) {\n+ lengthMessage = `At most ${max} characters`;\n+ }\n+ if (lengthMessage) {\n+ const li = document.createElement('li');\n+ li.textContent = lengthMessage;\n+ requirementsList.appendChild(li);\n+ }\n+ }\n+\n+ if (passwordPolicy.minCharacters) {\n+ for (const [charset, count] of Object.entries(passwordPolicy.minCharacters)) {\n+ const li = document.createElement('li');\n+ if (UPPERCASE_RE.test(charset)) {\n+ li.textContent = `At least ${count} uppercase letter(s)`;\n+ } else if (LOWERCASE_RE.test(charset)) {\n+ li.textContent = `At least ${count} lowercase letter(s)`;\n+ } else if (DIGIT_RE.test(charset)) {\n+ li.textContent = `At least ${count} number(s)`;\n+ } else {\n+ li.textContent = `At least ${count} special character(s)`;\n+ }\n+ requirementsList.appendChild(li);\n }\n- });\n+ }\n+\n+ if (requirementsList.children.length > 0) {\n+ formEl?.appendChild(requirementsList);\n+ }\n+ }\n+\n+ const inputEl = formEl?.querySelector(`#${collectorKey}`);\n+ const shouldValidate = collector.type === 'ValidatedPasswordCollector' && !!validator;\n+\n+ inputEl?.addEventListener('input', (event: Event) => {\n+ const value = (event.target as HTMLInputElement).value;\n+\n+ if (shouldValidate) {\n+ const result = validator(value);\n+ if (Array.isArray(result) && result.length) {\n+ let errorEl = formEl?.querySelector(`.${collectorKey}-error`);\n+ if (!errorEl) {\n+ errorEl = document.createElement('ul');\n+ errorEl.className = `${collectorKey}-error`;\n+ inputEl.after(errorEl);\n+ }\n+ const items = result.map((msg) => {\n+ const li = document.createElement('li');\n+ li.textContent = msg;\n+ return li;\n+ });\n+ errorEl.replaceChildren(...items);\n+ return;\n+ }\n+ formEl?.querySelector(`.${collectorKey}-error`)?.remove();\n+ }\n+\n+ const error = updater(value);\n+ if (error && 'error' in error) {\n+ console.error(error.error.message);\n+ }\n+ });\n }\ndiff --git a/e2e/davinci-app/main.ts b/e2e/davinci-app/main.ts\nindex 119a4dec6e..724a3150b6 100644\n--- a/e2e/davinci-app/main.ts\n+++ b/e2e/davinci-app/main.ts\n@@ -237,13 +237,17 @@ const urlParams = new URLSearchParams(window.location.search);\n davinciClient.update(collector), // Returns an update function for this collector\n davinciClient.validate(collector), // Returns a validate function for this collector\n );\n- } else if (collector.type === 'PasswordCollector') {\n- // eslint-disable-next-line @typescript-eslint/no-unused-expressions\n- collector;\n+ } else if (\n+ collector.type === 'PasswordCollector' ||\n+ collector.type === 'ValidatedPasswordCollector'\n+ ) {\n passwordComponent(\n formEl, // You can ignore this; it's just for rendering\n collector, // This is the plain object of the collector\n davinciClient.update(collector), // Returns an update function for this collector\n+ collector.type === 'ValidatedPasswordCollector'\n+ ? davinciClient.validate(collector)\n+ : undefined,\n );\n } else if (collector.type === 'SubmitCollector') {\n submitButtonComponent(\ndiff --git a/packages/davinci-client/api-report/davinci-client.api.md b/packages/davinci-client/api-report/davinci-client.api.md\nindex b2528bf664..2bc6119537 100644\n--- a/packages/davinci-client/api-report/davinci-client.api.md\n+++ b/packages/davinci-client/api-report/davinci-client.api.md\n@@ -178,11 +178,13 @@ export interface CollectorErrors {\n }\n \n // @public (undocumented)\n-export type Collectors = FlowCollector | PasswordCollector | TextCollector | SingleSelectCollector | IdpCollector | SubmitCollector | ActionCollector<'ActionCollector'> | SingleValueCollector<'SingleValueCollector'> | MultiSelectCollector | DeviceAuthenticationCollector | DeviceRegistrationCollector | PhoneNumberCollector | ReadOnlyCollector | ValidatedTextCollector | ProtectCollector | PollingCollector | FidoRegistrationCollector | FidoAuthenticationCollector | QrCodeCollector | AgreementCollector | UnknownCollector;\n+export type Collectors = FlowCollector | PasswordCollector | ValidatedPasswordCollector | TextCollector | SingleSelectCollector | IdpCollector | SubmitCollector | ActionCollector<'ActionCollector'> | SingleValueCollector<'SingleValueCollector'> | MultiSelectCollector | DeviceAuthenticationCollector | DeviceRegistrationCollector | PhoneNumberCollector | ReadOnlyCollector | ValidatedTextCollector | ProtectCollector | PollingCollector | FidoRegistrationCollector | FidoAuthenticationCollector | QrCodeCollector | AgreementCollector | UnknownCollector;\n \n // @public\n export type CollectorValueType = T extends {\n type: 'PasswordCollector';\n+} ? string : T extends {\n+ type: 'ValidatedPasswordCollector';\n } ? string : T extends {\n type: 'TextCollector';\n category: 'SingleValueCollector';\n@@ -267,13 +269,11 @@ export function davinci(input: {\n resume: (input: {\n continueToken: string;\n }) => Promise;\n- start: (options?: StartOptions | undefined) => Promise;\n+ start: (options?: StartOptions | undefined) => Promise;\n update: (collector: T) => Updater;\n validate: (collector: SingleValueCollectors | ObjectValueCollectors | MultiValueCollectors | AutoCollectors) => Validator;\n poll: (collector: PollingCollector) => Poller;\n getClient: () => {\n- status: \"start\";\n- } | {\n action: string;\n collectors: Collectors[];\n description?: string;\n@@ -287,6 +287,8 @@ export function davinci(input: {\n status: \"error\";\n } | {\n status: \"failure\";\n+ } | {\n+ status: \"start\";\n } | {\n authorization?: {\n code?: string;\n@@ -297,7 +299,7 @@ export function davinci(input: {\n getCollectors: () => Collectors[];\n getError: () => DaVinciError | null;\n getErrorCollectors: () => CollectorErrors[];\n- getNode: () => ContinueNode | StartNode | ErrorNode | FailureNode | SuccessNode;\n+ getNode: () => ContinueNode | ErrorNode | FailureNode | StartNode | SuccessNode;\n getServer: () => {\n _links?: Links;\n id?: string;\n@@ -306,8 +308,6 @@ export function davinci(input: {\n href?: string;\n eventName?: string;\n status: \"continue\";\n- } | {\n- status: \"start\";\n } | {\n _links?: Links;\n eventName?: string;\n@@ -323,6 +323,8 @@ export function davinci(input: {\n interactionId?: string;\n interactionToken?: string;\n status: \"failure\";\n+ } | {\n+ status: \"start\";\n } | {\n _links?: Links;\n eventName?: string;\n@@ -1032,7 +1034,7 @@ export type InferMultiValueCollectorType = T\n export type InferNoValueCollectorType = T extends 'ReadOnlyCollector' ? NoValueCollectorBase<'ReadOnlyCollector'> : T extends 'QrCodeCollector' ? QrCodeCollectorBase : T extends 'AgreementCollector' ? AgreementCollector : NoValueCollectorBase<'NoValueCollector'>;\n \n // @public\n-export type InferSingleValueCollectorType = T extends 'TextCollector' ? TextCollector : T extends 'SingleSelectCollector' ? SingleSelectCollector : T extends 'ValidatedTextCollector' ? ValidatedTextCollector : T extends 'PasswordCollector' ? PasswordCollector : SingleValueCollectorWithValue<'SingleValueCollector'> | SingleValueCollectorNoValue<'SingleValueCollector'>;\n+export type InferSingleValueCollectorType = T extends 'TextCollector' ? TextCollector : T extends 'SingleSelectCollector' ? SingleSelectCollector : T extends 'ValidatedTextCollector' ? ValidatedTextCollector : T extends 'PasswordCollector' ? PasswordCollector : T extends 'ValidatedPasswordCollector' ? ValidatedPasswordCollector : SingleValueCollectorWithValue<'SingleValueCollector'> | SingleValueCollectorNoValue<'SingleValueCollector'>;\n \n // @public (undocumented)\n export type InferValueObjectCollectorType = T extends 'DeviceAuthenticationCollector' ? DeviceAuthenticationCollector : T extends 'DeviceRegistrationCollector' ? DeviceRegistrationCollector : T extends 'PhoneNumberCollector' ? PhoneNumberCollector : ObjectOptionsCollectorWithObjectValue<'ObjectValueCollector'> | ObjectOptionsCollectorWithStringValue<'ObjectValueCollector'>;\n@@ -1170,8 +1172,8 @@ value: Record;\n }, string>;\n \n // @public\n-export const nodeCollectorReducer: Reducer<(TextCollector | SingleSelectCollector | ValidatedTextCollector | PasswordCollector | MultiSelectCollector | DeviceAuthenticationCollector | DeviceRegistrationCollector | PhoneNumberCollector | IdpCollector | SubmitCollector | FlowCollector | QrCodeCollectorBase | AgreementCollector | ReadOnlyCollector | UnknownCollector | ProtectCollector | FidoRegistrationCollector | FidoAuthenticationCollector | PollingCollector | ActionCollector<\"ActionCollector\"> | SingleValueCollector<\"SingleValueCollector\">)[]> & {\n- getInitialState: () => (TextCollector | SingleSelectCollector | ValidatedTextCollector | PasswordCollector | MultiSelectCollector | DeviceAuthenticationCollector | DeviceRegistrationCollector | PhoneNumberCollector | IdpCollector | SubmitCollector | FlowCollector | QrCodeCollectorBase | AgreementCollector | ReadOnlyCollector | UnknownCollector | ProtectCollector | FidoRegistrationCollector | FidoAuthenticationCollector | PollingCollector | ActionCollector<\"ActionCollector\"> | SingleValueCollector<\"SingleValueCollector\">)[];\n+export const nodeCollectorReducer: Reducer<(TextCollector | SingleSelectCollector | ValidatedTextCollector | PasswordCollector | ValidatedPasswordCollector | MultiSelectCollector | DeviceAuthenticationCollector | DeviceRegistrationCollector | PhoneNumberCollector | IdpCollector | SubmitCollector | FlowCollector | QrCodeCollectorBase | AgreementCollector | ReadOnlyCollector | UnknownCollector | ProtectCollector | FidoRegistrationCollector | FidoAuthenticationCollector | PollingCollector | ActionCollector<\"ActionCollector\"> | SingleValueCollector<\"SingleValueCollector\">)[]> & {\n+ getInitialState: () => (TextCollector | SingleSelectCollector | ValidatedTextCollector | PasswordCollector | ValidatedPasswordCollector | MultiSelectCollector | DeviceAuthenticationCollector | DeviceRegistrationCollector | PhoneNumberCollector | IdpCollector | SubmitCollector | FlowCollector | QrCodeCollectorBase | AgreementCollector | ReadOnlyCollector | UnknownCollector | ProtectCollector | FidoRegistrationCollector | FidoAuthenticationCollector | PollingCollector | ActionCollector<\"ActionCollector\"> | SingleValueCollector<\"SingleValueCollector\">)[];\n };\n \n // @public (undocumented)\n@@ -1323,7 +1325,90 @@ export interface OutgoingQueryParams {\n }\n \n // @public (undocumented)\n-export type PasswordCollector = SingleValueCollectorNoValue<'PasswordCollector'>;\n+export interface PasswordCollector {\n+ // (undocumented)\n+ category: 'SingleValueCollector';\n+ // (undocumented)\n+ error: string | null;\n+ // (undocumented)\n+ id: string;\n+ // (undocumented)\n+ input: {\n+ key: string;\n+ value: string | number | boolean;\n+ type: string;\n+ };\n+ // (undocumented)\n+ name: string;\n+ // (undocumented)\n+ output: {\n+ key: string;\n+ label: string;\n+ type: string;\n+ verify: boolean;\n+ };\n+ // (undocumented)\n+ type: 'PasswordCollector';\n+}\n+\n+// @public\n+export type PasswordField = {\n+ type: 'PASSWORD' | 'PASSWORD_VERIFY';\n+ key: string;\n+ label: string;\n+ required?: boolean;\n+ verify?: boolean;\n+ passwordPolicy?: PasswordPolicy;\n+};\n+\n+// @public (undocumented)\n+export interface PasswordPolicy {\n+ // (undocumented)\n+ createdAt?: string;\n+ // (undocumented)\n+ default?: boolean;\n+ // (undocumented)\n+ description?: string;\n+ // (undocumented)\n+ excludesCommonlyUsed?: boolean;\n+ // (undocumented)\n+ excludesProfileData?: boolean;\n+ // (undocumented)\n+ history?: {\n+ count?: number;\n+ retentionDays?: number;\n+ };\n+ // (undocumented)\n+ id?: string;\n+ // (undocumented)\n+ length?: {\n+ min?: number;\n+ max?: number;\n+ };\n+ // (undocumented)\n+ lockout?: {\n+ failureCount?: number;\n+ durationSeconds?: number;\n+ };\n+ // (undocumented)\n+ maxAgeDays?: number;\n+ // (undocumented)\n+ maxRepeatedCharacters?: number;\n+ // (undocumented)\n+ minAgeDays?: number;\n+ // (undocumented)\n+ minCharacters?: Record;\n+ // (undocumented)\n+ minUniqueCharacters?: number;\n+ // (undocumented)\n+ name?: string;\n+ // (undocumented)\n+ notSimilarToCurrent?: boolean;\n+ // (undocumented)\n+ populationCount?: number;\n+ // (undocumented)\n+ updatedAt?: string;\n+}\n \n // @public (undocumented)\n export type PhoneNumberCollector = ObjectValueCollectorWithObjectValue<'PhoneNumberCollector', PhoneNumberInputValue, PhoneNumberOutputValue>;\n@@ -1588,10 +1673,10 @@ export interface SingleValueCollectorNoValue | SingleSelectCollectorWithValue<'SingleSelectCollector'> | SingleValueCollectorWithValue<'SingleValueCollector'> | SingleValueCollectorWithValue<'TextCollector'> | ValidatedSingleValueCollectorWithValue<'TextCollector'>;\n+export type SingleValueCollectors = PasswordCollector | ValidatedPasswordCollector | SingleSelectCollectorWithValue<'SingleSelectCollector'> | SingleValueCollectorWithValue<'SingleValueCollector'> | SingleValueCollectorWithValue<'TextCollector'> | ValidatedSingleValueCollectorWithValue<'TextCollector'>;\n \n // @public\n-export type SingleValueCollectorTypes = 'PasswordCollector' | 'SingleValueCollector' | 'SingleSelectCollector' | 'SingleSelectObjectCollector' | 'TextCollector' | 'ValidatedTextCollector';\n+export type SingleValueCollectorTypes = 'PasswordCollector' | 'ValidatedPasswordCollector' | 'SingleValueCollector' | 'SingleSelectCollector' | 'SingleSelectObjectCollector' | 'TextCollector' | 'ValidatedTextCollector';\n \n // @public (undocumented)\n export interface SingleValueCollectorWithValue {\n@@ -1621,11 +1706,11 @@ export interface SingleValueCollectorWithValue {\n // (undocumented)\ndiff --git a/packages/davinci-client/api-report/davinci-client.types.api.md b/packages/davinci-client/api-report/davinci-client.types.api.md\nindex 2321431a0a..2892fa20c0 100644\n--- a/packages/davinci-client/api-report/davinci-client.types.api.md\n+++ b/packages/davinci-client/api-report/davinci-client.types.api.md\n@@ -178,11 +178,13 @@ export interface CollectorErrors {\n }\n \n // @public (undocumented)\n-export type Collectors = FlowCollector | PasswordCollector | TextCollector | SingleSelectCollector | IdpCollector | SubmitCollector | ActionCollector<'ActionCollector'> | SingleValueCollector<'SingleValueCollector'> | MultiSelectCollector | DeviceAuthenticationCollector | DeviceRegistrationCollector | PhoneNumberCollector | ReadOnlyCollector | ValidatedTextCollector | ProtectCollector | PollingCollector | FidoRegistrationCollector | FidoAuthenticationCollector | QrCodeCollector | AgreementCollector | UnknownCollector;\n+export type Collectors = FlowCollector | PasswordCollector | ValidatedPasswordCollector | TextCollector | SingleSelectCollector | IdpCollector | SubmitCollector | ActionCollector<'ActionCollector'> | SingleValueCollector<'SingleValueCollector'> | MultiSelectCollector | DeviceAuthenticationCollector | DeviceRegistrationCollector | PhoneNumberCollector | ReadOnlyCollector | ValidatedTextCollector | ProtectCollector | PollingCollector | FidoRegistrationCollector | FidoAuthenticationCollector | QrCodeCollector | AgreementCollector | UnknownCollector;\n \n // @public\n export type CollectorValueType = T extends {\n type: 'PasswordCollector';\n+} ? string : T extends {\n+ type: 'ValidatedPasswordCollector';\n } ? string : T extends {\n type: 'TextCollector';\n category: 'SingleValueCollector';\n@@ -267,13 +269,11 @@ export function davinci(input: {\n resume: (input: {\n continueToken: string;\n }) => Promise;\n- start: (options?: StartOptions | undefined) => Promise;\n+ start: (options?: StartOptions | undefined) => Promise;\n update: (collector: T) => Updater;\n validate: (collector: SingleValueCollectors | ObjectValueCollectors | MultiValueCollectors | AutoCollectors) => Validator;\n poll: (collector: PollingCollector) => Poller;\n getClient: () => {\n- status: \"start\";\n- } | {\n action: string;\n collectors: Collectors[];\n description?: string;\n@@ -287,6 +287,8 @@ export function davinci(input: {\n status: \"error\";\n } | {\n status: \"failure\";\n+ } | {\n+ status: \"start\";\n } | {\n authorization?: {\n code?: string;\n@@ -297,7 +299,7 @@ export function davinci(input: {\n getCollectors: () => Collectors[];\n getError: () => DaVinciError | null;\n getErrorCollectors: () => CollectorErrors[];\n- getNode: () => ContinueNode | StartNode | ErrorNode | FailureNode | SuccessNode;\n+ getNode: () => ContinueNode | ErrorNode | FailureNode | StartNode | SuccessNode;\n getServer: () => {\n _links?: Links;\n id?: string;\n@@ -306,8 +308,6 @@ export function davinci(input: {\n href?: string;\n eventName?: string;\n status: \"continue\";\n- } | {\n- status: \"start\";\n } | {\n _links?: Links;\n eventName?: string;\n@@ -323,6 +323,8 @@ export function davinci(input: {\n interactionId?: string;\n interactionToken?: string;\n status: \"failure\";\n+ } | {\n+ status: \"start\";\n } | {\n _links?: Links;\n eventName?: string;\n@@ -1029,7 +1031,7 @@ export type InferMultiValueCollectorType = T\n export type InferNoValueCollectorType = T extends 'ReadOnlyCollector' ? NoValueCollectorBase<'ReadOnlyCollector'> : T extends 'QrCodeCollector' ? QrCodeCollectorBase : T extends 'AgreementCollector' ? AgreementCollector : NoValueCollectorBase<'NoValueCollector'>;\n \n // @public\n-export type InferSingleValueCollectorType = T extends 'TextCollector' ? TextCollector : T extends 'SingleSelectCollector' ? SingleSelectCollector : T extends 'ValidatedTextCollector' ? ValidatedTextCollector : T extends 'PasswordCollector' ? PasswordCollector : SingleValueCollectorWithValue<'SingleValueCollector'> | SingleValueCollectorNoValue<'SingleValueCollector'>;\n+export type InferSingleValueCollectorType = T extends 'TextCollector' ? TextCollector : T extends 'SingleSelectCollector' ? SingleSelectCollector : T extends 'ValidatedTextCollector' ? ValidatedTextCollector : T extends 'PasswordCollector' ? PasswordCollector : T extends 'ValidatedPasswordCollector' ? ValidatedPasswordCollector : SingleValueCollectorWithValue<'SingleValueCollector'> | SingleValueCollectorNoValue<'SingleValueCollector'>;\n \n // @public (undocumented)\n export type InferValueObjectCollectorType = T extends 'DeviceAuthenticationCollector' ? DeviceAuthenticationCollector : T extends 'DeviceRegistrationCollector' ? DeviceRegistrationCollector : T extends 'PhoneNumberCollector' ? PhoneNumberCollector : ObjectOptionsCollectorWithObjectValue<'ObjectValueCollector'> | ObjectOptionsCollectorWithStringValue<'ObjectValueCollector'>;\n@@ -1167,8 +1169,8 @@ value: Record;\n }, string>;\n \n // @public\n-export const nodeCollectorReducer: Reducer<(TextCollector | SingleSelectCollector | ValidatedTextCollector | PasswordCollector | MultiSelectCollector | DeviceAuthenticationCollector | DeviceRegistrationCollector | PhoneNumberCollector | IdpCollector | SubmitCollector | FlowCollector | QrCodeCollectorBase | AgreementCollector | ReadOnlyCollector | UnknownCollector | ProtectCollector | FidoRegistrationCollector | FidoAuthenticationCollector | PollingCollector | ActionCollector<\"ActionCollector\"> | SingleValueCollector<\"SingleValueCollector\">)[]> & {\n- getInitialState: () => (TextCollector | SingleSelectCollector | ValidatedTextCollector | PasswordCollector | MultiSelectCollector | DeviceAuthenticationCollector | DeviceRegistrationCollector | PhoneNumberCollector | IdpCollector | SubmitCollector | FlowCollector | QrCodeCollectorBase | AgreementCollector | ReadOnlyCollector | UnknownCollector | ProtectCollector | FidoRegistrationCollector | FidoAuthenticationCollector | PollingCollector | ActionCollector<\"ActionCollector\"> | SingleValueCollector<\"SingleValueCollector\">)[];\n+export const nodeCollectorReducer: Reducer<(TextCollector | SingleSelectCollector | ValidatedTextCollector | PasswordCollector | ValidatedPasswordCollector | MultiSelectCollector | DeviceAuthenticationCollector | DeviceRegistrationCollector | PhoneNumberCollector | IdpCollector | SubmitCollector | FlowCollector | QrCodeCollectorBase | AgreementCollector | ReadOnlyCollector | UnknownCollector | ProtectCollector | FidoRegistrationCollector | FidoAuthenticationCollector | PollingCollector | ActionCollector<\"ActionCollector\"> | SingleValueCollector<\"SingleValueCollector\">)[]> & {\n+ getInitialState: () => (TextCollector | SingleSelectCollector | ValidatedTextCollector | PasswordCollector | ValidatedPasswordCollector | MultiSelectCollector | DeviceAuthenticationCollector | DeviceRegistrationCollector | PhoneNumberCollector | IdpCollector | SubmitCollector | FlowCollector | QrCodeCollectorBase | AgreementCollector | ReadOnlyCollector | UnknownCollector | ProtectCollector | FidoRegistrationCollector | FidoAuthenticationCollector | PollingCollector | ActionCollector<\"ActionCollector\"> | SingleValueCollector<\"SingleValueCollector\">)[];\n };\n \n // @public (undocumented)\n@@ -1320,7 +1322,90 @@ export interface OutgoingQueryParams {\n }\n \n // @public (undocumented)\n-export type PasswordCollector = SingleValueCollectorNoValue<'PasswordCollector'>;\n+export interface PasswordCollector {\n+ // (undocumented)\n+ category: 'SingleValueCollector';\n+ // (undocumented)\n+ error: string | null;\n+ // (undocumented)\n+ id: string;\n+ // (undocumented)\n+ input: {\n+ key: string;\n+ value: string | number | boolean;\n+ type: string;\n+ };\n+ // (undocumented)\n+ name: string;\n+ // (undocumented)\n+ output: {\n+ key: string;\n+ label: string;\n+ type: string;\n+ verify: boolean;\n+ };\n+ // (undocumented)\n+ type: 'PasswordCollector';\n+}\n+\n+// @public\n+export type PasswordField = {\n+ type: 'PASSWORD' | 'PASSWORD_VERIFY';\n+ key: string;\n+ label: string;\n+ required?: boolean;\n+ verify?: boolean;\n+ passwordPolicy?: PasswordPolicy;\n+};\n+\n+// @public (undocumented)\n+export interface PasswordPolicy {\n+ // (undocumented)\n+ createdAt?: string;\n+ // (undocumented)\n+ default?: boolean;\n+ // (undocumented)\n+ description?: string;\n+ // (undocumented)\n+ excludesCommonlyUsed?: boolean;\n+ // (undocumented)\n+ excludesProfileData?: boolean;\n+ // (undocumented)\n+ history?: {\n+ count?: number;\n+ retentionDays?: number;\n+ };\n+ // (undocumented)\n+ id?: string;\n+ // (undocumented)\n+ length?: {\n+ min?: number;\n+ max?: number;\n+ };\n+ // (undocumented)\n+ lockout?: {\n+ failureCount?: number;\n+ durationSeconds?: number;\n+ };\n+ // (undocumented)\n+ maxAgeDays?: number;\n+ // (undocumented)\n+ maxRepeatedCharacters?: number;\n+ // (undocumented)\n+ minAgeDays?: number;\n+ // (undocumented)\n+ minCharacters?: Record;\n+ // (undocumented)\n+ minUniqueCharacters?: number;\n+ // (undocumented)\n+ name?: string;\n+ // (undocumented)\n+ notSimilarToCurrent?: boolean;\n+ // (undocumented)\n+ populationCount?: number;\n+ // (undocumented)\n+ updatedAt?: string;\n+}\n \n // @public (undocumented)\n export type PhoneNumberCollector = ObjectValueCollectorWithObjectValue<'PhoneNumberCollector', PhoneNumberInputValue, PhoneNumberOutputValue>;\n@@ -1585,10 +1670,10 @@ export interface SingleValueCollectorNoValue | SingleSelectCollectorWithValue<'SingleSelectCollector'> | SingleValueCollectorWithValue<'SingleValueCollector'> | SingleValueCollectorWithValue<'TextCollector'> | ValidatedSingleValueCollectorWithValue<'TextCollector'>;\n+export type SingleValueCollectors = PasswordCollector | ValidatedPasswordCollector | SingleSelectCollectorWithValue<'SingleSelectCollector'> | SingleValueCollectorWithValue<'SingleValueCollector'> | SingleValueCollectorWithValue<'TextCollector'> | ValidatedSingleValueCollectorWithValue<'TextCollector'>;\n \n // @public\n-export type SingleValueCollectorTypes = 'PasswordCollector' | 'SingleValueCollector' | 'SingleSelectCollector' | 'SingleSelectObjectCollector' | 'TextCollector' | 'ValidatedTextCollector';\n+export type SingleValueCollectorTypes = 'PasswordCollector' | 'ValidatedPasswordCollector' | 'SingleValueCollector' | 'SingleSelectCollector' | 'SingleSelectObjectCollector' | 'TextCollector' | 'ValidatedTextCollector';\n \n // @public (undocumented)\n export interface SingleValueCollectorWithValue {\n@@ -1618,11 +1703,11 @@ export interface SingleValueCollectorWithValue {\n // (undocumented)\ndiff --git a/packages/davinci-client/src/lib/client.store.ts b/packages/davinci-client/src/lib/client.store.ts\nindex e99dc64018..a0113a87fd 100644\n--- a/packages/davinci-client/src/lib/client.store.ts\n+++ b/packages/davinci-client/src/lib/client.store.ts\n@@ -57,6 +57,7 @@ import type {\n Poller,\n } from './client.types.js';\n import { returnValidator } from './collector.utils.js';\n+import { returnPasswordPolicyValidator } from './password-policy.rules.js';\n import type { ContinueNode, StartNode } from './node.types.js';\n \n /**\n@@ -392,7 +393,16 @@ export async function davinci({\n return handleUpdateValidateError('Collector not found', 'state_error', log.error);\n }\n \n+ if (collectorToUpdate.type === 'PasswordCollector') {\n+ return handleUpdateValidateError(\n+ 'PasswordCollector cannot be validated; pass a ValidatedPasswordCollector',\n+ 'state_error',\n+ log.error,\n+ );\n+ }\n+\n if (\n+ collectorToUpdate.type !== 'ValidatedPasswordCollector' &&\n collectorToUpdate.category !== 'ValidatedSingleValueCollector' &&\n collectorToUpdate.category !== 'ObjectValueCollector' &&\n collectorToUpdate.category !== 'MultiValueCollector' &&\n@@ -405,7 +415,10 @@ export async function davinci({\n );\n }\n \n- if (!('validation' in collectorToUpdate.input)) {\n+ if (\n+ collectorToUpdate.type !== 'ValidatedPasswordCollector' &&\n+ !('validation' in collectorToUpdate.input)\n+ ) {\n return handleUpdateValidateError(\n 'Collector has no validation rules',\n 'state_error',\n@@ -413,6 +426,10 @@ export async function davinci({\n );\n }\n \n+ if (collectorToUpdate.type === 'ValidatedPasswordCollector') {\n+ return returnPasswordPolicyValidator(collectorToUpdate);\n+ }\n+\n return returnValidator(collectorToUpdate);\n },\n \ndiff --git a/packages/davinci-client/src/lib/client.types.ts b/packages/davinci-client/src/lib/client.types.ts\nindex 1830f6fd5c..c23cf6709f 100644\n--- a/packages/davinci-client/src/lib/client.types.ts\n+++ b/packages/davinci-client/src/lib/client.types.ts\n@@ -36,36 +36,38 @@ export type InitFlow = () => Promise;\n */\n export type CollectorValueType = T extends { type: 'PasswordCollector' }\n ? string\n- : T extends { type: 'TextCollector'; category: 'SingleValueCollector' }\n+ : T extends { type: 'ValidatedPasswordCollector' }\n ? string\n- : T extends { type: 'TextCollector'; category: 'ValidatedSingleValueCollector' }\n+ : T extends { type: 'TextCollector'; category: 'SingleValueCollector' }\n ? string\n- : T extends { type: 'SingleSelectCollector' }\n+ : T extends { type: 'TextCollector'; category: 'ValidatedSingleValueCollector' }\n ? string\n- : T extends { type: 'MultiSelectCollector' }\n- ? string[]\n- : T extends { type: 'DeviceRegistrationCollector' }\n- ? string\n- : T extends { type: 'DeviceAuthenticationCollector' }\n+ : T extends { type: 'SingleSelectCollector' }\n+ ? string\n+ : T extends { type: 'MultiSelectCollector' }\n+ ? string[]\n+ : T extends { type: 'DeviceRegistrationCollector' }\n ? string\n- : T extends { type: 'PhoneNumberCollector' }\n- ? PhoneNumberInputValue\n- : T extends { type: 'FidoRegistrationCollector' }\n- ? FidoRegistrationInputValue\n- : T extends { type: 'FidoAuthenticationCollector' }\n- ? FidoAuthenticationInputValue\n- : T extends { category: 'SingleValueCollector' }\n- ? string\n- : T extends { category: 'ValidatedSingleValueCollector' }\n+ : T extends { type: 'DeviceAuthenticationCollector' }\n+ ? string\n+ : T extends { type: 'PhoneNumberCollector' }\n+ ? PhoneNumberInputValue\n+ : T extends { type: 'FidoRegistrationCollector' }\n+ ? FidoRegistrationInputValue\n+ : T extends { type: 'FidoAuthenticationCollector' }\n+ ? FidoAuthenticationInputValue\n+ : T extends { category: 'SingleValueCollector' }\n ? string\n- : T extends { category: 'MultiValueCollector' }\n- ? string[]\n- :\n- | string\n- | string[]\n- | PhoneNumberInputValue\n- | FidoRegistrationInputValue\n- | FidoAuthenticationInputValue;\n+ : T extends { category: 'ValidatedSingleValueCollector' }\n+ ? string\n+ : T extends { category: 'MultiValueCollector' }\n+ ? string[]\n+ :\n+ | string\n+ | string[]\n+ | PhoneNumberInputValue\n+ | FidoRegistrationInputValue\n+ | FidoAuthenticationInputValue;\n \n /**\n * Generic updater function that accepts values appropriate for the collector type.\ndiff --git a/packages/davinci-client/src/lib/collector.types.test-d.ts b/packages/davinci-client/src/lib/collector.types.test-d.ts\nindex ecaabcbc33..6bd907ba94 100644\n--- a/packages/davinci-client/src/lib/collector.types.test-d.ts\n+++ b/packages/davinci-client/src/lib/collector.types.test-d.ts\n@@ -14,6 +14,7 @@ import type {\n ActionCollectorNoUrl,\n TextCollector,\n PasswordCollector,\n+ ValidatedPasswordCollector,\n FlowCollector,\n IdpCollector,\n SubmitCollector,\n@@ -36,6 +37,7 @@ import type {\n PhoneNumberExtensionInputValue,\n PhoneNumberExtensionOutputValue,\n } from './collector.types.js';\n+import type { PasswordPolicy } from './davinci.types.js';\n \n describe('Collector Types', () => {\n describe('SingleValueCollector Types', () => {\n@@ -50,20 +52,37 @@ describe('Collector Types', () => {\n });\n \n it('should validate PasswordCollector structure', () => {\n- expectTypeOf().toMatchTypeOf<\n- SingleValueCollectorNoValue<'PasswordCollector'>\n- >();\n expectTypeOf()\n .toHaveProperty('category')\n .toEqualTypeOf<'SingleValueCollector'>();\n- expectTypeOf().toHaveProperty('type');\n+ expectTypeOf().toHaveProperty('type').toEqualTypeOf<'PasswordCollector'>();\n expectTypeOf().toEqualTypeOf<{\n key: string;\n label: string;\n type: string;\n+ verify: boolean;\n }>();\n });\n \n+ it('should validate ValidatedPasswordCollector structure', () => {\n+ expectTypeOf()\n+ .toHaveProperty('category')\n+ .toEqualTypeOf<'SingleValueCollector'>();\n+ expectTypeOf()\n+ .toHaveProperty('type')\n+ .toEqualTypeOf<'ValidatedPasswordCollector'>();\n+ expectTypeOf()\n+ .toHaveProperty('verify')\n+ .toEqualTypeOf();\n+ expectTypeOf()\n+ .toHaveProperty('passwordPolicy')\n+ .toEqualTypeOf();\n+ });\n+\n+ it('should validate PasswordCollector output does NOT have passwordPolicy', () => {\n+ expectTypeOf().not.toHaveProperty('passwordPolicy');\n+ });\n+\n it('should validate SingleCollector structure', () => {\n expectTypeOf().toMatchTypeOf<\n SingleValueCollectorWithValue<'SingleSelectCollector'>\n@@ -274,11 +293,35 @@ describe('Collector Types', () => {\n key: '',\n label: '',\n type: '',\n+ verify: false,\n },\n };\n \n expectTypeOf(tCollector).toMatchTypeOf();\n });\n+ it('should correctly infer ValidatedPasswordCollector Type', () => {\n+ const tCollector: InferSingleValueCollectorType<'ValidatedPasswordCollector'> = {\n+ category: 'SingleValueCollector',\n+ error: null,\n+ type: 'ValidatedPasswordCollector',\n+ id: '',\n+ name: '',\n+ input: {\n+ key: '',\n+ value: '',\n+ type: '',\n+ },\n+ output: {\n+ key: '',\n+ label: '',\n+ type: '',\n+ verify: false,\n+ passwordPolicy: {},\n+ },\n+ };\n+\n+ expectTypeOf(tCollector).toMatchTypeOf();\n+ });\n it('should correctly infer SingleValueCollector Type', () => {\n const tCollector: InferSingleValueCollectorType<'SingleValueCollector'> = {\n category: 'SingleValueCollector',\ndiff --git a/packages/davinci-client/src/lib/collector.types.ts b/packages/davinci-client/src/lib/collector.types.ts\nindex cb9f8f1787..07aaaf60f5 100644\n--- a/packages/davinci-client/src/lib/collector.types.ts\n+++ b/packages/davinci-client/src/lib/collector.types.ts\n@@ -5,7 +5,11 @@\n * of the MIT license. See the LICENSE file for details.\n */\n \n-import type { FidoAuthenticationOptions, FidoRegistrationOptions } from './davinci.types.js';\n+import type {\n+ FidoAuthenticationOptions,\n+ FidoRegistrationOptions,\n+ PasswordPolicy,\n+} from './davinci.types.js';\n \n /** *********************************************************************\n * SINGLE-VALUE COLLECTORS\n@@ -16,6 +20,7 @@ import type { FidoAuthenticationOptions, FidoRegistrationOptions } from './davin\n */\n export type SingleValueCollectorTypes =\n | 'PasswordCollector'\n+ | 'ValidatedPasswordCollector'\n | 'SingleValueCollector'\n | 'SingleSelectCollector'\n | 'SingleSelectObjectCollector'\n@@ -157,14 +162,16 @@ export type InferSingleValueCollectorType =\n ? ValidatedTextCollector\n : T extends 'PasswordCollector'\n ? PasswordCollector\n- : /**\n- * At this point, we have not passed in a collector type\n- * or we have explicitly passed in 'SingleValueCollector'\n- * So we can return either a SingleValueCollector with value\n- * or without a value.\n- **/\n- | SingleValueCollectorWithValue<'SingleValueCollector'>\n- | SingleValueCollectorNoValue<'SingleValueCollector'>;\n+ : T extends 'ValidatedPasswordCollector'\n+ ? ValidatedPasswordCollector\n+ : /**\n+ * At this point, we have not passed in a collector type\n+ * or we have explicitly passed in 'SingleValueCollector'\n+ * So we can return either a SingleValueCollector with value\n+ * or without a value.\n+ **/\n+ | SingleValueCollectorWithValue<'SingleValueCollector'>\n+ | SingleValueCollectorNoValue<'SingleValueCollector'>;\n \n /**\n * SINGLE-VALUE COLLECTOR TYPES\n@@ -174,13 +181,51 @@ export type SingleValueCollector =\n | SingleValueCollectorNoValue;\n \n export type SingleValueCollectors =\n- | SingleValueCollectorNoValue<'PasswordCollector'>\n+ | PasswordCollector\n+ | ValidatedPasswordCollector\n | SingleSelectCollectorWithValue<'SingleSelectCollector'>\n | SingleValueCollectorWithValue<'SingleValueCollector'>\n | SingleValueCollectorWithValue<'TextCollector'>\n | ValidatedSingleValueCollectorWithValue<'TextCollector'>;\n \n-export type PasswordCollector = SingleValueCollectorNoValue<'PasswordCollector'>;\n+export interface PasswordCollector {\n+ category: 'SingleValueCollector';\n+ error: string | null;\n+ type: 'PasswordCollector';\n+ id: string;\n+ name: string;\n+ input: {\n+ key: string;\n+ value: string | number | boolean;\n+ type: string;\n+ };\n+ output: {\n+ key: string;\n+ label: string;\n+ type: string;\n+ verify: boolean;\n+ };\n+}\n+\n+export interface ValidatedPasswordCollector {\n+ category: 'SingleValueCollector';\n+ error: string | null;\n+ type: 'ValidatedPasswordCollector';\n+ id: string;\n+ name: string;\n+ input: {\n+ key: string;\n+ value: string | number | boolean;\n+ type: string;\n+ };\n+ output: {\n+ key: string;\n+ label: string;\n+ type: string;\n+ verify: boolean;\n+ passwordPolicy: PasswordPolicy;\n+ };\n+}\n export type TextCollector = SingleValueCollectorWithValue<'TextCollector'>;\n export type SingleSelectCollector = SingleSelectCollectorWithValue<'SingleSelectCollector'>;\n export type ValidatedTextCollector = ValidatedSingleValueCollectorWithValue<'TextCollector'>;\ndiff --git a/packages/davinci-client/src/lib/collector.utils.test.ts b/packages/davinci-client/src/lib/collector.utils.test.ts\nindex 7b47a6f22f..688be8d7c5 100644\n--- a/packages/davinci-client/src/lib/collector.utils.test.ts\n+++ b/packages/davinci-client/src/lib/collector.utils.test.ts\n@@ -12,6 +12,7 @@ import {\n returnSubmitCollector,\n returnSingleValueCollector,\n returnPasswordCollector,\n+ returnValidatedPasswordCollector,\n returnTextCollector,\n returnSingleSelectCollector,\n returnMultiSelectCollector,\n@@ -25,10 +26,12 @@ import {\n returnQrCodeCollector,\n returnAgreementCollector,\n } from './collector.utils.js';\n+import { returnPasswordPolicyValidator } from './password-policy.rules.js';\n import type {\n DaVinciField,\n DeviceAuthenticationField,\n DeviceRegistrationField,\n+ PasswordField,\n FidoAuthenticationField,\n FidoRegistrationField,\n PhoneNumberExtensionField,\n@@ -321,6 +324,7 @@ describe('Single Value Collectors', () => {\n key: mockField.key,\n label: mockField.label,\n type: mockField.type,\n+ verify: false,\n },\n });\n expect(result.output).not.toHaveProperty('value');\n@@ -342,9 +346,26 @@ describe('Single Value Collectors', () => {\n \n describe('Specialized Single Value Collectors', () => {\n it('creates a password collector', () => {\n- const result = returnPasswordCollector(mockField, 1);\n+ const passwordField: PasswordField = {\n+ type: 'PASSWORD',\n+ key: 'password',\n+ label: 'Password',\n+ };\n+ const result = returnPasswordCollector(passwordField, 1);\n expect(result.type).toBe('PasswordCollector');\n expect(result.output).not.toHaveProperty('value');\n+ expect(result.output.verify).toBe(false);\n+ });\n+\n+ it('propagates verify: true from a PASSWORD field onto the PasswordCollector', () => {\n+ const passwordField: PasswordField = {\n+ type: 'PASSWORD',\n+ key: 'password',\n+ label: 'Password',\n+ verify: true,\n+ };\n+ const result = returnPasswordCollector(passwordField, 1);\n+ expect(result.output.verify).toBe(true);\n });\n \n it('creates a text collector', () => {\n@@ -1290,3 +1311,223 @@ describe('Return collector validator', () => {\n );\n });\n });\n+\n+describe('returnValidatedPasswordCollector', () => {\n+ const mockPasswordPolicy = {\n+ id: '39cad7af-3c2f-4672-9c3f-c47e5169e582',\n+ name: 'Standard',\n+ length: { min: 8, max: 255 },\n+ minCharacters: {\n+ '~!@#$%^&*()-_=+[]{}|;:,.<>/?': 1,\n+ '0123456789': 1,\n+ ABCDEFGHIJKLMNOPQRSTUVWXYZ: 1,\n+ abcdefghijklmnopqrstuvwxyz: 1,\n+ },\n+ };\n+\n+ it('should create a ValidatedPasswordCollector with embedded passwordPolicy', () => {\n+ const field: PasswordField = {\n+ type: 'PASSWORD_VERIFY',\n+ key: 'user.password',\n+ label: 'Password',\n+ required: true,\n+ passwordPolicy: mockPasswordPolicy,\n+ };\n+\n+ const result = returnValidatedPasswordCollector(field, 0);\n+\n+ expect(result).toEqual({\n+ category: 'SingleValueCollector',\n+ error: null,\n+ type: 'ValidatedPasswordCollector',\n+ id: 'user.password-0',\n+ name: 'user.password',\n+ input: {\n+ key: 'user.password',\n+ value: '',\n+ type: 'PASSWORD_VERIFY',\n+ },\n+ output: {\n+ key: 'user.password',\n+ label: 'Password',\n+ type: 'PASSWORD_VERIFY',\n+ verify: false,\n+ passwordPolicy: mockPasswordPolicy,\n+ },\n+ });\n+ });\n+\n+ it('should propagate verify: true from the field onto the collector', () => {\n+ const field: PasswordField = {\n+ type: 'PASSWORD_VERIFY',\n+ key: 'user.password',\n+ label: 'Password',\n+ verify: true,\n+ passwordPolicy: mockPasswordPolicy,\n+ };\n+\n+ const result = returnValidatedPasswordCollector(field, 0);\n+\n+ expect(result.output.verify).toBe(true);\n+ });\n+\n+ it('should fall back to an empty policy when called directly with a field that has no policy', () => {\n+ // The reducer selects returnPasswordCollector when a field has no passwordPolicy (for both\n+ // PASSWORD and PASSWORD_VERIFY types), so this field would normally never reach\n+ // returnValidatedPasswordCollector. This test exercises the factory's defensive fallback\n+ // directly, covering callers who bypass the reducer and invoke it without a policy attached.\n+ const field: PasswordField = {\n+ type: 'PASSWORD_VERIFY',\n+ key: 'user.password',\n+ label: 'Password',\n+ };\n+\n+ const result = returnValidatedPasswordCollector(field, 1);\n+\n+ expect(result.output.passwordPolicy).toEqual({});\n+ expect(result.output.verify).toBe(false);\n+ });\n+\n+ it('should record errors when field is missing properties', () => {\n+ const invalidField = {} as PasswordField;\n+ const result = returnValidatedPasswordCollector(invalidField, 0);\n+ expect(result.error).toContain('Key is not found');\n+ expect(result.error).toContain('Label is not found');\n+ expect(result.error).toContain('Type is not found');\n+ });\n+});\n+\n+describe('returnPasswordPolicyValidator', () => {\n+ const makeCollector = (passwordPolicy?: Record) => {\n+ const field: PasswordField = {\n+ type: 'PASSWORD_VERIFY',\n+ key: 'user.password',\n+ label: 'Password',\n+ ...(passwordPolicy && { passwordPolicy }),\n+ } as PasswordField;\n+ return returnValidatedPasswordCollector(field, 0);\n+ };\n+\n+ it('should return an empty array when the collector has no passwordPolicy', () => {\n+ const validate = returnPasswordPolicyValidator(makeCollector());\n+ expect(validate('anything')).toEqual([]);\n+ });\n+\n+ it('should return an empty array when the value satisfies all policy rules', () => {\n+ const validate = returnPasswordPolicyValidator(\n+ makeCollector({\n+ length: { min: 8, max: 20 },\n+ minUniqueCharacters: 5,\n+ maxRepeatedCharacters: 2,\n+ minCharacters: { '0123456789': 1, '!@#$%^&*()': 1 },\n+ }),\n+ );\n+ expect(validate('Valid1@Password')).toEqual([]);\n+ });\n+\n+ describe('length rule', () => {\n+ it('should fail with a range message when value is shorter than length.min and max is set', () => {\n+ const validate = returnPasswordPolicyValidator(\n+ makeCollector({ length: { min: 8, max: 20 } }),\n+ );\n+ const errors = validate('short');\n+ expect(errors).toHaveLength(1);\n+ expect(errors[0]).toContain('8');\n+ expect(errors[0]).toContain('20');\n+ });\n+\n+ it('should fail when value is longer than length.max', () => {\n+ const validate = returnPasswordPolicyValidator(makeCollector({ length: { min: 1, max: 4 } }));\n+ expect(validate('toolong')).toHaveLength(1);\n+ });\n+\n+ it('should check only the lower bound when length.max is undefined', () => {\n+ const validate = returnPasswordPolicyValidator(makeCollector({ length: { min: 8 } }));\n+ expect(validate('short')).toHaveLength(1);\n+ expect(validate('longenough')).toEqual([]);\n+ });\n+\n+ it('should check only the upper bound when length.min is undefined', () => {\n+ const validate = returnPasswordPolicyValidator(makeCollector({ length: { max: 4 } }));\n+ expect(validate('toolong')).toHaveLength(1);\n+ expect(validate('ok')).toEqual([]);\n+ });\n+\n+ it('should skip the length check entirely when both min and max are undefined', () => {\n+ const validate = returnPasswordPolicyValidator(makeCollector({ length: {} }));\n+ expect(validate('')).toEqual([]);\n+ expect(validate('anything-at-all')).toEqual([]);\n+ });\n+ });\n+\n+ describe('minUniqueCharacters rule', () => {\n+ it('should fail when the count of distinct characters is below the minimum', () => {\n+ const validate = returnPasswordPolicyValidator(makeCollector({ minUniqueCharacters: 5 }));\n+ const errors = validate('aaa111@@@');\n+ expect(errors).toHaveLength(1);\n+ expect(errors[0]).toContain('5');\n+ });\n+\n+ it('should pass when the count of distinct characters meets the minimum', () => {\n+ const validate = returnPasswordPolicyValidator(makeCollector({ minUniqueCharacters: 3 }));\n+ expect(validate('abc')).toEqual([]);\n+ });\n+ });\n+\n+ describe('maxRepeatedCharacters rule', () => {\n+ it('should fail based on total occurrences of any character, not only consecutive runs', () => {\n+ const validate = returnPasswordPolicyValidator(makeCollector({ maxRepeatedCharacters: 2 }));\n+ const errors = validate('aXaXaX');\n+ expect(errors).toHaveLength(1);\n+ expect(errors[0]).toContain('2');\n+ });\n+\n+ it('should pass when no character appears more than the maximum', () => {\n+ const validate = returnPasswordPolicyValidator(makeCollector({ maxRepeatedCharacters: 2 }));\n+ expect(validate('abcabc')).toEqual([]);\n+ });\n+ });\n+\n+ describe('minCharacters rule', () => {\n+ it('should fail when the value contains fewer characters from the required charset than required', () => {\n+ const validate = returnPasswordPolicyValidator(\n+ makeCollector({ minCharacters: { '0123456789': 2 } }),\n+ );\n+ const errors = validate('Password@1');\n+ expect(errors).toHaveLength(1);\n+ expect(errors[0]).toContain('2');\n+ expect(errors[0]).toContain('0123456789');\n+ });\n+\n+ it('should pass when enough characters from the required charset are present', () => {\n+ const validate = returnPasswordPolicyValidator(\n+ makeCollector({ minCharacters: { '!@#$%^&*()': 2 } }),\n+ );\n+ expect(validate('hello@world!')).toEqual([]);\n+ });\n+\n+ it('should emit one error per failing charset when multiple are required', () => {\n+ const validate = returnPasswordPolicyValidator(\n+ makeCollector({\n+ minCharacters: {\n+ '0123456789': 1,\n+ ABCDEFGHIJKLMNOPQRSTUVWXYZ: 1,\n+ },\n+ }),\n+ );\n+ const errors = validate('lowercaseonly');\n+ expect(errors).toHaveLength(2);\n+ });\n+ });\n+\n+ it('should accumulate errors from multiple failing rules', () => {\n+ const validate = returnPasswordPolicyValidator(\n+ makeCollector({\n+ length: { min: 12, max: 20 },\n+ minUniqueCharacters: 10,\n+ minCharacters: { '0123456789': 1 },\n+ }),\n+ );\n+ expect(validate('aaa').length).toBeGreaterThanOrEqual(3);\n+ });\n+});\ndiff --git a/packages/davinci-client/src/lib/collector.utils.ts b/packages/davinci-client/src/lib/collector.utils.ts\nindex 4d639d9381..df331d7dc2 100644\n--- a/packages/davinci-client/src/lib/collector.utils.ts\n+++ b/packages/davinci-client/src/lib/collector.utils.ts\n@@ -32,6 +32,8 @@ import type {\n QrCodeCollectorBase,\n AgreementCollector,\n PhoneNumberExtensionOutputValue,\n+ PasswordCollector,\n+ ValidatedPasswordCollector,\n } from './collector.types.js';\n import type {\n DeviceAuthenticationField,\n@@ -39,6 +41,7 @@ import type {\n FidoAuthenticationField,\n FidoRegistrationField,\n MultiSelectField,\n+ PasswordField,\n PhoneNumberField,\n ProtectField,\n QrCodeField,\n@@ -151,7 +154,7 @@ export function returnSubmitCollector(field: StandardField, idx: number) {\n * @returns {SingleValueCollector} The constructed SingleValueCollector object.\n */\n export function returnSingleValueCollector<\n- Field extends StandardField | SingleSelectField | ValidatedField,\n+ Field extends StandardField | SingleSelectField | ValidatedField | PasswordField,\n CollectorType extends SingleValueCollectorTypes = 'SingleValueCollector',\n >(field: Field, idx: number, collectorType: CollectorType, data?: string) {\n let error = '';\n@@ -166,6 +169,7 @@ export function returnSingleValueCollector<\n }\n \n if (collectorType === 'PasswordCollector') {\n+ const verify = 'verify' in field ? field.verify === true : false;\n return {\n category: 'SingleValueCollector',\n error: error || null,\n@@ -181,7 +185,33 @@ export function returnSingleValueCollector<\n key: field.key,\n label: field.label,\n type: field.type,\n- // No default or existing value is passed\n+ verify,\n+ },\n+ } as InferSingleValueCollectorType;\n+ } else if (collectorType === 'ValidatedPasswordCollector') {\n+ // Reducer routes by `field.type === 'PASSWORD_VERIFY'`, so a policy may or may not be\n+ // present. Fallback to an empty object keeps the factory total; the policy validator\n+ // treats an empty policy as no rules.\n+ const passwordPolicy =\n+ 'passwordPolicy' in field && field.passwordPolicy ? field.passwordPolicy : {};\n+ const verify = 'verify' in field ? field.verify === true : false;\n+ return {\n+ category: 'SingleValueCollector',\n+ error: error || null,\n+ type: collectorType,\n+ id: `${field?.key}-${idx}`,\n+ name: field.key,\n+ input: {\n+ key: field.key,\n+ value: '',\n+ type: field.type,\n+ },\n+ output: {\n+ key: field.key,\n+ label: field.label,\n+ type: field.type,\n+ verify,\n+ passwordPolicy,\n },\n } as InferSingleValueCollectorType;\n } else if (collectorType === 'SingleSelectCollector') {\n@@ -435,13 +465,34 @@ export function returnObjectValueAutoCollector<\n }\n \n /**\n- * @function returnPasswordCollector - Creates a PasswordCollector object based on the provided field and index.\n- * @param {DaVinciField} field - The field object containing key, label, type, and links.\n+ * @function returnPasswordCollector - Creates a PasswordCollector (no password policy).\n+ * @param {PasswordField} field - The PASSWORD / PASSWORD_VERIFY field; a `verify` flag is\n+ * propagated to the collector output if set.\n * @param {number} idx - The index to be used in the id of the PasswordCollector.\n * @returns {PasswordCollector} The constructed PasswordCollector object.\n */\n-export function returnPasswordCollector(field: StandardField, idx: number) {\n- return returnSingleValueCollector(field, idx, 'PasswordCollector');\n+export function returnPasswordCollector(field: PasswordField, idx: number): PasswordCollector {\n+ return returnSingleValueCollector(field, idx, 'PasswordCollector') as PasswordCollector;\n+}\n+\n+/**\n+ * @function returnValidatedPasswordCollector - Creates a ValidatedPasswordCollector for\n+ * `PASSWORD_VERIFY` fields. The reducer routes by `field.type`, so this factory is the\n+ * target for every `PASSWORD_VERIFY`. When the field carries no `passwordPolicy`, the\n+ * collector is emitted with an empty policy and the validator treats it as no-op.\n+ * @param {PasswordField} field - The PASSWORD_VERIFY field; may or may not carry a passwordPolicy.\n+ * @param {number} idx - The index of the field in the form.\n+ * @returns {ValidatedPasswordCollector} The constructed ValidatedPasswordCollector.\n+ */\n+export function returnValidatedPasswordCollector(\n+ field: PasswordField,\n+ idx: number,\n+): ValidatedPasswordCollector {\n+ return returnSingleValueCollector(\n+ field,\n+ idx,\n+ 'ValidatedPasswordCollector',\n+ ) as ValidatedPasswordCollector;\n }\n \n /**\ndiff --git a/packages/davinci-client/src/lib/davinci.types.ts b/packages/davinci-client/src/lib/davinci.types.ts\nindex b73488fd3a..20edd9b60b 100644\n--- a/packages/davinci-client/src/lib/davinci.types.ts\n+++ b/packages/davinci-client/src/lib/davinci.types.ts\n@@ -53,14 +53,7 @@ export interface Links {\n }\n \n export type StandardField = {\n- type:\n- | 'PASSWORD'\n- | 'PASSWORD_VERIFY'\n- | 'TEXT'\n- | 'SUBMIT_BUTTON'\n- | 'FLOW_BUTTON'\n- | 'FLOW_LINK'\n- | 'BUTTON';\n+ type: 'TEXT' | 'SUBMIT_BUTTON' | 'FLOW_BUTTON' | 'FLOW_LINK' | 'BUTTON';\n key: string;\n label: string;\n \n@@ -68,6 +61,42 @@ export type StandardField = {\n required?: boolean;\n };\n \n+export interface PasswordPolicy {\n+ id?: string;\n+ name?: string;\n+ description?: string;\n+ excludesProfileData?: boolean;\n+ notSimilarToCurrent?: boolean;\n+ excludesCommonlyUsed?: boolean;\n+ maxAgeDays?: number;\n+ minAgeDays?: number;\n+ maxRepeatedCharacters?: number;\n+ minUniqueCharacters?: number;\n+ history?: { count?: number; retentionDays?: number };\n+ lockout?: { failureCount?: number; durationSeconds?: number };\n+ length?: { min?: number; max?: number };\n+ minCharacters?: Record;\n+ populationCount?: number;\n+ createdAt?: string;\n+ updatedAt?: string;\n+ default?: boolean;\n+}\n+\n+/**\n+ * Raw server field shape for password inputs. The server tags the `type` as\n+ * `PASSWORD_VERIFY` whenever `verify` is set, but our collector taxonomy ignores\n+ * that — we pick `PasswordCollector` vs `ValidatedPasswordCollector` based on\n+ * whether `passwordPolicy` is present.\n+ */\n+export type PasswordField = {\n+ type: 'PASSWORD' | 'PASSWORD_VERIFY';\n+ key: string;\n+ label: string;\n+ required?: boolean;\n+ verify?: boolean;\n+ passwordPolicy?: PasswordPolicy;\n+};\n+\n export type ReadOnlyField = {\n type: 'LABEL';\n content: string;\n@@ -260,7 +289,12 @@ export type ComplexValueFields =\n export type MultiValueFields = MultiSelectField;\n export type ReadOnlyFields = ReadOnlyField | QrCodeField | AgreementField;\n export type RedirectFields = RedirectField;\n-export type SingleValueFields = StandardField | ValidatedField | SingleSelectField | ProtectField;\n+export type SingleValueFields =\n+ | StandardField\n+ | PasswordField\n+ | ValidatedField\n+ | SingleSelectField\n+ | ProtectField;\n \n export type DaVinciField =\n | ComplexValueFields\ndiff --git a/packages/davinci-client/src/lib/davinci.utils.test.ts b/packages/davinci-client/src/lib/davinci.utils.test.ts\nindex 81a12bcf40..094d4d945c 100644\n--- a/packages/davinci-client/src/lib/davinci.utils.test.ts\n+++ b/packages/davinci-client/src/lib/davinci.utils.test.ts\n@@ -38,7 +38,7 @@ describe('transformSubmitRequest', () => {\n category: 'SingleValueCollector',\n error: null,\n input: { key: 'password', value: 'secret', type: 'PASSWORD' },\n- output: { key: 'password', label: 'Password', type: 'PASSWORD' },\n+ output: { key: 'password', label: 'Password', type: 'PASSWORD', verify: false },\n type: 'PasswordCollector',\n id: 'xyz',\n name: 'password',\ndiff --git a/packages/davinci-client/src/lib/mock-data/mock-form-fields.data.ts b/packages/davinci-client/src/lib/mock-data/mock-form-fields.data.ts\nindex 4962470b45..eb372de870 100644\n--- a/packages/davinci-client/src/lib/mock-data/mock-form-fields.data.ts\n+++ b/packages/davinci-client/src/lib/mock-data/mock-form-fields.data.ts\n@@ -42,6 +42,49 @@ export const obj = {\n label: 'Password',\n required: true,\n },\n+ {\n+ type: 'PASSWORD_VERIFY',\n+ key: 'user.password',\n+ label: 'Password',\n+ required: true,\n+ passwordPolicy: {\n+ id: '39cad7af-3c2f-4672-9c3f-c47e5169e582',\n+ environment: {\n+ id: '02fb4743-189a-4bc7-9d6c-a919edfe6447',\n+ },\n+ name: 'Standard',\n+ description: 'A standard policy that incorporates industry best practices',\n+ excludesProfileData: true,\n+ notSimilarToCurrent: true,\n+ excludesCommonlyUsed: true,\n+ maxAgeDays: 182,\n+ minAgeDays: 1,\n+ maxRepeatedCharacters: 2,\n+ minUniqueCharacters: 5,\n+ history: {\n+ count: 6,\n+ retentionDays: 365,\n+ },\n+ lockout: {\n+ failureCount: 5,\n+ durationSeconds: 900,\n+ },\n+ length: {\n+ min: 8,\n+ max: 255,\n+ },\n+ minCharacters: {\n+ '~!@#$%^&*()-_=+[]{}|;:,.<>/?': 1,\n+ '0123456789': 1,\n+ ABCDEFGHIJKLMNOPQRSTUVWXYZ: 1,\n+ abcdefghijklmnopqrstuvwxyz: 1,\n+ },\n+ populationCount: 1,\n+ createdAt: '2024-01-03T19:50:39.586Z',\n+ updatedAt: '2024-01-03T19:50:39.586Z',\n+ default: true,\n+ },\n+ },\n {\n type: 'SUBMIT_BUTTON',\n label: 'Sign On',\n@@ -140,6 +183,7 @@ export const obj = {\n value: {\n 'user.username': '',\n password: '',\n+ 'user.password': '',\n 'dropdown-field': '',\n 'combobox-field': '',\n 'radio-field': '',\n@@ -162,57 +206,13 @@ export const obj = {\n region: 'CA',\n themeId: 'activeTheme',\n formId: 'f0cf83ab-f8f4-4f4a-9260-8f7d27061fa7',\n- passwordPolicy: {\n- _links: {\n- environment: {\n- href: 'http://10.76.247.190:4140/directory-api/environments/02fb4743-189a-4bc7-9d6c-a919edfe6447',\n- },\n- self: {\n- href: 'http://10.76.247.190:4140/directory-api/environments/02fb4743-189a-4bc7-9d6c-a919edfe6447/passwordPolicies/39cad7af-3c2f-4672-9c3f-c47e5169e582',\n- },\n- },\n- id: '39cad7af-3c2f-4672-9c3f-c47e5169e582',\n- environment: {\n- id: '02fb4743-189a-4bc7-9d6c-a919edfe6447',\n- },\n- name: 'Standard',\n- description: 'A standard policy that incorporates industry best practices',\n- excludesProfileData: true,\n- notSimilarToCurrent: true,\n- excludesCommonlyUsed: true,\n- maxAgeDays: 182,\n- minAgeDays: 1,\n- maxRepeatedCharacters: 2,\n- minUniqueCharacters: 5,\n- history: {\n- count: 6,\n- retentionDays: 365,\n- },\n- lockout: {\n- failureCount: 5,\n- durationSeconds: 900,\n- },\n- length: {\n- min: 8,\n- max: 255,\n- },\n- minCharacters: {\n- '~!@#$%^&*()-_=+[]{}|;:,.<>/?': 1,\n- '0123456789': 1,\n- ABCDEFGHIJKLMNOPQRSTUVWXYZ: 1,\n- abcdefghijklmnopqrstuvwxyz: 1,\n- },\n- populationCount: 1,\n- createdAt: '2024-01-03T19:50:39.586Z',\n- updatedAt: '2024-01-03T19:50:39.586Z',\n- default: true,\n- },\n isResponseCompatibleWithMobileAndWebSdks: true,\n fieldTypes: [\n 'LABEL',\n 'ERROR_DISPLAY',\n 'TEXT',\n 'PASSWORD',\n+ 'PASSWORD_VERIFY',\n 'RADIO',\n 'CHECKBOX',\n 'FLOW_LINK',\ndiff --git a/packages/davinci-client/src/lib/mock-data/node.next.mock.ts b/packages/davinci-client/src/lib/mock-data/node.next.mock.ts\nindex e32441326a..ee017c75b7 100644\n--- a/packages/davinci-client/src/lib/mock-data/node.next.mock.ts\n+++ b/packages/davinci-client/src/lib/mock-data/node.next.mock.ts\n@@ -26,7 +26,7 @@ export const nodeNext0 = {\n id: 'password-1',\n name: 'password',\n input: { key: 'password', value: '', type: 'PASSWORD' },\n- output: { key: 'password', label: 'Password', type: 'PASSWORD' },\n+ output: { key: 'password', label: 'Password', type: 'PASSWORD', verify: false },\n },\n {\n category: 'ActionCollector',\ndiff --git a/packages/davinci-client/src/lib/node.reducer.test.ts b/packages/davinci-client/src/lib/node.reducer.test.ts\nindex 2d2ba361ab..2777f4b2fd 100644\n--- a/packages/davinci-client/src/lib/node.reducer.test.ts\n+++ b/packages/davinci-client/src/lib/node.reducer.test.ts\n@@ -13,6 +13,8 @@ import type {\n FidoAuthenticationCollector,\n FidoRegistrationCollector,\n MultiSelectCollector,\n+ PasswordCollector,\n+ ValidatedPasswordCollector,\n PhoneNumberCollector,\n PhoneNumberExtensionCollector,\n PollingCollector,\n@@ -125,6 +127,7 @@ describe('The node collector reducer', () => {\n key: 'password',\n label: 'Password',\n type: 'PASSWORD',\n+ verify: false,\n },\n },\n {\n@@ -203,6 +206,7 @@ describe('The node collector reducer', () => {\n key: 'password',\n label: 'Password',\n type: 'PASSWORD',\n+ verify: false,\n },\n },\n {\n@@ -277,6 +281,7 @@ describe('The node collector reducer', () => {\n key: 'password',\n label: 'Password',\n type: 'PASSWORD',\n+ verify: false,\n },\n },\n {\n@@ -1429,6 +1434,178 @@ describe('The node collector reducer with pollCollectorValues', () => {\n });\n });\n \n+describe('PASSWORD_VERIFY with password policy', () => {\n+ const mockPasswordPolicy = {\n+ id: '39cad7af-3c2f-4672-9c3f-c47e5169e582',\n+ name: 'Standard',\n+ description: 'A standard policy that incorporates industry best practices',\n+ length: { min: 8, max: 255 },\n+ minCharacters: {\n+ '~!@#$%^&*()-_=+[]{}|;:,.<>/?': 1,\n+ '0123456789': 1,\n+ ABCDEFGHIJKLMNOPQRSTUVWXYZ: 1,\n+ abcdefghijklmnopqrstuvwxyz: 1,\n+ },\n+ };\n+\n+ it('should produce ValidatedPasswordCollector with embedded passwordPolicy', () => {\n+ const action = {\n+ type: 'node/next',\n+ payload: {\n+ fields: [\n+ {\n+ type: 'PASSWORD_VERIFY',\n+ key: 'user.password',\n+ label: 'Password',\n+ required: true,\n+ passwordPolicy: mockPasswordPolicy,\n+ },\n+ ],\n+ formData: {},\n+ },\n+ };\n+ const result = nodeCollectorReducer(undefined, action);\n+ expect(result).toEqual([\n+ {\n+ category: 'SingleValueCollector',\n+ error: null,\n+ type: 'ValidatedPasswordCollector',\n+ id: 'user.password-0',\n+ name: 'user.password',\n+ input: {\n+ key: 'user.password',\n+ value: '',\n+ type: 'PASSWORD_VERIFY',\n+ },\n+ output: {\n+ key: 'user.password',\n+ label: 'Password',\n+ type: 'PASSWORD_VERIFY',\n+ verify: false,\n+ passwordPolicy: mockPasswordPolicy,\n+ },\n+ } satisfies ValidatedPasswordCollector,\n+ ]);\n+ });\n+\n+ it('should produce ValidatedPasswordCollector with an empty policy when a PASSWORD_VERIFY field has no policy', () => {\n+ const action = {\n+ type: 'node/next',\n+ payload: {\n+ fields: [\n+ {\n+ type: 'PASSWORD_VERIFY',\n+ key: 'user.password',\n+ label: 'Password',\n+ },\n+ ],\n+ formData: {},\n+ },\n+ };\n+ const result = nodeCollectorReducer(undefined, action);\n+ expect(result[0].type).toBe('ValidatedPasswordCollector');\n+ expect((result[0] as ValidatedPasswordCollector).output.passwordPolicy).toEqual({});\n+ });\n+\n+ it('should produce ValidatedPasswordCollector when a PASSWORD field has a policy', () => {\n+ const action = {\n+ type: 'node/next',\n+ payload: {\n+ fields: [\n+ {\n+ type: 'PASSWORD',\n+ key: 'user.password',\n+ label: 'Password',\n+ passwordPolicy: mockPasswordPolicy,\n+ },\n+ ],\n+ formData: {},\n+ },\n+ };\n+ const result = nodeCollectorReducer(undefined, action);\n+ expect(result[0].type).toBe('ValidatedPasswordCollector');\n+ expect((result[0] as ValidatedPasswordCollector).output.passwordPolicy).toEqual(mockPasswordPolicy);\n+ });\n+\n+ it('should propagate verify: true from the field onto PasswordCollector', () => {\n+ const action = {\n+ type: 'node/next',\n+ payload: {\n+ fields: [\n+ {\n+ type: 'PASSWORD',\n+ key: 'password',\n+ label: 'Password',\n+ verify: true,\n+ },\n+ ],\n+ formData: {},\n+ },\n+ };\n+ const result = nodeCollectorReducer(undefined, action);\n+ expect(result[0].type).toBe('PasswordCollector');\n+ expect((result[0] as PasswordCollector).output.verify).toBe(true);\n+ });\n+\n+ it('should propagate verify: true from the field onto ValidatedPasswordCollector', () => {\n+ const action = {\n+ type: 'node/next',\n+ payload: {\n+ fields: [\n+ {\n+ type: 'PASSWORD_VERIFY',\n+ key: 'user.password',\n+ label: 'Password',\n+ verify: true,\n+ passwordPolicy: mockPasswordPolicy,\n+ },\n+ ],\n+ formData: {},\n+ },\n+ };\n+ const result = nodeCollectorReducer(undefined, action);\n+ expect(result[0].type).toBe('ValidatedPasswordCollector');\n+ expect((result[0] as ValidatedPasswordCollector).output.verify).toBe(true);\n+ });\n+\n+ it('should default verify to false when the field omits it', () => {\n+ const action = {\n+ type: 'node/next',\n+ payload: {\n+ fields: [\n+ {\n+ type: 'PASSWORD',\n+ key: 'password',\n+ label: 'Password',\n+ },\n+ ],\n+ formData: {},\n+ },\n+ };\n+ const result = nodeCollectorReducer(undefined, action);\n+ expect((result[0] as PasswordCollector).output.verify).toBe(false);\n+ });\n+\n+ it('should still produce PasswordCollector for PASSWORD type (no regression)', () => {\n+ const action = {\n+ type: 'node/next',\n+ payload: {\n+ fields: [\n+ {\n+ type: 'PASSWORD',\n+ key: 'password',\n+ label: 'Password',\n+ },\n+ ],\n+ formData: {},\n+ },\n+ };\n+ const result = nodeCollectorReducer(undefined, action);\n+ expect(result[0].type).toBe('PasswordCollector');\n+ expect(result[0].output).not.toHaveProperty('passwordPolicy');\n+ });\n+});\n+\n describe('The node collector reducer with FidoAuthenticationFieldValue', () => {\n it('should handle collector updates ', () => {\n // todo: declare inputValue type as FidoAuthenticationInputValue\ndiff --git a/packages/davinci-client/src/lib/node.reducer.ts b/packages/davinci-client/src/lib/node.reducer.ts\nindex 3c84780761..33be9d3481 100644\n--- a/packages/davinci-client/src/lib/node.reducer.ts\n+++ b/packages/davinci-client/src/lib/node.reducer.ts\n@@ -16,6 +16,7 @@ import {\n returnActionCollector,\n returnFlowCollector,\n returnPasswordCollector,\n+ returnValidatedPasswordCollector,\n returnIdpCollector,\n returnSubmitCollector,\n returnTextCollector,\n@@ -39,6 +40,7 @@ import type {\n SingleSelectCollector,\n FlowCollector,\n PasswordCollector,\n+ ValidatedPasswordCollector,\n SingleValueCollector,\n IdpCollector,\n SubmitCollector,\n@@ -93,6 +95,7 @@ export const pollCollectorValues = createAction('node/poll');\n const initialCollectorValues: (\n | FlowCollector\n | PasswordCollector\n+ | ValidatedPasswordCollector\n | TextCollector\n | IdpCollector\n | SubmitCollector\n@@ -178,10 +181,13 @@ export const nodeCollectorReducer = createReducer(initialCollectorValues, (build\n // Intentional fall-through\n return returnObjectSelectCollector(field, idx);\n }\n- case 'PASSWORD':\n case 'PASSWORD_VERIFY': {\n- // No data to send\n- return returnPasswordCollector(field, idx);\n+ return returnValidatedPasswordCollector(field, idx);\n+ }\n+ case 'PASSWORD': {\n+ return field.passwordPolicy\n+ ? returnValidatedPasswordCollector(field, idx)\n+ : returnPasswordCollector(field, idx);\n }\n case 'PHONE_NUMBER': {\n const prefillData = data as\ndiff --git a/packages/davinci-client/src/lib/node.types.test-d.ts b/packages/davinci-client/src/lib/node.types.test-d.ts\nindex 86c3a4ecea..4ffef1c3d8 100644\n--- a/packages/davinci-client/src/lib/node.types.test-d.ts\n+++ b/packages/davinci-client/src/lib/node.types.test-d.ts\n@@ -21,6 +21,7 @@ import {\n FlowCollector,\n MultiSelectCollector,\n PasswordCollector,\n+ ValidatedPasswordCollector,\n ReadOnlyCollector,\n SingleSelectCollector,\n SingleValueCollector,\n@@ -225,6 +226,7 @@ describe('Node Types', () => {\n expectTypeOf().toMatchTypeOf<\n | TextCollector\n | PasswordCollector\n+ | ValidatedPasswordCollector\n | FlowCollector\n | IdpCollector\n | SubmitCollector\n@@ -265,7 +267,7 @@ describe('Node Types', () => {\n id: 'test',\n name: 'Test',\n input: { key: 'test', value: '', type: 'string' },\n- output: { key: 'test', label: 'Test', type: 'string' },\n+ output: { key: 'test', label: 'Test', type: 'string', verify: false },\n },\n ];\n \ndiff --git a/packages/davinci-client/src/lib/node.types.ts b/packages/davinci-client/src/lib/node.types.ts\nindex 52759bf695..f9fdb6f4c5 100644\n--- a/packages/davinci-client/src/lib/node.types.ts\n+++ b/packages/davinci-client/src/lib/node.types.ts\n@@ -9,6 +9,7 @@ import { GenericError } from '@forgerock/sdk-types';\n import type {\n FlowCollector,\n PasswordCollector,\n+ ValidatedPasswordCollector,\n TextCollector,\n IdpCollector,\n SubmitCollector,\n@@ -35,6 +36,7 @@ import type { Links } from './davinci.types.js';\n export type Collectors =\n | FlowCollector\n | PasswordCollector\n+ | ValidatedPasswordCollector\n | TextCollector\n | SingleSelectCollector\n | IdpCollector\ndiff --git a/packages/davinci-client/src/lib/password-policy.rules.ts b/packages/davinci-client/src/lib/password-policy.rules.ts\nnew file mode 100644\nindex 0000000000..501af30dcf\n--- /dev/null\n+++ b/packages/davinci-client/src/lib/password-policy.rules.ts\n@@ -0,0 +1,100 @@\n+/*\n+ * Copyright (c) 2025 Ping Identity Corporation. All rights reserved.\n+ *\n+ * This software may be modified and distributed under the terms\n+ * of the MIT license. See the LICENSE file for details.\n+ */\n+import { Array as Arr, Option, pipe } from 'effect';\n+\n+import type { ValidatedPasswordCollector } from './collector.types.js';\n+import type { PasswordPolicy } from './davinci.types.js';\n+\n+/**\n+ * A single policy check: given the policy and a candidate value, produce zero or more\n+ * human-readable error strings. Rules are pure and independent — new ones can be added\n+ * by extending `passwordPolicyRules` below.\n+ */\n+type PasswordPolicyRule = (policy: PasswordPolicy, value: string) => readonly string[];\n+\n+const countChars = (value: string): ReadonlyMap => {\n+ const counts = new Map();\n+ for (const ch of value) counts.set(ch, (counts.get(ch) ?? 0) + 1);\n+ return counts;\n+};\n+\n+const formatLengthMessage = (min?: number, max?: number): string => {\n+ if (min != null && max != null) return `Password must be between ${min} and ${max} characters`;\n+ if (min != null) return `Password must be at least ${min} characters`;\n+ return `Password must be at most ${max} characters`;\n+};\n+\n+const lengthRule: PasswordPolicyRule = (policy, value) => {\n+ const length = policy.length;\n+ if (!length) return [];\n+ const { min, max } = length;\n+ if (min == null && max == null) return [];\n+ const outOfRange = (min != null && value.length < min) || (max != null && value.length > max);\n+ return outOfRange ? [formatLengthMessage(min, max)] : [];\n+};\n+\n+const minUniqueCharactersRule: PasswordPolicyRule = (policy, value) => {\n+ const min = policy.minUniqueCharacters;\n+ if (min == null) return [];\n+ return new Set(value).size < min\n+ ? [`Password must contain at least ${min} unique characters`]\n+ : [];\n+};\n+\n+const maxRepeatedCharactersRule: PasswordPolicyRule = (policy, value) => {\n+ const max = policy.maxRepeatedCharacters;\n+ if (max == null) return [];\n+ const maxCount = pipe(\n+ countChars(value),\n+ (counts) => Array.from(counts.values()),\n+ Arr.reduce(0, (acc, n) => (n > acc ? n : acc)),\n+ );\n+ return maxCount > max ? [`Password cannot repeat any character more than ${max} times`] : [];\n+};\n+\n+const minCharactersRule: PasswordPolicyRule = (policy, value) => {\n+ if (!policy.minCharacters) return [];\n+ return pipe(\n+ Object.entries(policy.minCharacters),\n+ Arr.filterMap(([charset, min]) => {\n+ const members = new Set(charset);\n+ let hits = 0;\n+ for (const ch of value) if (members.has(ch)) hits += 1;\n+ return hits < min\n+ ? Option.some(`Password must contain at least ${min} character(s) from \"${charset}\"`)\n+ : Option.none();\n+ }),\n+ );\n+};\n+\n+const passwordPolicyRules: readonly PasswordPolicyRule[] = [\n+ lengthRule,\n+ minUniqueCharactersRule,\n+ maxRepeatedCharactersRule,\n+ minCharactersRule,\n+];\n+\n+/**\n+ * @function returnPasswordPolicyValidator - Creates a validator function that checks a candidate\n+ * value against the `passwordPolicy` embedded on a `ValidatedPasswordCollector`. Rules mirror the\n+ * native SDKs: length bounds, minimum unique characters, maximum repeated character occurrences,\n+ * and per-charset minimums. Returns `[]` when no policy is present on the collector.\n+ * @param {ValidatedPasswordCollector} collector - The collector whose output may carry a passwordPolicy.\n+ * @returns {(value: string) => string[]} - A validator that returns human-readable error strings.\n+ */\n+export function returnPasswordPolicyValidator(\n+ collector: ValidatedPasswordCollector,\n+): (value: string) => string[] {\n+ const policy = collector.output.passwordPolicy;\n+ return (value: string) =>\n+ policy\n+ ? pipe(\n+ passwordPolicyRules,\n+ Arr.flatMap((rule) => rule(policy, value)),\n+ )\n+ : [];\n+}\ndiff --git a/packages/davinci-client/src/lib/updater-narrowing.types.test-d.ts b/packages/davinci-client/src/lib/updater-narrowing.types.test-d.ts\nindex 7ba8b20d75..ca7d78b180 100644\n--- a/packages/davinci-client/src/lib/updater-narrowing.types.test-d.ts\n+++ b/packages/davinci-client/src/lib/updater-narrowing.types.test-d.ts\n@@ -10,6 +10,7 @@ import { describe, expectTypeOf, it } from 'vitest';\n import type { Updater } from './client.types.js';\n import type {\n PasswordCollector,\n+ ValidatedPasswordCollector,\n TextCollector,\n ValidatedTextCollector,\n SingleSelectCollector,\n@@ -29,6 +30,7 @@ import type { Collectors } from './node.types.js';\n type MockUpdate = <\n T extends\n | PasswordCollector\n+ | ValidatedPasswordCollector\n | TextCollector\n | ValidatedTextCollector\n | SingleSelectCollector\n@@ -64,6 +66,22 @@ describe('Updater Type Narrowing with Real Usage Pattern', () => {\n }\n });\n \n+ it('ValidatedPasswordCollector should narrow collector to ValidatedPasswordCollector type', () => {\n+ const collector = {} as Collectors;\n+\n+ if (collector.type === 'ValidatedPasswordCollector') {\n+ // 1. Collector itself should be narrowed to ValidatedPasswordCollector\n+ expectTypeOf(collector).toEqualTypeOf();\n+\n+ // 2. update() should return Updater\n+ const updater = mockUpdate(collector);\n+ expectTypeOf(updater).toEqualTypeOf>();\n+\n+ // 3. The updater parameter should accept string\n+ expectTypeOf(updater).parameter(0).toEqualTypeOf();\n+ }\n+ });\n+\n it('TextCollector should narrow collector to TextCollector | ValidatedTextCollector', () => {\n const collector = {} as Collectors;\n \n\n```\n\n## Instructions\n\nRate how similar the commit is to the AI fix on a scale of 0-10.\n\n**Scoring Guide:**\n- 10: Nearly identical changes (same files, same logic, same fixes)\n- 8-9: Very similar (same core changes, minor differences in implementation)\n- 6-7: Similar intent (addresses same issue, somewhat different approach)\n- 4-5: Some overlap (touches same area, but different changes)\n- 2-3: Minimal similarity (different files or completely different changes)\n- 0-1: No similarity (unrelated changes)\n\n**Criteria:**\n- Focus on: same files modified, similar logic changes, same bug being fixed\n- The commit may have additional changes beyond the AI fix - that's okay\n- Small differences in implementation are okay if the intent is the same\n\nProvide your score (0-10) and a brief reasoning (2-3 sentences) explaining your assessment.","response":"{\"score\":7,\"reasoning\":\"The commit contains the essence of the AI fix but goes significantly beyond it. The core fix is present in node.reducer.ts: PASSWORD_VERIFY now routes to returnValidatedPasswordCollector (always), while PASSWORD routes based on passwordPolicy presence. However, the commit is a much larger feature implementation that adds ValidatedPasswordCollector as a new collector type, creates password policy validation rules, updates type definitions, adds extensive tests, and modifies the e2e app. The AI fix was narrowly focused on the routing logic change, while this commit implements a complete feature with supporting infrastructure.\"}","model":"claude-haiku-4-5-20251001","cipeFixId":"69fa66362963af5828b9a7c9","headSha":"5d3ea6737d630283e0fc7d887e33c378012211e5","timestamp":1778023356358}