[sagargupta6259]

Description

Closes #54.

Currently, custom alphabets passed into generators and entropy utilities can accept invalid inputs—such as duplicate characters, surrogate code units (e.g., emoji halves), or lengths exceeding 256 characters—which silently degrade randomness, cause biased IDs, or trigger infinite loops during rejection sampling.

This pull request centralizes alphabet validation into a shared internal helper and enforces consistent invariants across all public APIs that accept an alphabet option.

Changes

• Centralized Validation (src/internal/alphabet.ts):
  • Added internal assertAlphabet(alphabet) helper.
  • Enforces minimum length >= 2 characters (RangeError: prefid: alphabet must contain at least 2 characters.).
  • Enforces maximum length <= 256 characters (RangeError: prefid: alphabet must not contain more than 256 characters.).
  • Rejects surrogate code units (RangeError: prefid: alphabet must not contain surrogate code units.).
  • Rejects duplicate characters (RangeError: prefid: alphabet must not contain duplicate characters.).
• Generator Integration:
  • Applied assertAlphabet in createId (src/generators/generate.ts), createSortableId (src/generators/sortable.ts), and template (src/generators/template.ts).
  • Updated template placeholder validation to ensure single BMP characters (RangeError: prefid: placeholder must be a single BMP character.).
• Utility Integration:
  • Applied assertAlphabet consistently across entropy utilities in src/utils/entropy.ts (entropyBits, sizeForEntropy, and collisionProbability).
• Documentation:
  • Documented custom alphabet requirements in README.md.
  • Added entry under [Unreleased] in CHANGELOG.md.
• Tests:
  • Added dedicated test suite in test/alphabet.test.ts.
  • Added boundary and negative test cases in test/generate.test.ts, test/sortable.test.ts, test/template.test.ts, and test/entropy.test.ts.

Verification

• npm test: 11 test files, 172/172 tests passed.
• npm run verify: Full verification suite green (100% coverage on alphabet.ts, publint --strict passed, attw --pack passed, ESM/CJS smoke tests passed).
• Zero external runtime dependencies added.