Six fixes, each with a test:
1. Character pools are built as arrays of code points, so astral characters
(emoji) are never split into lone surrogates. Entropy counts code points.
2. Boolean options are parsed strictly: true/false, 1/0, "true"/"false",
"1"/"0", "yes"/"no", "on"/"off" (case-insensitive). Anything else
is a 400 naming the option instead of a silent truthy fallback.
3. customSymbols is validated: at most 64 code points, duplicates dropped,
control characters and whitespace rejected with a 400.
4. Random mode entropy with requireEach now counts only the passwords that
contain a character of every enabled class (inclusion-exclusion). The
value is an upper bound and is labelled as such in the API
(entropyApproximate/entropyNote) and in the UI.
5. docker-compose.yml uses expose instead of ports, so it no longer
collides with Dokploy's own port 3000.
6. SIGTERM/SIGINT shut the server down gracefully: close the listener, let
in-flight requests finish, force-exit after 5s. Measured at ~60ms.
The server now exports createServer() so the API can be tested over HTTP
without binding a fixed port.
reze
1965c6efaa