updated skills

plugins/document-navigator/docs/security-stack/crypto/crypto-bin/README.md

@@ -19,7 +19,9 @@ browser/server consumers that just want primitives.
   - [hash-password](./src/bin/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
 - [hash-password](./src/hash-password/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
   - [hash-password](./src/hash-password/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+
 <!-- end:auto-docs -->  - [hash-password](./src/bin/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_- [hash-password](./src/hash-password/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_- [hash-password](./src/hash-password/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_- [hash-password](./src/bin/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_- [hash-password](./src/hash-password/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_- [hash-password](./src/hash-password/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_- [hash-password](./src/bin/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_- [hash-password](./src/hash-password/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_- [hash-password](./src/hash-password/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_- [hash-password](./src/bin/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_- [hash-password](./src/hash-password/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_  - [hash-password](./src/hash-password/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Quickstart
 
 ```bash
@@ -102,4 +104,3 @@ surfaced via `env.writeError(...)` and a non-zero return value. See
 
 No dependency on `@suaveplan/cli` — argv parsing is hand-rolled (~40
 lines) so the bin stays small.
-

plugins/document-navigator/docs/security-stack/crypto/crypto-cipher/src/primitives/aes-256-gcm/aes-256-gcm.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [aes-256-gcm.select](./aes-256-gcm.select/aes-256-gcm.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.native](./impl/aes-256-gcm.native/aes-256-gcm.native.md) — <!-- begin:auto-docs --> _(no submodules)_  - [aes-256-gcm.native](./impl/aes-256-gcm.native/aes-256-gcm.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.noble](./impl/aes-256-gcm.noble/aes-256-gcm.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [aes-256-gcm.noble](./impl/aes-256-gcm.noble/aes-256-gcm.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm](./aes-256-gcm.md) — <!-- begin:auto-docs --> _(no submodules)_- aes-256-gcm.select — <!-- begin:auto-docs --> _(no s…
+- [aes-256-gcm.select](./aes-256-gcm.select/aes-256-gcm.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.native](./impl/aes-256-gcm.native/aes-256-gcm.native.md) — <!-- begin:auto-docs --> _(no submodules)_  - [aes-256-gcm.native](./impl/aes-256-gcm.native/aes-256-gcm.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.noble](./impl/aes-256-gcm.noble/aes-256-gcm.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [aes-256-gcm.noble](./impl/aes-256-gcm.noble/aes-256-gcm.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm](./aes-256-gcm.md) — <!-- begin:auto-docs --> _(no submodules)_- aes-256-gcm.select — <!-- begin:auto-docs --> _(no s…
 - [aes-256-gcm.select](./aes-256-gcm.select/aes-256-gcm.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.native](./impl/aes-256-gcm.native/aes-256-gcm.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.native](./impl/aes-256-gcm.native/aes-256-gcm.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.noble](./impl/aes-256-gcm.noble/aes-256-gcm.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.noble](./impl/aes-256-gcm.noble/aes-256-gcm.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm](./aes-256-gcm.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.select](./aes-256-gcm.select/aes-256-gcm.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.native](./impl/aes-256-gcm.native/aes-256-gcm.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.native](./impl/aes-256-gcm.native/aes-256-gcm.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.noble](./impl/aes-256-gcm.noble/aes-256-gcm.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.noble](./impl/aes-256-gcm.noble/aes-256-gcm.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm](./aes-256-gcm.md) — <!-- begin:auto-docs --> _(no submodules)_- aes-256-gcm.select — <!-- be…
 - [aes-256-gcm.select](./aes-256-gcm.select/aes-256-gcm.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.native](./impl/aes-256-gcm.native/aes-256-gcm.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.native](./impl/aes-256-gcm.native/aes-256-gcm.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.noble](./impl/aes-256-gcm.noble/aes-256-gcm.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.noble](./impl/aes-256-gcm.noble/aes-256-gcm.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm](./aes-256-gcm.md) — <!-- begin:auto-docs --> _(no submodules)_- aes-256-gcm.select — <!-- begin:auto-docs --> _(no…
 - [aes-256-gcm.select](./aes-256-gcm.select/aes-256-gcm.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.native](./impl/aes-256-gcm.native/aes-256-gcm.native.md) — <!-- begin:auto-docs --> _(no submodules)_  - [aes-256-gcm.native](./impl/aes-256-gcm.native/aes-256-gcm.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.noble](./impl/aes-256-gcm.noble/aes-256-gcm.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [aes-256-gcm.noble](./impl/aes-256-gcm.noble/aes-256-gcm.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm](./aes-256-gcm.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 `aes-256-gcm.ts` is the stable public entry point for the AES-256-GCM AEAD primitive in `@suaveplan/crypto-cipher`. It re-exports everything from the generated `aes-256-gcm.select.ts`, which forwards to either the Noble-backed or native implementation according to `crypto.config.ts`.

plugins/document-navigator/docs/security-stack/crypto/crypto-cipher/src/primitives/chacha20-poly1305/chacha20-poly1305.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [chacha20-poly1305.select](./chacha20-poly1305.select/chacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.native](./impl/chacha20-poly1305.native/chacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_  - [chacha20-poly1305.native](./impl/chacha20-poly1305.native/chacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.noble](./impl/chacha20-poly1305.noble/chacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [chacha20-poly1305.noble](./impl/chacha20-poly1305.noble/chacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305](./chacha20-poly1305.md) — <!-- begin:auto-docs --> _(no submodules)_- chacha20-poly1305.select — <!-- begin:auto-docs -->…
+- [chacha20-poly1305.select](./chacha20-poly1305.select/chacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.native](./impl/chacha20-poly1305.native/chacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_  - [chacha20-poly1305.native](./impl/chacha20-poly1305.native/chacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.noble](./impl/chacha20-poly1305.noble/chacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [chacha20-poly1305.noble](./impl/chacha20-poly1305.noble/chacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305](./chacha20-poly1305.md) — <!-- begin:auto-docs --> _(no submodules)_- chacha20-poly1305.select — <!-- begin:auto-docs -->…
 - [chacha20-poly1305.select](./chacha20-poly1305.select/chacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.native](./impl/chacha20-poly1305.native/chacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.native](./impl/chacha20-poly1305.native/chacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.noble](./impl/chacha20-poly1305.noble/chacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.noble](./impl/chacha20-poly1305.noble/chacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305](./chacha20-poly1305.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.select](./chacha20-poly1305.select/chacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.native](./impl/chacha20-poly1305.native/chacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.native](./impl/chacha20-poly1305.native/chacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.noble](./impl/chacha20-poly1305.noble/chacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.noble](./impl/chacha20-poly1305.noble/chacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305](./chacha20-poly1305.md) — <!-- begin:auto-docs --> _(no submodules)_- chacha20-poly1305.select — <…
 - [chacha20-poly1305.select](./chacha20-poly1305.select/chacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.native](./impl/chacha20-poly1305.native/chacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.native](./impl/chacha20-poly1305.native/chacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.noble](./impl/chacha20-poly1305.noble/chacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.noble](./impl/chacha20-poly1305.noble/chacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305](./chacha20-poly1305.md) — <!-- begin:auto-docs --> _(no submodules)_- chacha20-poly1305.select — <!-- begin:auto-docs -->…
 - [chacha20-poly1305.select](./chacha20-poly1305.select/chacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.native](./impl/chacha20-poly1305.native/chacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_  - [chacha20-poly1305.native](./impl/chacha20-poly1305.native/chacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.noble](./impl/chacha20-poly1305.noble/chacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [chacha20-poly1305.noble](./impl/chacha20-poly1305.noble/chacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305](./chacha20-poly1305.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 `chacha20-poly1305.ts` is the stable public entry point for the ChaCha20-Poly1305 AEAD primitive in `@suaveplan/crypto-cipher`. It re-exports everything from the generated `chacha20-poly1305.select.ts`, which forwards to either the Noble-backed or native implementation based on `crypto.config.ts`.

plugins/document-navigator/docs/security-stack/crypto/crypto-cipher/src/primitives/xchacha20-poly1305/xchacha20-poly1305.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [xchacha20-poly1305.native](./impl/xchacha20-poly1305.native/xchacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.noble](./impl/xchacha20-poly1305.noble/xchacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [xchacha20-poly1305.noble](./impl/xchacha20-poly1305.noble/xchacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.select](./xchacha20-poly1305.select/xchacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [xchacha20-poly1305.select](./xchacha20-poly1305.select/xchacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305](./xchacha20-poly1305.md) — <!-- begin:auto-docs --> _(no submodules)_- xchacha20-poly1305.native — <!-- begin:auto-docs -->…
+- [xchacha20-poly1305.native](./impl/xchacha20-poly1305.native/xchacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.noble](./impl/xchacha20-poly1305.noble/xchacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [xchacha20-poly1305.noble](./impl/xchacha20-poly1305.noble/xchacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.select](./xchacha20-poly1305.select/xchacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [xchacha20-poly1305.select](./xchacha20-poly1305.select/xchacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305](./xchacha20-poly1305.md) — <!-- begin:auto-docs --> _(no submodules)_- xchacha20-poly1305.native — <!-- begin:auto-docs -->…
 - [xchacha20-poly1305.native](./impl/xchacha20-poly1305.native/xchacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.noble](./impl/xchacha20-poly1305.noble/xchacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.noble](./impl/xchacha20-poly1305.noble/xchacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.select](./xchacha20-poly1305.select/xchacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.select](./xchacha20-poly1305.select/xchacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305](./xchacha20-poly1305.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.native](./impl/xchacha20-poly1305.native/xchacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.noble](./impl/xchacha20-poly1305.noble/xchacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.noble](./impl/xchacha20-poly1305.noble/xchacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.select](./xchacha20-poly1305.select/xchacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.select](./xchacha20-poly1305.select/xchacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305](./xchacha20-poly1305.md) — <!-- begin:auto-docs --> _(no submodules)_- xchacha20-poly1305.native —…
 - [xchacha20-poly1305.native](./impl/xchacha20-poly1305.native/xchacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.noble](./impl/xchacha20-poly1305.noble/xchacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.noble](./impl/xchacha20-poly1305.noble/xchacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.select](./xchacha20-poly1305.select/xchacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.select](./xchacha20-poly1305.select/xchacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305](./xchacha20-poly1305.md) — <!-- begin:auto-docs --> _(no submodules)_- xchacha20-poly1305.native — <!-- begin:auto-docs --…
 - [xchacha20-poly1305.native](./impl/xchacha20-poly1305.native/xchacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.noble](./impl/xchacha20-poly1305.noble/xchacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [xchacha20-poly1305.noble](./impl/xchacha20-poly1305.noble/xchacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.select](./xchacha20-poly1305.select/xchacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [xchacha20-poly1305.select](./xchacha20-poly1305.select/xchacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305](./xchacha20-poly1305.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 `xchacha20-poly1305.ts` is the stable public entry point for the XChaCha20-Poly1305 AEAD primitive in `@suaveplan/crypto-cipher`. It re-exports from the generated `xchacha20-poly1305.select.ts`, which forwards to the Noble-backed or native implementation based on `crypto.config.ts`.

plugins/document-navigator/docs/security-stack/crypto/crypto-core/README.md

@@ -39,6 +39,7 @@ Universal cryptographic primitives — engine-pluggable AEAD, Ed25519/ECDSA-P256
   - [ed25519](./src/sign/ed25519/ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
 - [noble-sign-engine](./src/sign/noble-sign-engine/noble-sign-engine.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
   - [noble-sign-engine](./src/sign/noble-sign-engine/noble-sign-engine.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+
 <!-- end:auto-docs -->  - [noble-aead-engine](./src/aead/noble-aead-engine/noble-aead-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-aead-engine](./src/aead/noble-aead-engine/noble-aead-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [aead](./src/aead/aead.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-agree-engine](./src/agree/noble-agree-engine/noble-agree-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-agree-engine](./src/agree/noble-agree-engine/noble-agree-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519](./src/agree/x25519/x25519.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519](./src/agree/x25519/x25519.md) — <!-- begin:auto-docs --> _(no submodules)_- [auth-box](./src/auth-box/auth-box.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-auth-box-engine](./src/auth-box/noble-auth-box-engine/noble-auth-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-auth-box-engine](./src/auth-box/noble-auth-box-engine/noble-auth-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [auth-box](./src/auth-box/auth-box.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-error](./src/errors/crypto-error/crypto-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-error](./src/errors/crypto-error/crypto-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [constant-time-equal](./src/primitives/constant-time-equal/constant-time-equal.md) — <!-- begin:auto-docs --> _(no submodules)_- [constant-time-equal](./src/primitives/constant-time-equal/constant-time-equal.md) — <!-- begin:auto-docs --> _(no submodules)_- [random-bytes](./src/primitives/random-bytes/random-bytes.md) — <!-- begin:auto-docs --> _(no submodules)_- [random-bytes](./src/primitives/random-bytes/random-bytes.md) — <!-- begin:auto-docs --> _(no submodules)_- [zeroize](./src/primitives/zeroize/zeroize.md) — <!-- begin:auto-docs --> _(no submodules)_- [zeroize](./src/primitives/zeroize/zeroize.md) — <!-- begin:auto-docs --> _(no submodules)_- [sealed-box](./src/sealed-box/sealed-box.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-sealed-box-engine](./src/sealed-box/noble-sealed-box-engine/noble-sealed-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-sealed-box-engine](./src/sealed-box/noble-sealed-box-engine/noble-sealed-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [sealed-box](./src/sealed-box/sealed-box.md) — <!-- begin:auto-docs --> _(no submodules)_- [ecdsa-p256](./src/sign/ecdsa-p256/ecdsa-p256.md) — <!-- begin:auto-docs --> _(no submodules)_- [ecdsa-p256](./src/sign/ecdsa-p256/ecdsa-p256.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519](./src/sign/ed25519/ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519](./src/sign/ed25519/ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-sign-engine](./src/sign/noble-sign-engine/noble-sign-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-sign-engine](./src/sign/noble-sign-engine/noble-sign-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-aead-engine — <!-- beg…
 
 - [noble-aead-engine](./src/aead/noble-aead-engine/noble-aead-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-aead-engine](./src/aead/noble-aead-engine/noble-aead-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [aead](./src/aead/aead.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-aead-engine — <!-- beg…
@@ -54,6 +55,7 @@ Universal cryptographic primitives — engine-pluggable AEAD, Ed25519/ECDSA-P256
 - [codes](./src/errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-error](./src/errors/crypto-error/crypto-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-error](./src/errors/crypto-error/crypto-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [constant-time-equal](./src/primitives/constant-time-equal/constant-time-equal.md) — <!-- begin:auto-docs --> _(no submodules)_- [constant-time-equal](./src/primitives/constant-time-equal/constant-time-equal.md) — <!-- begin:auto-docs --> _(no submodules)_- [random-bytes](./src/primitives/random-bytes/random-bytes.md) — <!-- begin:auto-docs --> _(no submodules)_- [random-bytes](./src/primitives/random-bytes/random-bytes.md) — <!-- begin:auto-docs --> _(no submodules)_- [zeroize](./src/primitives/zeroize/zeroize.md) — <!-- begin:auto-docs --> _(no submodules)_- [zeroize](./src/primitives/zeroize/zeroize.md) — <!-- begin:auto-docs --> _(no submodules)_- [sealed-box](./src/sealed-box/sealed-box.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-sealed-box-engine — <!-- begin:auto-docs -->…
   - [noble-sealed-box-engine](./src/sealed-box/noble-sealed-box-engine/noble-sealed-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-sealed-box-engine](./src/sealed-box/noble-sealed-box-engine/noble-sealed-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [sealed-box](./src/sealed-box/sealed-box.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-sealed-box-engine — <!-- begin:auto-docs -->…
 - [ecdsa-p256](./src/sign/ecdsa-p256/ecdsa-p256.md) — <!-- begin:auto-docs --> _(no submodules)_- [ecdsa-p256](./src/sign/ecdsa-p256/ecdsa-p256.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519](./src/sign/ed25519/ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519](./src/sign/ed25519/ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-sign-engine](./src/sign/noble-sign-engine/noble-sign-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-sign-engine](./src/sign/noble-sign-engine/noble-sign-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-aead-engine](./src/aead/noble-aead-engine/noble-aead-engine.md) — <!-- begin:auto-docs --> _(no submodules)_  - [noble-aead-engine](./src/aead/noble-aead-engine/noble-aead-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [aead](./src/aead/aead.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-agree-engine](./src/agree/noble-agree-engine/noble-agree-engine.md) — <!-- begin:auto-docs --> _(no submodules)_  - [noble-agree-engine](./src/agree/noble-agree-engine/noble-agree-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519](./src/agree/x25519/x25519.md) — <!-- begin:auto-docs --> _(no submodules)_  - [x25519](./src/agree/x25519/x25519.md) — <!-- begin:auto-docs --> _(no submodules)_- [auth-box](./src/auth-box/auth-box.md) — <!-- begin:auto-docs --> _(no submodules)_  - [noble-auth-box-engine](./src/auth-box/noble-auth-box-engine/noble-auth-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_    - [noble-auth-box-engine](./src/auth-box/noble-auth-box-engine/noble-auth-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_  - [auth-box](./src/auth-box/auth-box.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_  - [codes](./src/errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-error](./src/errors/crypto-error/crypto-error.md) — <!-- begin:auto-docs --> _(no submodules)_  - [crypto-error](./src/errors/crypto-error/crypto-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [constant-time-equal](./src/primitives/constant-time-equal/constant-time-equal.md) — <!-- begin:auto-docs --> _(no submodules)_  - [constant-time-equal](./src/primitives/constant-time-equal/constant-time-equal.md) — <!-- begin:auto-docs --> _(no submodules)_- [random-bytes](./src/primitives/random-bytes/random-bytes.md) — <!-- begin:auto-docs --> _(no submodules)_  - [random-bytes](./src/primitives/random-bytes/random-bytes.md) — <!-- begin:auto-docs --> _(no submodules)_- [zeroize](./src/primitives/zeroize/zeroize.md) — <!-- begin:auto-docs --> _(no submodules)_  - [zeroize](./src/primitives/zeroize/zeroize.md) — <!-- begin:auto-docs --> _(no submodules)_- [sealed-box](./src/sealed-box/sealed-box.md) — <!-- begin:auto-docs --> _(no submodules)_  - [noble-sealed-box-engine](./src/sealed-box/noble-sealed-box-engine/noble-sealed-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_    - [noble-sealed-box-engine](./src/sealed-box/noble-sealed-box-engine/noble-sealed-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_  - [sealed-box](./src/sealed-box/sealed-box.md) — <!-- begin:auto-docs --> _(no submodules)_- [ecdsa-p256](./src/sign/ecdsa-p256/ecdsa-p256.md) — <!-- begin:auto-docs --> _(no submodules)_  - [ecdsa-p256](./src/sign/ecdsa-p256/ecdsa-p256.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519](./src/sign/ed25519/ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_  - [ed25519](./src/sign/ed25519/ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-sign-engine](./src/sign/noble-sign-engine/noble-sign-engine.md) — <!-- begin:auto-docs --> _(no submodules)_  - [noble-sign-engine](./src/sign/noble-sign-engine/noble-sign-engine.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Install
 
 ```bash

plugins/document-navigator/docs/security-stack/crypto/crypto-core/src/aead/aead.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [noble-aead-engine](./noble-aead-engine/noble-aead-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [aead](./aead.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-aead-engine — <!-- begin:auto-docs --> _(no su…
+- [noble-aead-engine](./noble-aead-engine/noble-aead-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [aead](./aead.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-aead-engine — <!-- begin:auto-docs --> _(no su…
 - [noble-aead-engine](./noble-aead-engine/noble-aead-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [aead](./aead.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-aead-engine](./noble-aead-engine/noble-aead-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [aead](./aead.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-aead-engine — <!-- beg…
 - [noble-aead-engine](./noble-aead-engine/noble-aead-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [aead](./aead.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-aead-engine — <!-- begin:auto-docs --> _(no s…
 - [noble-aead-engine](./noble-aead-engine/noble-aead-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [aead](./aead.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 Provides authenticated encryption with associated data (AEAD) facade functions backed by `@noble/ciphers`. AEAD combines confidentiality and integrity in a single operation — encrypted data includes an authentication tag that is verified before decryption, making it safe against ciphertext tampering. The facade is engine-pluggable: pass `{ engine }` to swap in a WebCrypto-backed or libsodium-backed implementation without changing calling code.

plugins/document-navigator/docs/security-stack/crypto/crypto-core/src/auth-box/auth-box.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [noble-auth-box-engine](./noble-auth-box-engine/noble-auth-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [auth-box](./auth-box.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-auth-box-engine — <!-- begin:auto-docs --> _(n…
+- [noble-auth-box-engine](./noble-auth-box-engine/noble-auth-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [auth-box](./auth-box.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-auth-box-engine — <!-- begin:auto-docs --> _(n…
 - [noble-auth-box-engine](./noble-auth-box-engine/noble-auth-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [auth-box](./auth-box.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-auth-box-engine](./noble-auth-box-engine/noble-auth-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [auth-box](./auth-box.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-auth-box-engine — <!--…
 - [noble-auth-box-engine](./noble-auth-box-engine/noble-auth-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [auth-box](./auth-box.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-auth-box-engine — <!-- begin:auto-docs --> _(…
 - [noble-auth-box-engine](./noble-auth-box-engine/noble-auth-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [auth-box](./auth-box.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 Provides authenticated sealed-box encryption following `crypto_box` semantics. Unlike the anonymous `sealedBox`, the auth-box binds the sender's identity to the ciphertext: the recipient can verify that only the holder of the sender's secret key could have produced it. The protocol uses X25519 ECDH key agreement, HKDF-SHA256 key derivation, and XChaCha20-Poly1305 encryption. Both parties must hold each other's public keys before communicating, making this suitable for protocols with established key exchange such as Signal-style messaging or server-to-server encryption.

plugins/document-navigator/docs/security-stack/crypto/crypto-core/src/sealed-box/sealed-box.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [noble-sealed-box-engine](./noble-sealed-box-engine/noble-sealed-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [sealed-box](./sealed-box.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-sealed-box-engine — <!-- begin:auto-docs --> _…
+- [noble-sealed-box-engine](./noble-sealed-box-engine/noble-sealed-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [sealed-box](./sealed-box.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-sealed-box-engine — <!-- begin:auto-docs --> _…
 - [noble-sealed-box-engine](./noble-sealed-box-engine/noble-sealed-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [sealed-box](./sealed-box.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-sealed-box-engine](./noble-sealed-box-engine/noble-sealed-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [sealed-box](./sealed-box.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-sealed-box-engine — <!…
 - [noble-sealed-box-engine](./noble-sealed-box-engine/noble-sealed-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [sealed-box](./sealed-box.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-sealed-box-engine — <!-- begin:auto-docs -->…
 - [noble-sealed-box-engine](./noble-sealed-box-engine/noble-sealed-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [sealed-box](./sealed-box.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 Provides anonymous-sender sealed-box encryption following `crypto_box_seal` semantics. The sender generates an ephemeral X25519 keypair, performs ECDH with the recipient's public key, derives a symmetric key via HKDF-SHA256, then encrypts with XChaCha20-Poly1305. The ephemeral public key is prepended to the ciphertext blob so the recipient can derive the same symmetric key without the sender needing to reveal their identity. This pattern is commonly used for one-way encrypted messages where sender anonymity is desired.

plugins/document-navigator/docs/security-stack/crypto/crypto-curve/src/primitives/ed25519/ed25519.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [ed25519.select](./ed25519.select/ed25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.native](./impl/ed25519.native/ed25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_  - [ed25519.native](./impl/ed25519.native/ed25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.noble](./impl/ed25519.noble/ed25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [ed25519.noble](./impl/ed25519.noble/ed25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519](./ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_- ed25519.select — <!-- begin:auto-docs --> _(no submo…
+- [ed25519.select](./ed25519.select/ed25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.native](./impl/ed25519.native/ed25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_  - [ed25519.native](./impl/ed25519.native/ed25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.noble](./impl/ed25519.noble/ed25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [ed25519.noble](./impl/ed25519.noble/ed25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519](./ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_- ed25519.select — <!-- begin:auto-docs --> _(no submo…
 - [ed25519.select](./ed25519.select/ed25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.native](./impl/ed25519.native/ed25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.native](./impl/ed25519.native/ed25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.noble](./impl/ed25519.noble/ed25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.noble](./impl/ed25519.noble/ed25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519](./ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.select](./ed25519.select/ed25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.native](./impl/ed25519.native/ed25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.native](./impl/ed25519.native/ed25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.noble](./impl/ed25519.noble/ed25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.noble](./impl/ed25519.noble/ed25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519](./ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_- ed25519.select — <!-- begin:…
 - [ed25519.select](./ed25519.select/ed25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.native](./impl/ed25519.native/ed25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.native](./impl/ed25519.native/ed25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.noble](./impl/ed25519.noble/ed25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.noble](./impl/ed25519.noble/ed25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519](./ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_- ed25519.select — <!-- begin:auto-docs --> _(no subm…
 - [ed25519.select](./ed25519.select/ed25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.native](./impl/ed25519.native/ed25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_  - [ed25519.native](./impl/ed25519.native/ed25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.noble](./impl/ed25519.noble/ed25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [ed25519.noble](./impl/ed25519.noble/ed25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519](./ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 Ed25519 is the Edwards-curve Digital Signature Algorithm defined in RFC 8032, the recommended signature scheme for new protocols. Compared with ECDSA it has deterministic signatures (no per-signature randomness needed), constant-time verification of well-formed inputs, small 32-byte public keys and 64-byte signatures, and formal soundness properties that make it the baseline choice for TLS, SSH, JWT signing, and peer-to-peer identity. This module exposes the primitive directly — key generation, signing, verification, and public-key derivation — as thin wrappers over `@noble/curves/ed25519`, with a paired `native` stub that throws `PrimitiveNotImplemented`. Selection between the two is controlled by `crypto.config.ts` at build time.

plugins/document-navigator/docs/security-stack/crypto/crypto-curve/src/primitives/p256/p256.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [p256.native](./impl/p256.native/p256.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.noble](./impl/p256.noble/p256.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p256.noble](./impl/p256.noble/p256.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.select](./p256.select/p256.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p256.select](./p256.select/p256.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256](./p256.md) — <!-- begin:auto-docs --> _(no submodules)_- p256.native — <!-- begin:auto-docs --> _(no submodul…
+- [p256.native](./impl/p256.native/p256.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.noble](./impl/p256.noble/p256.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p256.noble](./impl/p256.noble/p256.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.select](./p256.select/p256.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p256.select](./p256.select/p256.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256](./p256.md) — <!-- begin:auto-docs --> _(no submodules)_- p256.native — <!-- begin:auto-docs --> _(no submodul…
 - [p256.native](./impl/p256.native/p256.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.noble](./impl/p256.noble/p256.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.noble](./impl/p256.noble/p256.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.select](./p256.select/p256.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.select](./p256.select/p256.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256](./p256.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.native](./impl/p256.native/p256.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.noble](./impl/p256.noble/p256.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.noble](./impl/p256.noble/p256.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.select](./p256.select/p256.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.select](./p256.select/p256.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256](./p256.md) — <!-- begin:auto-docs --> _(no submodules)_- p256.native — <!-- begin:aut…
 - [p256.native](./impl/p256.native/p256.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.noble](./impl/p256.noble/p256.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.noble](./impl/p256.noble/p256.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.select](./p256.select/p256.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.select](./p256.select/p256.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256](./p256.md) — <!-- begin:auto-docs --> _(no submodules)_- p256.native — <!-- begin:auto-docs --> _(no submodu…
 - [p256.native](./impl/p256.native/p256.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.noble](./impl/p256.noble/p256.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p256.noble](./impl/p256.noble/p256.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.select](./p256.select/p256.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p256.select](./p256.select/p256.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256](./p256.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 `p256.ts` is the stable public entry point for the NIST P-256 elliptic-curve primitive in `@suaveplan/crypto-curve`. It re-exports everything from `p256.select.ts`, which forwards to either the Noble-backed or native implementation based on `crypto.config.ts`.

plugins/document-navigator/docs/security-stack/crypto/crypto-curve/src/primitives/p384/p384.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [p384.native](./impl/p384.native/p384.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.noble](./impl/p384.noble/p384.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p384.noble](./impl/p384.noble/p384.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.select](./p384.select/p384.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p384.select](./p384.select/p384.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384](./p384.md) — <!-- begin:auto-docs --> _(no submodules)_- p384.native — <!-- begin:auto-docs --> _(no submodul…
+- [p384.native](./impl/p384.native/p384.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.noble](./impl/p384.noble/p384.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p384.noble](./impl/p384.noble/p384.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.select](./p384.select/p384.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p384.select](./p384.select/p384.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384](./p384.md) — <!-- begin:auto-docs --> _(no submodules)_- p384.native — <!-- begin:auto-docs --> _(no submodul…
 - [p384.native](./impl/p384.native/p384.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.noble](./impl/p384.noble/p384.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.noble](./impl/p384.noble/p384.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.select](./p384.select/p384.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.select](./p384.select/p384.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384](./p384.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.native](./impl/p384.native/p384.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.noble](./impl/p384.noble/p384.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.noble](./impl/p384.noble/p384.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.select](./p384.select/p384.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.select](./p384.select/p384.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384](./p384.md) — <!-- begin:auto-docs --> _(no submodules)_- p384.native — <!-- begin:aut…
 - [p384.native](./impl/p384.native/p384.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.noble](./impl/p384.noble/p384.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.noble](./impl/p384.noble/p384.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.select](./p384.select/p384.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.select](./p384.select/p384.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384](./p384.md) — <!-- begin:auto-docs --> _(no submodules)_- p384.native — <!-- begin:auto-docs --> _(no submodu…
 - [p384.native](./impl/p384.native/p384.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.noble](./impl/p384.noble/p384.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p384.noble](./impl/p384.noble/p384.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.select](./p384.select/p384.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p384.select](./p384.select/p384.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384](./p384.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 `p384.ts` is the stable public entry point for the NIST P-384 elliptic-curve

plugins/document-navigator/docs/security-stack/crypto/crypto-curve/src/primitives/p521/p521.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [p521.native](./impl/p521.native/p521.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.noble](./impl/p521.noble/p521.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p521.noble](./impl/p521.noble/p521.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.select](./p521.select/p521.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p521.select](./p521.select/p521.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521](./p521.md) — <!-- begin:auto-docs --> _(no submodules)_- p521.native — <!-- begin:auto-docs --> _(no submodul…
+- [p521.native](./impl/p521.native/p521.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.noble](./impl/p521.noble/p521.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p521.noble](./impl/p521.noble/p521.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.select](./p521.select/p521.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p521.select](./p521.select/p521.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521](./p521.md) — <!-- begin:auto-docs --> _(no submodules)_- p521.native — <!-- begin:auto-docs --> _(no submodul…
 - [p521.native](./impl/p521.native/p521.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.noble](./impl/p521.noble/p521.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.noble](./impl/p521.noble/p521.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.select](./p521.select/p521.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.select](./p521.select/p521.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521](./p521.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.native](./impl/p521.native/p521.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.noble](./impl/p521.noble/p521.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.noble](./impl/p521.noble/p521.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.select](./p521.select/p521.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.select](./p521.select/p521.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521](./p521.md) — <!-- begin:auto-docs --> _(no submodules)_- p521.native — <!-- begin:aut…
 - [p521.native](./impl/p521.native/p521.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.noble](./impl/p521.noble/p521.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.noble](./impl/p521.noble/p521.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.select](./p521.select/p521.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.select](./p521.select/p521.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521](./p521.md) — <!-- begin:auto-docs --> _(no submodules)_- p521.native — <!-- begin:auto-docs --> _(no submodu…
 - [p521.native](./impl/p521.native/p521.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.noble](./impl/p521.noble/p521.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p521.noble](./impl/p521.noble/p521.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.select](./p521.select/p521.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p521.select](./p521.select/p521.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521](./p521.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 `p521.ts` is the stable public entry point for the NIST P-521 elliptic-curve

plugins/document-navigator/docs/security-stack/crypto/crypto-curve/src/primitives/secp256k1/secp256k1.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [secp256k1.native](./impl/secp256k1.native/secp256k1.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.noble](./impl/secp256k1.noble/secp256k1.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [secp256k1.noble](./impl/secp256k1.noble/secp256k1.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.select](./secp256k1.select/secp256k1.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [secp256k1.select](./secp256k1.select/secp256k1.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1](./secp256k1.md) — <!-- begin:auto-docs --> _(no submodules)_- secp256k1.native — <!-- begin:auto-docs --> _(no sub…
+- [secp256k1.native](./impl/secp256k1.native/secp256k1.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.noble](./impl/secp256k1.noble/secp256k1.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [secp256k1.noble](./impl/secp256k1.noble/secp256k1.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.select](./secp256k1.select/secp256k1.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [secp256k1.select](./secp256k1.select/secp256k1.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1](./secp256k1.md) — <!-- begin:auto-docs --> _(no submodules)_- secp256k1.native — <!-- begin:auto-docs --> _(no sub…
 - [secp256k1.native](./impl/secp256k1.native/secp256k1.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.noble](./impl/secp256k1.noble/secp256k1.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.noble](./impl/secp256k1.noble/secp256k1.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.select](./secp256k1.select/secp256k1.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.select](./secp256k1.select/secp256k1.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1](./secp256k1.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.native](./impl/secp256k1.native/secp256k1.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.noble](./impl/secp256k1.noble/secp256k1.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.noble](./impl/secp256k1.noble/secp256k1.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.select](./secp256k1.select/secp256k1.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.select](./secp256k1.select/secp256k1.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1](./secp256k1.md) — <!-- begin:auto-docs --> _(no submodules)_- secp256k1.native — <!-- begi…
 - [secp256k1.native](./impl/secp256k1.native/secp256k1.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.noble](./impl/secp256k1.noble/secp256k1.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.noble](./impl/secp256k1.noble/secp256k1.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.select](./secp256k1.select/secp256k1.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.select](./secp256k1.select/secp256k1.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1](./secp256k1.md) — <!-- begin:auto-docs --> _(no submodules)_- secp256k1.native — <!-- begin:auto-docs --> _(no su…
 - [secp256k1.native](./impl/secp256k1.native/secp256k1.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.noble](./impl/secp256k1.noble/secp256k1.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [secp256k1.noble](./impl/secp256k1.noble/secp256k1.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.select](./secp256k1.select/secp256k1.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [secp256k1.select](./secp256k1.select/secp256k1.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1](./secp256k1.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 `secp256k1.ts` is the stable public entry point for the secp256k1 elliptic-curve primitive in `@suaveplan/crypto-curve`. It re-exports everything from the generated selector file `secp256k1.select.ts`, which in turn forwards to either the Noble-backed or native implementation depending on `crypto.config.ts`.

plugins/document-navigator/docs/security-stack/crypto/crypto-curve/src/primitives/x25519/x25519.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [x25519.native](./impl/x25519.native/x25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.noble](./impl/x25519.noble/x25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [x25519.noble](./impl/x25519.noble/x25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.select](./x25519.select/x25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [x25519.select](./x25519.select/x25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519](./x25519.md) — <!-- begin:auto-docs --> _(no submodules)_- x25519.native — <!-- begin:auto-docs --> _(no submod…
+- [x25519.native](./impl/x25519.native/x25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.noble](./impl/x25519.noble/x25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [x25519.noble](./impl/x25519.noble/x25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.select](./x25519.select/x25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [x25519.select](./x25519.select/x25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519](./x25519.md) — <!-- begin:auto-docs --> _(no submodules)_- x25519.native — <!-- begin:auto-docs --> _(no submod…
 - [x25519.native](./impl/x25519.native/x25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.noble](./impl/x25519.noble/x25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.noble](./impl/x25519.noble/x25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.select](./x25519.select/x25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.select](./x25519.select/x25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519](./x25519.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.native](./impl/x25519.native/x25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.noble](./impl/x25519.noble/x25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.noble](./impl/x25519.noble/x25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.select](./x25519.select/x25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.select](./x25519.select/x25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519](./x25519.md) — <!-- begin:auto-docs --> _(no submodules)_- x25519.native — <!-- begin:a…
 - [x25519.native](./impl/x25519.native/x25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.noble](./impl/x25519.noble/x25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.noble](./impl/x25519.noble/x25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.select](./x25519.select/x25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.select](./x25519.select/x25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519](./x25519.md) — <!-- begin:auto-docs --> _(no submodules)_- x25519.native — <!-- begin:auto-docs --> _(no submo…
 - [x25519.native](./impl/x25519.native/x25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.noble](./impl/x25519.noble/x25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [x25519.noble](./impl/x25519.noble/x25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.select](./x25519.select/x25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [x25519.select](./x25519.select/x25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519](./x25519.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 `x25519.ts` is the stable public entry point for the X25519 elliptic-curve Diffie-Hellman primitive in `@suaveplan/crypto-curve`. It re-exports everything from `x25519.select.ts`, which forwards to either the Noble-backed or native implementation based on `crypto.config.ts`.

plugins/document-navigator/docs/security-stack/crypto/crypto-hash/src/primitives/blake2b/blake2b.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [blake2b.noble](./impl/blake2b.noble/blake2b.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [blake2b](./blake2b.md) — <!-- begin:auto-docs --> _(no submodules)_- blake2b.noble — <!-- begin:auto-docs --> _(no submod…
+- [blake2b.noble](./impl/blake2b.noble/blake2b.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [blake2b](./blake2b.md) — <!-- begin:auto-docs --> _(no submodules)_- blake2b.noble — <!-- begin:auto-docs --> _(no submod…
 - [blake2b.noble](./impl/blake2b.noble/blake2b.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [blake2b](./blake2b.md) — <!-- begin:auto-docs --> _(no submodules)_- [blake2b.noble](./impl/blake2b.noble/blake2b.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [blake2b](./blake2b.md) — <!-- begin:auto-docs --> _(no submodules)_- blake2b.noble — <!-- begin:a…
 - [blake2b.noble](./impl/blake2b.noble/blake2b.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [blake2b](./blake2b.md) — <!-- begin:auto-docs --> _(no submodules)_- blake2b.noble — <!-- begin:auto-docs --> _(no submo…
 - [blake2b.noble](./impl/blake2b.noble/blake2b.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [blake2b](./blake2b.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 `blake2b.ts` is the public entry point for the BLAKE2b hash primitive (RFC 7693) in `@suaveplan/crypto-hash`. BLAKE2b is a fast, secure cryptographic hash function used by Argon2, password-manager keystreams, blockchain-protocol commitments (Zcash, Polkadot), and many other modern protocols. The suaveplan implementation routes through the per-primitive selector layout (`blake2b.select.ts`) so the noble engine can be replaced without changing caller imports.

plugins/document-navigator/docs/security-stack/crypto/crypto-hash/src/primitives/scrypt/scrypt.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [scrypt.noble](./impl/scrypt.noble/scrypt.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [scrypt](./scrypt.md) — <!-- begin:auto-docs --> _(no submodules)_- scrypt.noble — <!-- begin:auto-docs --> _(no submodu…
+- [scrypt.noble](./impl/scrypt.noble/scrypt.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [scrypt](./scrypt.md) — <!-- begin:auto-docs --> _(no submodules)_- scrypt.noble — <!-- begin:auto-docs --> _(no submodu…
 - [scrypt.noble](./impl/scrypt.noble/scrypt.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [scrypt](./scrypt.md) — <!-- begin:auto-docs --> _(no submodules)_- [scrypt.noble](./impl/scrypt.noble/scrypt.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [scrypt](./scrypt.md) — <!-- begin:auto-docs --> _(no submodules)_- scrypt.noble — <!-- begin:au…
 - [scrypt.noble](./impl/scrypt.noble/scrypt.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [scrypt](./scrypt.md) — <!-- begin:auto-docs --> _(no submodules)_- scrypt.noble — <!-- begin:auto-docs --> _(no submod…
 - [scrypt.noble](./impl/scrypt.noble/scrypt.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [scrypt](./scrypt.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 `scrypt.ts` is the public entry point for the scrypt KDF (RFC 7914) primitive in `@suaveplan/crypto-hash`. scrypt is a memory-hard password-based key derivation function — its `N` parameter forces an attacker to allocate `N * r * 64` bytes of fast memory per guess, which makes brute-force attacks on hardware accelerators dramatically more expensive than they would be against PBKDF2 or even bcrypt. It is the right KDF when callers want stronger memory-hardness than PBKDF2 but cannot adopt Argon2id (e.g. cross-stack interop with older Bitcoin / Litecoin tooling, or compatibility with the standard library on platforms that ship scrypt natively).

plugins/document-navigator/docs/security-stack/crypto/crypto-keys/README.md

@@ -189,4 +189,3 @@ with a stable `CHAIN_KEYS.*` code. Verification failures don't throw;
 they return `{ valid: false, errors: [...] }` so callers can chain
 multiple verification attempts without try/catch. Only construction-time
 errors (e.g. an invalid `domainTag`) throw synchronously.
-

plugins/document-navigator/docs/security-stack/crypto/crypto-rsa/README.md

@@ -20,75 +20,77 @@ encrypt / decrypt / key-generation entry points, the engine adapter (`@noble/cur
 <!-- begin:auto-docs -->
 ## Documentation tree
 
-- [__benchmarks__](./src/__benchmarks__/blinded_vs_unblinded_2048.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
-  - [blinded_vs_unblinded_2048](./src/__benchmarks__/blinded_vs_unblinded_2048.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
-- [rsa-2048-key](./src/__fixtures__/rsa-2048-key.md) — Real 2048-bit RSA keypair generated once at module-load time and exposed as canonical `RsaPublicKey` / `RsaPrivateKey`…
-- [test-keys](./src/__fixtures__/test-keys.md) — Tiny synthetic RSA keypair for unit tests that need an `RsaPrivateKey` / `RsaPublicKey` shape but don't need to run a r…
-- [reader](./src/asn1/reader.md) — Strict-DER reader scoped to the RSA key shapes defined in RFC 8017 Appendix A (PKCS#1), RFC 5280 §4.1 + Appendix A (`Su…
-- [writer](./src/asn1/writer.md) — Strict-DER encoder mirroring `asn1/reader`. Encodes the same minimal subset of ASN.1 needed to serialise RSA keys in PK…
-- [blinding](./src/blinding/blinding.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
-  - [blinding](./src/blinding/blinding.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
-- [oaep](./src/decrypt/oaep.md) — RSAES-OAEP decryption per RFC 8017 §7.1.2 — counterpart to `encrypt/oaep`. Modern default for RSA public-key encryption.
-- [pkcs1v15](./src/decrypt/pkcs1v15.md) — RSAES-PKCS1-v1_5 decryption per RFC 8017 §7.2.2. Counterpart to `encrypt/pkcs1v15`. Provides legacy interop for protoco…
-- [emsa-pkcs1-v1_5](./src/encoding/emsa-pkcs1-v1_5.md) — Implements EMSA-PKCS1-v1\_5-ENCODE from RFC 8017 §9.2 — the encoding method underlying RSASSA-PKCS1-v1\_5 signatures. T…
-- [emsa-pss-encode](./src/encoding/emsa-pss-encode.md) — Implements the EMSA-PSS encoding operation defined in RFC 8017 §9.1.1. Given a message digest, an encoded-message bit l…
-- [emsa-pss-verify](./src/encoding/emsa-pss-verify.md) — Implements the EMSA-PSS verification operation defined in RFC 8017 §9.1.2. Given the message digest, the candidate enco…
-- [mgf1](./src/encoding/mgf1.md) — Implements the MGF1 mask-generation function defined in RFC 8017 §B.2.1. MGF1 is the building block used by EMSA-PSS an…
-- [default-rng](./src/encrypt/default-rng.md) — Single canonical adapter that lifts the `crypto.getRandomValues` CSPRNG into the `@suaveplan/types` `Rng` interface eve…
-- [oaep](./src/encrypt/oaep.md) — RSAES-OAEP encryption per RFC 8017 §7.1.1. The Optimal Asymmetric Encryption Padding (OAEP) scheme is the modern defaul…
-- [pkcs1v15](./src/encrypt/pkcs1v15.md) — RSAES-PKCS1-v1_5 encryption per RFC 8017 §7.2.1 — the legacy public-key encryption padding scheme historically used by…
-- [noble](./src/engine/noble.md) — Default `RsaCryptoEngine` backed by the pure-JS noble primitives this package ships natively. Provides the `name: "nobl…
-- [select](./src/engine/select.md) — Resolve the default `RsaCryptoEngine` for the host runtime. When `globalThis.crypto.subtle` exposes the RSA algorithms…
-- [subtle](./src/engine/subtle.md) — `RsaCryptoEngine` adapter over `globalThis.crypto.subtle`. When the host runtime exposes WebCrypto, this engine routes…
-- [errors](./src/errors/errors.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
-  - [errors](./src/errors/errors.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
-- [format](./src/fingerprint/format.md) — Render a fingerprint byte sequence as a human- and machine-readable string. Provides four output formats covering every…
-- [spki](./src/fingerprint/spki.md) — Compute a deterministic fingerprint of an RSA public key by hashing its SPKI DER encoding (RFC 5280 §4.1 `SubjectPublic…
-- [registry](./src/handle/registry.md) — Process-wide registry for RSA key-handle providers. Every HSM, KMS, OS keychain, or PKCS#11 bridge registers a provider…
-- [software](./src/handle/software.md) — Reference `RsaKeyHandleProvider` wrapping in-memory `RsaPrivateKey` values. Implements the same interface as a real HSM…
-- [thumbprint-uri](./src/jwk/thumbprint-uri.md) — Compute the JWK Thumbprint URI per RFC 9278 §3 — the canonical `urn:ietf:params:oauth:jwk-thumbprint:<hash-alg>:<base64…
-- [thumbprint](./src/jwk/thumbprint.md) — Compute the JWK Thumbprint of an RSA public key per RFC 7638 §3.2. The thumbprint is a deterministic hash over the cano…
-- [exponent](./src/keygen/exponent.md) — Public-exponent validation for RSA key generation. The `e`-only constraints (odd, `> 1`, `< 2^256`) live here so they c…
-- [generate](./src/keygen/generate.md) — RSA key-pair generation per NIST FIPS 186-5 Appendix A.1 and SP 800-56B Rev. 2 §6.3. Two-prime by default; multi-prime…
-- [miller-rabin](./src/keygen/miller-rabin.md) — Probable-prime test per NIST FIPS 186-5 Appendix B.3.1, used by `generateRsaKeyPair` to qualify candidate primes during…
-- [multi-prime](./src/keygen/multi-prime.md) — Multi-prime RSA key generation per RFC 8017 §3 and PKCS #1 Appendix A.1.2 `OtherPrimeInfos` extension. Reachable via th…
-- [jwk-policy](./src/keys/jwk-policy.md) — Cross-check a JWK's `key_ops`, `use`, and `alg` members against the requested operation per RFC 7517 §4.2 / §4.3 / §4.4…
-- [oid](./src/keys/oid.md) — Centralised OID constants for the RSA wire formats handled by this package. Currently exports `OID_RSA_ENCRYPTION` (`1.…
-- [parse-jwk](./src/keys/parse-jwk.md) — Parses RSA JWKs per RFC 7517 §6.3.1 (public) and §6.3.2 (private). Accepts the JWK as a plain JS object literal, as a J…
-- [parse-pkcs1-private](./src/keys/parse-pkcs1-private.md) — Parses a DER-encoded `RSAPrivateKey` per RFC 8017 Appendix A.1.2 into the canonical `RsaPrivateKey` shape with mandator…
-- [parse-pkcs1-public](./src/keys/parse-pkcs1-public.md) — Parses a DER-encoded `RSAPublicKey ::= SEQUENCE { modulus INTEGER, publicExponent INTEGER }` per RFC 8017 Appendix A.1.…
-- [parse-pkcs8](./src/keys/parse-pkcs8.md) — Parses a PKCS#8 `PrivateKeyInfo` per RFC 5208 §5 — also accepts the RFC 5958 `OneAsymmetricKey` shape, which adds optio…
-- [parse-spki](./src/keys/parse-spki.md) — Parses an X.509 `SubjectPublicKeyInfo` per RFC 5280 §4.1 + Appendix A and unwraps the inner PKCS#1 `RSAPublicKey`. SPKI…
-- [parse](./src/keys/parse.md) — Public dispatcher entry-point unifying the four key-format parsers (PKCS#1, SPKI, PKCS#8, JWK) under one ergonomic call…
-- [serialize-jwk](./src/keys/serialize-jwk.md) — Inverse of `parseRsaPublicKeyJwk` and `parseRsaPrivateKeyJwk`. Emits an `RsaJwk` with every numeric field encoded as ba…
-- [serialize-pkcs1-private](./src/keys/serialize-pkcs1-private.md) — Inverse of `parseRsaPrivateKeyPkcs1`. Emits a DER `RSAPrivateKey` SEQUENCE per RFC 8017 Appendix A.1.2 from a canonical…
-- [serialize-pkcs1-public](./src/keys/serialize-pkcs1-public.md) — Inverse of `parseRsaPublicKeyPkcs1`. Emits a DER `RSAPublicKey` SEQUENCE per RFC 8017 Appendix A.1.1 from a canonical `…
-- [serialize-pkcs8](./src/keys/serialize-pkcs8.md) — Inverse of `parseRsaPrivateKeyPkcs8`. Wraps a serialised PKCS#1 `RSAPrivateKey` in a DER `PrivateKeyInfo` per RFC 5208…
-- [serialize-spki](./src/keys/serialize-spki.md) — Inverse of `parseRsaPublicKeySpki`. Wraps a serialised PKCS#1 `RSAPublicKey` in a DER `SubjectPublicKeyInfo` per RFC 52…
-- [serialize](./src/keys/serialize.md) — Public dispatcher entry-point inverse of `parse`. Selects the per-format serialiser via the same `format` discriminator…
-- [crt](./src/math/crt.md) — RSA private-key operation via the Chinese Remainder Theorem (RFC 8017 §5.1.2, second-form algorithm). Computes `m = c^d…
-- [i2osp](./src/math/i2osp.md) — Integer-to-Octet-String Primitive (RFC 8017 §4.1). Encodes a non-negative integer as a fixed-length big-endian byte str…
-- [modpow](./src/math/modpow.md) — Single-source-of-truth modular exponentiation for the entire `@suaveplan/crypto-rsa` package. Wraps `@noble/curves/abst…
-- [os2ip](./src/math/os2ip.md) — Octet-String-to-Integer Primitive (RFC 8017 §4.2). Decodes a big-endian byte string into a non-negative `bigint`. Used…
-- [metrics](./src/observability/metrics.md) — OpenTelemetry meter + instrument registry for `@suaveplan/crypto-rsa`. defines the full instrument set the prop…
-- [timing](./src/observability/timing.md) — Centralised high-resolution clock source used by every metric histogram in `@suaveplan/crypto-rsa`. Resolves to `perfor…
-- [labels](./src/pem/labels.md) — Centralised PEM textual labels per RFC 7468 §5/§10/§11 used by the public and private PEM parsers and serialisers in th…
-- [parse-private](./src/pem/parse-private.md) — Parse an RSA private key from RFC 7468 PEM textual encoding. Accepts the two canonical private-key armor labels — `"PRI…
-- [parse-public](./src/pem/parse-public.md) — Parse an RSA public key from RFC 7468 PEM textual encoding. Accepts both canonical armor labels — `"PUBLIC KEY"` (SPKI…
-- [pem-codec](./src/pem/pem-codec.md) — Underlying RFC 7468 textual-encoding codec used by the four PEM parse/serialise entry points in this module. Splits the…
-- [serialize-private](./src/pem/serialize-private.md) — Inverse of `parseRsaPrivateKeyPem`. Emits PEM textual encoding for an RSA private key in either PKCS#8 (`"PRIVATE KEY"`…
-- [serialize-public](./src/pem/serialize-public.md) — Inverse of `parseRsaPublicKeyPem`. Emits PEM textual encoding for an RSA public key in either SPKI (`"PUBLIC KEY"`, the…
-- [policy](./src/policy/modulus.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
-  - [modulus](./src/policy/modulus.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
-- [profile](./src/profile/profile.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
-  - [profile](./src/profile/profile.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
-- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
-  - [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
-- [pkcs1v15](./src/sign/pkcs1v15.md) — RSASSA-PKCS1-v1\_5 signature generation per RFC 8017 §8.2.1. Hashes the message with the configured algorithm, applies…
-- [pss](./src/sign/pss.md) — RSASSA-PSS signature generation per RFC 8017 §8.1.1. Hashes the message, draws a random salt of the configured length,…
-- [pkcs1v15](./src/verify/pkcs1v15.md) — RSASSA-PKCS1-v1\_5 signature verification per RFC 8017 §8.2.2. Recovers the encoded message from `signature` via `s^e m…
-- [pss](./src/verify/pss.md) — RSASSA-PSS signature verification per RFC 8017 §8.1.2. Recovers the encoded message via `s^e mod n`, then runs the EMSA…
++ [__benchmarks__](./src/__benchmarks__/blinded_vs_unblinded_2048.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+  + [blinded_vs_unblinded_2048](./src/__benchmarks__/blinded_vs_unblinded_2048.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
++ [rsa-2048-key](./src/__fixtures__/rsa-2048-key.md) — Real 2048-bit RSA keypair generated once at module-load time and exposed as canonical `RsaPublicKey` / `RsaPrivateKey`…
++ [test-keys](./src/__fixtures__/test-keys.md) — Tiny synthetic RSA keypair for unit tests that need an `RsaPrivateKey` / `RsaPublicKey` shape but don't need to run a r…
++ [reader](./src/asn1/reader.md) — Strict-DER reader scoped to the RSA key shapes defined in RFC 8017 Appendix A (PKCS#1), RFC 5280 §4.1 + Appendix A (`Su…
++ [writer](./src/asn1/writer.md) — Strict-DER encoder mirroring `asn1/reader`. Encodes the same minimal subset of ASN.1 needed to serialise RSA keys in PK…
++ [blinding](./src/blinding/blinding.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+  + [blinding](./src/blinding/blinding.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
++ [oaep](./src/decrypt/oaep.md) — RSAES-OAEP decryption per RFC 8017 §7.1.2 — counterpart to `encrypt/oaep`. Modern default for RSA public-key encryption.
++ [pkcs1v15](./src/decrypt/pkcs1v15.md) — RSAES-PKCS1-v1_5 decryption per RFC 8017 §7.2.2. Counterpart to `encrypt/pkcs1v15`. Provides legacy interop for protoco…
++ [emsa-pkcs1-v1_5](./src/encoding/emsa-pkcs1-v1_5.md) — Implements EMSA-PKCS1-v1\_5-ENCODE from RFC 8017 §9.2 — the encoding method underlying RSASSA-PKCS1-v1\_5 signatures. T…
++ [emsa-pss-encode](./src/encoding/emsa-pss-encode.md) — Implements the EMSA-PSS encoding operation defined in RFC 8017 §9.1.1. Given a message digest, an encoded-message bit l…
++ [emsa-pss-verify](./src/encoding/emsa-pss-verify.md) — Implements the EMSA-PSS verification operation defined in RFC 8017 §9.1.2. Given the message digest, the candidate enco…
++ [mgf1](./src/encoding/mgf1.md) — Implements the MGF1 mask-generation function defined in RFC 8017 §B.2.1. MGF1 is the building block used by EMSA-PSS an…
++ [default-rng](./src/encrypt/default-rng.md) — Single canonical adapter that lifts the `crypto.getRandomValues` CSPRNG into the `@suaveplan/types` `Rng` interface eve…
++ [oaep](./src/encrypt/oaep.md) — RSAES-OAEP encryption per RFC 8017 §7.1.1. The Optimal Asymmetric Encryption Padding (OAEP) scheme is the modern defaul…
++ [pkcs1v15](./src/encrypt/pkcs1v15.md) — RSAES-PKCS1-v1_5 encryption per RFC 8017 §7.2.1 — the legacy public-key encryption padding scheme historically used by…
++ [noble](./src/engine/noble.md) — Default `RsaCryptoEngine` backed by the pure-JS noble primitives this package ships natively. Provides the `name: "nobl…
++ [select](./src/engine/select.md) — Resolve the default `RsaCryptoEngine` for the host runtime. When `globalThis.crypto.subtle` exposes the RSA algorithms…
++ [subtle](./src/engine/subtle.md) — `RsaCryptoEngine` adapter over `globalThis.crypto.subtle`. When the host runtime exposes WebCrypto, this engine routes…
++ [errors](./src/errors/errors.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+  + [errors](./src/errors/errors.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
++ [format](./src/fingerprint/format.md) — Render a fingerprint byte sequence as a human- and machine-readable string. Provides four output formats covering every…
++ [spki](./src/fingerprint/spki.md) — Compute a deterministic fingerprint of an RSA public key by hashing its SPKI DER encoding (RFC 5280 §4.1 `SubjectPublic…
++ [registry](./src/handle/registry.md) — Process-wide registry for RSA key-handle providers. Every HSM, KMS, OS keychain, or PKCS#11 bridge registers a provider…
++ [software](./src/handle/software.md) — Reference `RsaKeyHandleProvider` wrapping in-memory `RsaPrivateKey` values. Implements the same interface as a real HSM…
++ [thumbprint-uri](./src/jwk/thumbprint-uri.md) — Compute the JWK Thumbprint URI per RFC 9278 §3 — the canonical `urn:ietf:params:oauth:jwk-thumbprint:<hash-alg>:<base64…
++ [thumbprint](./src/jwk/thumbprint.md) — Compute the JWK Thumbprint of an RSA public key per RFC 7638 §3.2. The thumbprint is a deterministic hash over the cano…
++ [exponent](./src/keygen/exponent.md) — Public-exponent validation for RSA key generation. The `e`-only constraints (odd, `> 1`, `< 2^256`) live here so they c…
++ [generate](./src/keygen/generate.md) — RSA key-pair generation per NIST FIPS 186-5 Appendix A.1 and SP 800-56B Rev. 2 §6.3. Two-prime by default; multi-prime…
++ [miller-rabin](./src/keygen/miller-rabin.md) — Probable-prime test per NIST FIPS 186-5 Appendix B.3.1, used by `generateRsaKeyPair` to qualify candidate primes during…
++ [multi-prime](./src/keygen/multi-prime.md) — Multi-prime RSA key generation per RFC 8017 §3 and PKCS #1 Appendix A.1.2 `OtherPrimeInfos` extension. Reachable via th…
++ [jwk-policy](./src/keys/jwk-policy.md) — Cross-check a JWK's `key_ops`, `use`, and `alg` members against the requested operation per RFC 7517 §4.2 / §4.3 / §4.4…
++ [oid](./src/keys/oid.md) — Centralised OID constants for the RSA wire formats handled by this package. Currently exports `OID_RSA_ENCRYPTION` (`1.…
++ [parse-jwk](./src/keys/parse-jwk.md) — Parses RSA JWKs per RFC 7517 §6.3.1 (public) and §6.3.2 (private). Accepts the JWK as a plain JS object literal, as a J…
++ [parse-pkcs1-private](./src/keys/parse-pkcs1-private.md) — Parses a DER-encoded `RSAPrivateKey` per RFC 8017 Appendix A.1.2 into the canonical `RsaPrivateKey` shape with mandator…
++ [parse-pkcs1-public](./src/keys/parse-pkcs1-public.md) — Parses a DER-encoded `RSAPublicKey ::= SEQUENCE { modulus INTEGER, publicExponent INTEGER }` per RFC 8017 Appendix A.1.…
++ [parse-pkcs8](./src/keys/parse-pkcs8.md) — Parses a PKCS#8 `PrivateKeyInfo` per RFC 5208 §5 — also accepts the RFC 5958 `OneAsymmetricKey` shape, which adds optio…
++ [parse-spki](./src/keys/parse-spki.md) — Parses an X.509 `SubjectPublicKeyInfo` per RFC 5280 §4.1 + Appendix A and unwraps the inner PKCS#1 `RSAPublicKey`. SPKI…
++ [parse](./src/keys/parse.md) — Public dispatcher entry-point unifying the four key-format parsers (PKCS#1, SPKI, PKCS#8, JWK) under one ergonomic call…
++ [serialize-jwk](./src/keys/serialize-jwk.md) — Inverse of `parseRsaPublicKeyJwk` and `parseRsaPrivateKeyJwk`. Emits an `RsaJwk` with every numeric field encoded as ba…
++ [serialize-pkcs1-private](./src/keys/serialize-pkcs1-private.md) — Inverse of `parseRsaPrivateKeyPkcs1`. Emits a DER `RSAPrivateKey` SEQUENCE per RFC 8017 Appendix A.1.2 from a canonical…
++ [serialize-pkcs1-public](./src/keys/serialize-pkcs1-public.md) — Inverse of `parseRsaPublicKeyPkcs1`. Emits a DER `RSAPublicKey` SEQUENCE per RFC 8017 Appendix A.1.1 from a canonical `…
++ [serialize-pkcs8](./src/keys/serialize-pkcs8.md) — Inverse of `parseRsaPrivateKeyPkcs8`. Wraps a serialised PKCS#1 `RSAPrivateKey` in a DER `PrivateKeyInfo` per RFC 5208…
++ [serialize-spki](./src/keys/serialize-spki.md) — Inverse of `parseRsaPublicKeySpki`. Wraps a serialised PKCS#1 `RSAPublicKey` in a DER `SubjectPublicKeyInfo` per RFC 52…
++ [serialize](./src/keys/serialize.md) — Public dispatcher entry-point inverse of `parse`. Selects the per-format serialiser via the same `format` discriminator…
++ [crt](./src/math/crt.md) — RSA private-key operation via the Chinese Remainder Theorem (RFC 8017 §5.1.2, second-form algorithm). Computes `m = c^d…
++ [i2osp](./src/math/i2osp.md) — Integer-to-Octet-String Primitive (RFC 8017 §4.1). Encodes a non-negative integer as a fixed-length big-endian byte str…
++ [modpow](./src/math/modpow.md) — Single-source-of-truth modular exponentiation for the entire `@suaveplan/crypto-rsa` package. Wraps `@noble/curves/abst…
++ [os2ip](./src/math/os2ip.md) — Octet-String-to-Integer Primitive (RFC 8017 §4.2). Decodes a big-endian byte string into a non-negative `bigint`. Used…
++ [metrics](./src/observability/metrics.md) — OpenTelemetry meter + instrument registry for `@suaveplan/crypto-rsa`. defines the full instrument set the prop…
++ [timing](./src/observability/timing.md) — Centralised high-resolution clock source used by every metric histogram in `@suaveplan/crypto-rsa`. Resolves to `perfor…
++ [labels](./src/pem/labels.md) — Centralised PEM textual labels per RFC 7468 §5/§10/§11 used by the public and private PEM parsers and serialisers in th…
++ [parse-private](./src/pem/parse-private.md) — Parse an RSA private key from RFC 7468 PEM textual encoding. Accepts the two canonical private-key armor labels — `"PRI…
++ [parse-public](./src/pem/parse-public.md) — Parse an RSA public key from RFC 7468 PEM textual encoding. Accepts both canonical armor labels — `"PUBLIC KEY"` (SPKI…
++ [pem-codec](./src/pem/pem-codec.md) — Underlying RFC 7468 textual-encoding codec used by the four PEM parse/serialise entry points in this module. Splits the…
++ [serialize-private](./src/pem/serialize-private.md) — Inverse of `parseRsaPrivateKeyPem`. Emits PEM textual encoding for an RSA private key in either PKCS#8 (`"PRIVATE KEY"`…
++ [serialize-public](./src/pem/serialize-public.md) — Inverse of `parseRsaPublicKeyPem`. Emits PEM textual encoding for an RSA public key in either SPKI (`"PUBLIC KEY"`, the…
++ [policy](./src/policy/modulus.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+  + [modulus](./src/policy/modulus.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
++ [profile](./src/profile/profile.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+  + [profile](./src/profile/profile.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
++ [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+  + [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
++ [pkcs1v15](./src/sign/pkcs1v15.md) — RSASSA-PKCS1-v1\_5 signature generation per RFC 8017 §8.2.1. Hashes the message with the configured algorithm, applies…
++ [pss](./src/sign/pss.md) — RSASSA-PSS signature generation per RFC 8017 §8.1.1. Hashes the message, draws a random salt of the configured length,…
++ [pkcs1v15](./src/verify/pkcs1v15.md) — RSASSA-PKCS1-v1\_5 signature verification per RFC 8017 §8.2.2. Recovers the encoded message from `signature` via `s^e m…
++ [pss](./src/verify/pss.md) — RSASSA-PSS signature verification per RFC 8017 §8.1.2. Recovers the encoded message via `s^e mod n`, then runs the EMSA…
+
 <!-- end:auto-docs -->  + [blinded_vs_unblinded_2048](./src/__benchmarks__/blinded_vs_unblinded_2048.md) — <!-- begin:auto-docs --> _(no submodules)_+ [rsa-2048-key](./src/__fixtures__/rsa-2048-key.md) — Real 2048-bit RSA keypair generated once at module-load time and exposed as canonical `RsaPublicKey` / `RsaPrivateKey`…
+
 + [test-keys](./src/__fixtures__/test-keys.md) — Tiny synthetic RSA keypair for unit tests that need an `RsaPrivateKey` / `RsaPublicKey` shape but don't need to run a r…
 + [reader](./src/asn1/reader.md) — Strict-DER reader scoped to the RSA key shapes defined in RFC 8017 Appendix A (PKCS#1), RFC 5280 §4.1 + Appendix A (`Su…
 + [writer](./src/asn1/writer.md) — Strict-DER encoder mirroring `asn1/reader`. Encodes the same minimal subset of ASN.1 needed to serialise RSA keys in PK…
@@ -461,4 +463,3 @@ const v = modPow(c, publicKey.e, publicKey.n); // public op
 ## License
 
 MIT
-

plugins/document-navigator/docs/security-stack/crypto/crypto-vault/README.md

@@ -39,7 +39,9 @@ instances that zeroize on lock.
   - [twoskd](./src/twoskd/twoskd.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
 - [types](./src/types/types.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
   - [types](./src/types/types.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+
 <!-- end:auto-docs -->  - [argon2id](./src/argon2id/argon2id.md) — <!-- begin:auto-docs --> _(no submodules)_- [bip39](./src/bip39/bip39.md) — <!-- begin:auto-docs --> _(no submodules)_- [bip39](./src/bip39/bip39.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes.md) — `codes.ts` is the canonical, frozen registry of every error code emitted by `@suaveplan/crypto-vault`. The registry exi…
+
 - [crypto-vault-error](./src/errors/crypto-vault-error.md) — `CryptoVaultError` is the umbrella error class for `@suaveplan/crypto-vault`. Every failure mode in the package — inval…
 - [handle](./src/handle/opaque-handle.md) — <!-- begin:auto-docs --> _(no submodules)_- [opaque-handle](./src/handle/opaque-handle.md) — <!-- begin:auto-docs --> _(no submodules)_- [hd-key](./src/hd-key/hd-key.md) — <!-- begin:auto-docs --> _(no submodules)_- [hd-key](./src/hd-key/hd-key.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-hierarchy](./src/key-hierarchy/key-hierarchy.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-hierarchy](./src/key-hierarchy/key-hierarchy.md) — <!-- begin:auto-docs --> _(no submodules)_- [otel](./src/otel/instruments.md) — <!-- begin:auto-docs --> _(no submodules)_- [instruments](./src/otel/instruments.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [secure](./src/secure/secure-buffer.md) — <!-- begin:auto-docs --> _(no submodules)_- [secure-buffer](./src/secure/secure-buffer.md) — <!-- begin:auto-docs --> _(no submodules)_- [srp-client](./src/srp/srp-client.md) — `srp-client.ts` implements the client side of the SRP-6a zero-knowledge password-authenticated key exchange per RFC 505…
 - [srp-group](./src/srp/srp-group.md) — `srp-group.ts` exports the canonical 2048-bit MODP group from RFC 5054 Appendix A as `bigint` constants. The SRP-6a cli…
@@ -56,6 +58,7 @@ instances that zeroize on lock.
 - [handle](./src/handle/opaque-handle.md) — <!-- begin:auto-docs --> _(no submodules)_  - [opaque-handle](./src/handle/opaque-handle.md) — <!-- begin:auto-docs --> _(no submodules)_- [hd-key](./src/hd-key/hd-key.md) — <!-- begin:auto-docs --> _(no submodules)_  - [hd-key](./src/hd-key/hd-key.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-hierarchy](./src/key-hierarchy/key-hierarchy.md) — <!-- begin:auto-docs --> _(no submodules)_  - [key-hierarchy](./src/key-hierarchy/key-hierarchy.md) — <!-- begin:auto-docs --> _(no submodules)_- [otel](./src/otel/instruments.md) — <!-- begin:auto-docs --> _(no submodules)_  - [instruments](./src/otel/instruments.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_  - [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [secure](./src/secure/secure-buffer.md) — <!-- begin:auto-docs --> _(no submodules)_  - [secure-buffer](./src/secure/secure-buffer.md) — <!-- begin:auto-docs --> _(no submodules)_- [srp-client](./src/srp/srp-client.md) — `srp-client.ts` implements the client side of the SRP-6a zero-knowledge password-authenticated key exchange per RFC 505…
 - [srp-group](./src/srp/srp-group.md) — `srp-group.ts` exports the canonical 2048-bit MODP group from RFC 5054 Appendix A as `bigint` constants. The SRP-6a cli…
 - [twoskd](./src/twoskd/twoskd.md) — <!-- begin:auto-docs --> _(no submodules)_  - [twoskd](./src/twoskd/twoskd.md) — <!-- begin:auto-docs --> _(no submodules)_- [types](./src/types/types.md) — <!-- begin:auto-docs --> _(no submodules)_  - [types](./src/types/types.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Install
 
 ```bash
@@ -150,4 +153,3 @@ console.log(wrapped.isClosed); // true
 ## License
 
 MIT
-

plugins/document-navigator/docs/security-stack/crypto/crypto-vault/src/orchestration/orchestration.md

@@ -96,7 +96,7 @@ console.log(decoded["sign"].publicKey === server2.publicKeys["sign"].publicKey);
   `Promise<ServerKeysResult>`. Deterministically derives a child master via
   `HMAC-SHA512(rootMaster, u32be(version))` truncated to 32 bytes. Throws
   `CryptoVaultError(CRYPTOVAULT.ORCHESTRATION.INVALID_VERSION)` on negative or
-  non-integer `version`. Public-key file is signed by the *root* sign slot.
+  non-integer `version`. Public-key file is signed by the _root_ sign slot.
 - `rollServerKeys(rootKeys, currentVersion, serverPassword, options?)` →
   `Promise<ServerKeysResult>`. Returns a result at `version = currentVersion + 1`.
   Throws the same `INVALID_VERSION` error on negative `currentVersion`.

plugins/document-navigator/docs/security-stack/crypto/crypto/README.md

@@ -57,7 +57,9 @@ Universal cryptographic primitives — engine-pluggable AEAD, Ed25519/ECDSA-P256
   - [trust-anchor](./src/trust-anchors/trust-anchor.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
 - [mnemonic](./src/vault/mnemonic/mnemonic.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
   - [mnemonic](./src/vault/mnemonic/mnemonic.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+
 <!-- end:auto-docs -->  - [authority](./src/authority/authority.md) — <!-- begin:auto-docs --> _(no submodules)_- [chain-bundle](./src/bundles/chain-bundle/chain-bundle.md) — <!-- begin:auto-docs --> _(no submodules)_- [chain-bundle](./src/bundles/chain-bundle/chain-bundle.md) — <!-- begin:auto-docs --> _(no submodules)_- [public-bundle](./src/bundles/public-bundle/public-bundle.md) — <!-- begin:auto-docs --> _(no submodules)_- [public-bundle](./src/bundles/public-bundle/public-bundle.md) — <!-- begin:auto-docs --> _(no submodules)_- [coordinate](./src/derivation/coordinate/coordinate.md) — <!-- begin:auto-docs --> _(no submodules)_- [coordinate](./src/derivation/coordinate/coordinate.md) — <!-- begin:auto-docs --> _(no submodules)_- [layouts](./src/derivation/layouts/layouts.md) — <!-- begin:auto-docs --> _(no submodules)_- [layouts](./src/derivation/layouts/layouts.md) — <!-- begin:auto-docs --> _(no submodules)_- [purposes](./src/derivation/purposes/purposes.md) — <!-- begin:auto-docs --> _(no submodules)_- [purposes](./src/derivation/purposes/purposes.md) — <!-- begin:auto-docs --> _(no submodules)_- [domain-tags](./src/domain-tags/domain-tags.md) — <!-- begin:auto-docs --> _(no submodules)_- [domain-tags](./src/domain-tags/domain-tags.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-error](./src/errors/crypto-error/crypto-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-error](./src/errors/crypto-error/crypto-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/keys-errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/keys-errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-keys-error](./src/errors/keys-errors/crypto-keys-error/crypto-keys-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-keys-error](./src/errors/keys-errors/crypto-keys-error/crypto-keys-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/vault-errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/vault-errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-vault-error](./src/errors/vault-errors/crypto-vault-error/crypto-vault-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-vault-error](./src/errors/vault-errors/crypto-vault-error/crypto-vault-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [keychain](./src/keychain/keychain.md) — <!-- begin:auto-docs --> _(no submodules)_- [algorithms](./src/keychain/algorithms/algorithms.md) — <!-- begin:auto-docs --> _(no submodules)_- [algorithms](./src/keychain/algorithms/algorithms.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./src/keychain/key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./src/keychain/key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./src/keychain/keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./src/keychain/keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./src/keychain/keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./src/keychain/keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./src/keychain/storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./src/keychain/storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./src/keychain/storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./src/keychain/storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./src/keychain/validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./src/keychain/validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [keychain](./src/keychain/keychain.md) — <!-- begin:auto-docs --> _(no submodules)_- [derive-key-from-password](./src/password/derive-key-from-password.md) — `derive-key-from-password.ts` is the low-level password-to-key derivation helper in `@suaveplan/crypto`. It accepts a p…
+
 - [encrypt-with-password](./src/password/encrypt-with-password.md) — `encrypt-with-password.ts` is the high-level password-based encryption helper in `@suaveplan/crypto`. It accepts a pass…
 - [trust-anchors](./src/trust-anchors/trust-anchor.md) — <!-- begin:auto-docs --> _(no submodules)_- [trust-anchor](./src/trust-anchors/trust-anchor.md) — <!-- begin:auto-docs --> _(no submodules)_- [mnemonic](./src/vault/mnemonic/mnemonic.md) — <!-- begin:auto-docs --> _(no submodules)_- [mnemonic](./src/vault/mnemonic/mnemonic.md) — <!-- begin:auto-docs --> _(no submodules)_- [authority](./src/authority/authority.md) — <!-- begin:auto-docs --> _(no submodules)_- [chain-bundle](./src/bundles/chain-bundle/chain-bundle.md) — <!-- begin:auto-docs --> _(no submodules)_- [chain-bundle](./src/bundles/chain-bundle/chain-bundle.md) — <!-- begin:auto-docs --> _(no submodules)_- [public-bundle](./src/bundles/public-bundle/public-bundle.md) — <!-- begin:auto-docs --> _(no submodules)_- [public-bundle](./src/bundles/public-bundle/public-bundle.md) — <!-- begin:auto-docs --> _(no submodules)_- [coordinate](./src/derivation/coordinate/coordinate.md) — <!-- begin:auto-docs --> _(no submodules)_- [coordinate](./src/derivation/coordinate/coordinate.md) — <!-- begin:auto-docs --> _(no submodules)_- [layouts](./src/derivation/layouts/layouts.md) — <!-- begin:auto-docs --> _(no submodules)_- [layouts](./src/derivation/layouts/layouts.md) — <!-- begin:auto-docs --> _(no submodules)_- [purposes](./src/derivation/purposes/purposes.md) — <!-- begin:auto-docs --> _(no submodules)_- [purposes](./src/derivation/purposes/purposes.md) — <!-- begin:auto-docs --> _(no submodules)_- [domain-tags](./src/domain-tags/domain-tags.md) — <!-- begin:auto-docs --> _(no submodules)_- [domain-tags](./src/domain-tags/domain-tags.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-error](./src/errors/crypto-error/crypto-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-error](./src/errors/crypto-error/crypto-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/keys-errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/keys-errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-keys-error](./src/errors/keys-errors/crypto-keys-error/crypto-keys-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-keys-error](./src/errors/keys-errors/crypto-keys-error/crypto-keys-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/vault-errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/vault-errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-vault-error](./src/errors/vault-errors/crypto-vault-error/crypto-vault-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-vault-error](./src/errors/vault-errors/crypto-vault-error/crypto-vault-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [keychain](./src/keychain/keychain.md) — <!-- begin:auto-docs --> _(no submodules)_- algorithms — <!-- begin:auto…
   - [algorithms](./src/keychain/algorithms/algorithms.md) — <!-- begin:auto-docs --> _(no submodules)_- [algorithms](./src/keychain/algorithms/algorithms.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./src/keychain/key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./src/keychain/key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./src/keychain/keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./src/keychain/keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./src/keychain/keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./src/keychain/keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./src/keychain/storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./src/keychain/storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./src/keychain/storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./src/keychain/storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./src/keychain/validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./src/keychain/validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [keychain](./src/keychain/keychain.md) — <!-- begin:auto-docs --> _(no submodules)_- algorithms — <!-- begin:auto…
@@ -70,6 +72,7 @@ Universal cryptographic primitives — engine-pluggable AEAD, Ed25519/ECDSA-P256
 - [trust-anchors](./src/trust-anchors/trust-anchor.md) — <!-- begin:auto-docs --> _(no submodules)_- [trust-anchor](./src/trust-anchors/trust-anchor.md) — <!-- begin:auto-docs --> _(no submodules)_- [mnemonic](./src/vault/mnemonic/mnemonic.md) — <!-- begin:auto-docs --> _(no submodules)_- [mnemonic](./src/vault/mnemonic/mnemonic.md) — <!-- begin:auto-docs --> _(no submodules)_- [authority](./src/authority/authority.md) — <!-- begin:auto-docs --> _(no submodules)_- [chain-bundle](./src/bundles/chain-bundle/chain-bundle.md) — <!-- begin:auto-docs --> _(no submodules)_  - [chain-bundle](./src/bundles/chain-bundle/chain-bundle.md) — <!-- begin:auto-docs --> _(no submodules)_- [public-bundle](./src/bundles/public-bundle/public-bundle.md) — <!-- begin:auto-docs --> _(no submodules)_  - [public-bundle](./src/bundles/public-bundle/public-bundle.md) — <!-- begin:auto-docs --> _(no submodules)_- [coordinate](./src/derivation/coordinate/coordinate.md) — <!-- begin:auto-docs --> _(no submodules)_  - [coordinate](./src/derivation/coordinate/coordinate.md) — <!-- begin:auto-docs --> _(no submodules)_- [layouts](./src/derivation/layouts/layouts.md) — <!-- begin:auto-docs --> _(no submodules)_  - [layouts](./src/derivation/layouts/layouts.md) — <!-- begin:auto-docs --> _(no submodules)_- [purposes](./src/derivation/purposes/purposes.md) — <!-- begin:auto-docs --> _(no submodules)_  - [purposes](./src/derivation/purposes/purposes.md) — <!-- begin:auto-docs --> _(no submodules)_- [domain-tags](./src/domain-tags/domain-tags.md) — <!-- begin:auto-docs --> _(no submodules)_  - [domain-tags](./src/domain-tags/domain-tags.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_  - [codes](./src/errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-error](./src/errors/crypto-error/crypto-error.md) — <!-- begin:auto-docs --> _(no submodules)_  - [crypto-error](./src/errors/crypto-error/crypto-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/keys-errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_  - [codes](./src/errors/keys-errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-keys-error](./src/errors/keys-errors/crypto-keys-error/crypto-keys-error.md) — <!-- begin:auto-docs --> _(no submodules)_  - [crypto-keys-error](./src/errors/keys-errors/crypto-keys-error/crypto-keys-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/vault-errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_  - [codes](./src/errors/vault-errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-vault-error](./src/errors/vault-errors/crypto-vault-error/crypto-vault-error.md) — <!-- begin:auto-docs --> _(no submodules)_  - [crypto-vault-error](./src/errors/vault-errors/crypto-vault-error/crypto-vault-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [keychain](./src/keychain/keychain.md) — <!-- begin:auto-docs --> _(no submodules)_  - [algorithms](./src/keychain/algorithms/algorithms.md) — <!-- begin:auto-docs --> _(no submodules)_    - [algorithms](./src/keychain/algorithms/algorithms.md) — <!-- begin:auto-docs --> _(no submodules)_  - [key-slot](./src/keychain/key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_    - [key-slot](./src/keychain/key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_  - [generate](./src/keychain/keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_    - [generate](./src/keychain/keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_  - [validate](./src/keychain/keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_    - [validate](./src/keychain/keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_  - [memory](./src/keychain/storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_    - [memory](./src/keychain/storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_  - [serialized](./src/keychain/storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_    - [serialized](./src/keychain/storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_  - [validity](./src/keychain/validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_    - [validity](./src/keychain/validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_  - [keychain](./src/keychain/keychain.md) — <!-- begin:auto-docs --> _(no submodules)_- [derive-key-from-password](./src/password/derive-key-from-password.md) — `derive-key-from-password.ts` is the low-level password-to-key derivation helper in `@suaveplan/crypto`. It accepts a p…
 - [encrypt-with-password](./src/password/encrypt-with-password.md) — `encrypt-with-password.ts` is the high-level password-based encryption helper in `@suaveplan/crypto`. It accepts a pass…
 - [trust-anchors](./src/trust-anchors/trust-anchor.md) — <!-- begin:auto-docs --> _(no submodules)_  - [trust-anchor](./src/trust-anchors/trust-anchor.md) — <!-- begin:auto-docs --> _(no submodules)_- [mnemonic](./src/vault/mnemonic/mnemonic.md) — <!-- begin:auto-docs --> _(no submodules)_  - [mnemonic](./src/vault/mnemonic/mnemonic.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Install
 
 ```bash
@@ -213,4 +216,3 @@ import { CryptoError, CRYPTO_CODES } from "@suaveplan/crypto/errors";
 ```bash
 bunx turbo lint typecheck test:coverage --filter=@suaveplan/crypto
 ```
-

plugins/document-navigator/docs/security-stack/crypto/crypto/src/keychain/keychain.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [algorithms](./algorithms/algorithms.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_  - [key-slot](./key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_  - [generate](./keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_  - [validate](./keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_  - [memory](./storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_  - [serialized](./storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_  - [validity](./validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [keychain](./keychain.md) — <!-- begin:auto-docs --> _(no submodules)_- algorithms — <!-- begin:auto-docs --> _(no submodule…
+- [algorithms](./algorithms/algorithms.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_  - [key-slot](./key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_  - [generate](./keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_  - [validate](./keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_  - [memory](./storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_  - [serialized](./storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_  - [validity](./validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [keychain](./keychain.md) — <!-- begin:auto-docs --> _(no submodules)_- algorithms — <!-- begin:auto-docs --> _(no submodule…
 - [algorithms](./algorithms/algorithms.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [keychain](./keychain.md) — <!-- begin:auto-docs --> _(no submodules)_- [algorithms](./algorithms/algorithms.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [keychain](./keychain.md) — <!-- begin:auto-docs --> _(no submodules)_- algorithms — <!-- begin:auto…
 - [algorithms](./algorithms/algorithms.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [keychain](./keychain.md) — <!-- begin:auto-docs --> _(no submodules)_- algorithms — <!-- begin:auto-docs --> _(no submodul…
 - [algorithms](./algorithms/algorithms.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_  - [key-slot](./key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_  - [generate](./keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_  - [validate](./keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_  - [memory](./storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_  - [serialized](./storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_  - [validity](./validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [keychain](./keychain.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 A `Keychain` is the typed, eight-slot identity bundle for a single application instance. It encodes every cryptographic role a real system needs — master derivation, encryption, signing, key-agreement, salting, hashing, streaming, and device identity — under one coherent versioned address. This is the central artifact of the package: vaults serialise it, public bundles distribute its public projection, the Authority interface signs _through_ its slots, and every higher-level operation (Packer envelopes, chain traversal, audit log) ultimately resolves back to a slot in some keychain.

plugins/document-navigator/docs/security-stack/security/hibp/README.md

@@ -36,10 +36,12 @@ required runtime primitive is `fetch`.
 - [paste.schema](./src/schemas/paste.schema.md) — `PasteSchema` validates the HIBP v3 `Paste` payload returned by `/pasteaccount/{email}`. Older paste records can omit `…
 - [pwned-result.schema](./src/schemas/pwned-result.schema.md) — `PwnedResultSchema` validates the runtime shape of every `checkPassword` result. It is the final boundary between the i…
 - [error-codes](./src/error-codes.md) — Hosts the canonical `HIBP_CODES` registry — exactly seven error codes that classify every failure path inside `@suavepl…
+
 <!-- end:auto-docs --> - lru — `LruHibpCache<V>` is the default cache for `H…
-  - [cache](./src/cache/cache.md) — <!-- begin:auto-docs --> _(no submodules)_- lru — `LruHibpCache<V>` is the default cache for `H…
-  - [lru](./src/cache/lru.md) — `LruHibpCache<V>` is the default cache for `HibpClient`. It holds up to `LRU_DEFAULT_CAPACITY` entries (10 000) with `L…
-  - [null](./src/cache/null.md) — `NullHibpCache<V>` is the always-miss adapter used by `HibpClient` when the caller explicitly opts out of caching (`cac…
+
+- [cache](./src/cache/cache.md) — <!-- begin:auto-docs --> _(no submodules)_- lru — `LruHibpCache<V>` is the default cache for `H…
+- [lru](./src/cache/lru.md) — `LruHibpCache<V>` is the default cache for `HibpClient`. It holds up to `LRU_DEFAULT_CAPACITY` entries (10 000) with `L…
+- [null](./src/cache/null.md) — `NullHibpCache<V>` is the always-miss adapter used by `HibpClient` when the caller explicitly opts out of caching (`cac…
 - [client](./src/client/client.md) — <!-- begin:auto-docs --> _(no submodules)_- options.schema — `HibpClientOptionsSchema` is the Z…
   - [client](./src/client/client.md) — <!-- begin:auto-docs --> _(no submodules)_- options.schema — `HibpClientOptionsSchema` is the Z…
   - [options.schema](./src/client/options.schema.md) — `HibpClientOptionsSchema` is the Zod boundary for the `HibpClient` constructor. It is `.strict()` — unknown keys cause…
@@ -219,4 +221,3 @@ Run with `bun run benchmark` (see `src/__benchmarks__/`).
 ## License
 
 MIT
-

plugins/document-navigator/docs/security-stack/security/hibp/src/cache/cache.md

@@ -3,6 +3,7 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs --> - lru — `LruHibpCache<V>` is the default cache for `H…
+
 - [lru](./lru.md) — `LruHibpCache<V>` is the default cache for `HibpClient`. It holds up to `LRU_DEFAULT_CAPACITY` entries (10 000) with `L…
 - [null](./null.md) — `NullHibpCache<V>` is the always-miss adapter used by `HibpClient` when the caller explicitly opts out of caching (`cac…
 - lru — `LruHibpCache<V>` is the default cache for `H…

plugins/document-navigator/docs/security-stack/security/hibp/src/client/client.md

@@ -3,6 +3,7 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs --> - options.schema — `HibpClientOptionsSchema` is the Z…
+
 - [options.schema](./options.schema.md) — `HibpClientOptionsSchema` is the Zod boundary for the `HibpClient` constructor. It is `.strict()` — unknown keys cause…
 - options.schema — `HibpClientOptionsSchema` is the Z…
 

plugins/document-navigator/docs/security-stack/security/jws/README.md

@@ -42,9 +42,11 @@ RFC 7515 **JSON Web Signature** (verify + sign). Pure TypeScript over `Uint8Arra
   - [sign-pipeline](./src/sign/sign-pipeline.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
 - [verify](./src/verify/verify-pipeline.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
   - [verify-pipeline](./src/verify/verify-pipeline.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+
 <!-- end:auto-docs -->  - [base64url](./src/base64url/base64url.md) — <!-- begin:auto-docs --> _(no submodules)_- [detached](./src/detached/detached.md) — <!-- begin:auto-docs --> _(no submodules)_- [detached](./src/detached/detached.md) — <!-- begin:auto-docs --> _(no submodules)_- [errors](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [error-codes](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [header](./src/header/header.md) — <!-- begin:auto-docs --> _(no submodules)_- [b64](./src/header/b64.md) — RFC 7797 §3 implements the `b64` header parameter, allowing JWS producers to embed unencoded payloads directly into the…
-  - [crit](./src/header/crit.md) — RFC 7515 §4.1.11 enforcement: every entry in `header.crit` MUST be in the caller's `acceptableCriticalHeaders` allowlis…
-  - [header](./src/header/header.md) — <!-- begin:auto-docs --> _(no submodules)_- [jwk](./src/keys/jwk.md) — Parse an RFC 7517 §4 / RFC 7518 §6 JSON Web Key into the typed key shape expected by the JWS algorithm impl for the dec…
+
+- [crit](./src/header/crit.md) — RFC 7515 §4.1.11 enforcement: every entry in `header.crit` MUST be in the caller's `acceptableCriticalHeaders` allowlis…
+- [header](./src/header/header.md) — <!-- begin:auto-docs --> _(no submodules)_- [jwk](./src/keys/jwk.md) — Parse an RFC 7517 §4 / RFC 7518 §6 JSON Web Key into the typed key shape expected by the JWS algorithm impl for the dec…
 - [resolver](./src/keys/resolver.md) — Caller-supplied key-resolution function consulted when `header.kid` is present and no key has been supplied via `opts.k…
 - [x5c](./src/keys/x5c.md) — Decode an RFC 7515 §4.1.6 `x5c` certificate chain, delegate trust-path validation to `@suaveplan/x509.validateChain`, a…
 - [observability](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [metrics](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [compact](./src/serialization/compact/compact.md) — <!-- begin:auto-docs --> _(no submodules)_- [compact](./src/serialization/compact/compact.md) — <!-- begin:auto-docs --> _(no submodules)_- [flat](./src/serialization/flat/flat.md) — <!-- begin:auto-docs --> _(no submodules)_- [flat](./src/serialization/flat/flat.md) — <!-- begin:auto-docs --> _(no submodules)_- [general](./src/serialization/general/general.md) — <!-- begin:auto-docs --> _(no submodules)_- [general](./src/serialization/general/general.md) — <!-- begin:auto-docs --> _(no submodules)_- [sign](./src/sign/sign-pipeline.md) — <!-- begin:auto-docs --> _(no submodules)_- [sign-pipeline](./src/sign/sign-pipeline.md) — <!-- begin:auto-docs --> _(no submodules)_- [verify](./src/verify/verify-pipeline.md) — <!-- begin:auto-docs --> _(no submodules)_- [verify-pipeline](./src/verify/verify-pipeline.md) — <!-- begin:auto-docs --> _(no submodules)_- [base64url](./src/base64url/base64url.md) — <!-- begin:auto-docs --> _(no submodules)_- [detached](./src/detached/detached.md) — <!-- begin:auto-docs --> _(no submodules)_- [detached](./src/detached/detached.md) — <!-- begin:auto-docs --> _(no submodules)_- [errors](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [error-codes](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [header](./src/header/header.md) — <!-- begin:auto-docs --> _(no submodules)_- [b64](./src/header/b64.md) — RFC 7797 §3 implements the `b64` header parameter, allowing JWS producers to embed unencoded payloads directly into the…
@@ -63,6 +65,7 @@ RFC 7515 **JSON Web Signature** (verify + sign). Pure TypeScript over `Uint8Arra
 - [resolver](./src/keys/resolver.md) — Caller-supplied key-resolution function consulted when `header.kid` is present and no key has been supplied via `opts.k…
 - [x5c](./src/keys/x5c.md) — Decode an RFC 7515 §4.1.6 `x5c` certificate chain, delegate trust-path validation to `@suaveplan/x509.validateChain`, a…
 - [observability](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_  - [metrics](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_  - [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [compact](./src/serialization/compact/compact.md) — <!-- begin:auto-docs --> _(no submodules)_  - [compact](./src/serialization/compact/compact.md) — <!-- begin:auto-docs --> _(no submodules)_- [flat](./src/serialization/flat/flat.md) — <!-- begin:auto-docs --> _(no submodules)_  - [flat](./src/serialization/flat/flat.md) — <!-- begin:auto-docs --> _(no submodules)_- [general](./src/serialization/general/general.md) — <!-- begin:auto-docs --> _(no submodules)_  - [general](./src/serialization/general/general.md) — <!-- begin:auto-docs --> _(no submodules)_- [sign](./src/sign/sign-pipeline.md) — <!-- begin:auto-docs --> _(no submodules)_  - [sign-pipeline](./src/sign/sign-pipeline.md) — <!-- begin:auto-docs --> _(no submodules)_- [verify](./src/verify/verify-pipeline.md) — <!-- begin:auto-docs --> _(no submodules)_  - [verify-pipeline](./src/verify/verify-pipeline.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Install
 
 ```sh
@@ -144,4 +147,3 @@ const result = await compactVerify(token, secret, { algorithms: ["HS256"] });
 ## License
 
 MIT.
-

plugins/document-navigator/docs/security-stack/security/license/README.md

@@ -175,4 +175,3 @@ breaks the circular dependency between "decode needs the seed" and
 ## License
 
 MIT.
-

plugins/document-navigator/docs/security-stack/security/otp/README.md

@@ -38,7 +38,9 @@
 - [format-uri](./src/uri/format-uri.md) — Build a canonical `otpauth://` URI from an `OtpUri` value object. Round-trips with `parseUri` for every valid input. Pe…
 - [parse-uri](./src/uri/parse-uri.md) — Parse the `otpauth://` Key URI Format used by Google Authenticator and every compatible authenticator app. Supports bot…
 - [uri.schema](./src/uri/uri.schema.md) — Zod boundary schemas for the `OtpUri` discriminated union. `OtpTotpUriSchema` and `OtpHotpUriSchema` cover the per-vari…
+
 <!-- end:auto-docs -->  - [base32](./src/base32/base32.md) — <!-- begin:auto-docs --> _(no submodules)_- [drift](./src/drift/detect.md) — <!-- begin:auto-docs --> _(no submodules)_- [detect](./src/drift/detect.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes.md) — Stable, registered error codes for `@suaveplan/otp` plus the typed `OtpError` base class. Every failure that crosses th…
+
 - [zod-map](./src/errors/zod-map.md) — Translate Zod boundary failures into the most-specific `OtpErrorCode`. When a caller passes options that fail strict-mo…
 - [hotp](./src/hotp/hotp.md) — <!-- begin:auto-docs --> _(no submodules)_- hotp.schema — Zod boundary schema for `HotpOptions`…
   - [encode-counter](./src/hotp/encode-counter.md) — Encode an HOTP counter as the 8-byte big-endian block required by RFC 4226 §5.1. `bigint` is the canonical input type b…
@@ -204,4 +206,3 @@ const r = verify(code, secret);
 ## License
 
 MIT
-

plugins/document-navigator/docs/security-stack/security/otp/src/hotp/hotp.md

@@ -3,6 +3,7 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs --> - hotp.schema — Zod boundary schema for `HotpOptions`…
+
 - [hotp.schema](./hotp.schema.md) — Zod boundary schema for `HotpOptions`. Strict-mode parsing rejects unknown keys (so silent typos in caller configuratio…
 - hotp.schema — Zod boundary schema for `HotpOptions`…
 

plugins/document-navigator/docs/security-stack/security/otp/src/ocra/ocra.md

@@ -3,6 +3,7 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs --> - ocra.schema — Zod boundary schema for `OcraParams`……
+
 - [ocra.schema](./ocra.schema.md) — Zod boundary schema for `OcraParams` — the runtime parameter bag passed alongside a suite string and a key. Optional fi…
 - [suite](./suite.md) — Parse an OCRA suite string into a typed `OcraSuite` AST per RFC 6287 §6.1. Exposed separately so callers can validate s…
 - [verify-ocra](./verify-ocra.md) — Constant-time verify of an OCRA response. Recomputes the response under the supplied suite, key, and params, then compa…

plugins/document-navigator/docs/security-stack/security/otp/src/totp/totp.md

@@ -3,6 +3,7 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs --> - totp.schema — Zod boundary schemas for `TotpOptions…
+
 - [totp.schema](./totp.schema.md) — Zod boundary schemas for `TotpOptions` and `TotpVerifyOptions`. The TOTP schema covers algorithm / digits / period / t0…
 - [verify-many](./verify-many.md) — Backup-aware TOTP verify. Used during rotation windows where an old and a new TOTP secret coexist — the user's authenti…
 - [verify](./verify.md) — RFC 6238 §5.2 verify with drift window. Checks the supplied code against the current step and `±window` neighbouring st…

plugins/document-navigator/docs/security-stack/security/password-generator/README.md

@@ -38,9 +38,11 @@ passphrase decoration, an entropy estimator, and a `assertStrength` guard.
 - [eff-long](./src/wordlists/eff-long.md) — Bundles the EFF Long Wordlist as a frozen `readonly string[]` so callers who only want passphrase generation pull this…
 - [eff-short](./src/wordlists/eff-short.md) — Bundles EFF's Short Wordlist #1 — 1296 entries (4-dice / 6⁴), ≈ 10.34 bits/word, every entry ≤ 5 ASCII characters. Sour…
 - [registry](./src/wordlists/registry.md) — The wordlist registry exposes a small plugin API — `registerWordlist`, `getWordlist`, `listWordlists` — that lets calle…
+
 <!-- end:auto-docs -->  - [charsets](./src/charsets/charsets.md) — <!-- begin:auto-docs --> _(no submodules)_- [entropy](./src/entropy/entropy.md) — <!-- begin:auto-docs --> _(no submodules)_- [entropy](./src/entropy/entropy.md) — <!-- begin:auto-docs --> _(no submodules)_- [errors](./src/errors/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [observability](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [metrics](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [passphrase](./src/passphrase/passphrase.md) — <!-- begin:auto-docs --> _(no submodules)_- [passphrase](./src/passphrase/passphrase.md) — <!-- begin:auto-docs --> _(no submodules)_- [password](./src/password/password.md) — <!-- begin:auto-docs --> _(no submodules)_- pronounceable — `generatePronounceablePassword(opts…
-  - [password](./src/password/password.md) — <!-- begin:auto-docs --> _(no submodules)_- pronounceable — `generatePronounceablePassword(opts…
-  - [pronounceable](./src/password/pronounceable.md) — `generatePronounceablePassword(opts, rng?)` emits CVC-pattern (consonant–vowel–consonant) syllables suitable for should…
+
+- [password](./src/password/password.md) — <!-- begin:auto-docs --> _(no submodules)_- pronounceable — `generatePronounceablePassword(opts…
+- [pronounceable](./src/password/pronounceable.md) — `generatePronounceablePassword(opts, rng?)` emits CVC-pattern (consonant–vowel–consonant) syllables suitable for should…
 - [pin](./src/pin/pin.md) — <!-- begin:auto-docs --> _(no submodules)_- [pin](./src/pin/pin.md) — <!-- begin:auto-docs --> _(no submodules)_- [default-rng](./src/random/default-rng.md) — `defaultRng()` builds the default `Rng` backed by `@suaveplan/crypto-utils.randomBytes`, which delegates to `crypto.get…
 - [fisher-yates](./src/random/fisher-yates.md) — `shuffleInPlace(array, rng)` performs an in-place Fisher–Yates / Knuth shuffle parameterised over the bias-free `random…
 - [random-int](./src/random/random-int.md) — `randomInt(rng, max)` returns a uniformly-distributed integer in the half-open interval `[0, max)` for any `max ∈ [1, 2…
@@ -160,4 +162,3 @@ list. A consumer that imports only `./pin` pulls neither wordlist.
 ## License
 
 MIT
-

plugins/document-navigator/docs/security-stack/security/password-generator/src/password/password.md

@@ -3,6 +3,7 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs --> - pronounceable — `generatePronounceablePassword(opts…
+
 - [pronounceable](./pronounceable.md) — `generatePronounceablePassword(opts, rng?)` emits CVC-pattern (consonant–vowel–consonant) syllables suitable for should…
 - pronounceable — `generatePronounceablePassword(opts…
 

plugins/document-navigator/docs/security-stack/security/password-strength/README.md

@@ -66,14 +66,16 @@ hard 200-character DoS guard.
 - [estimate-guesses](./src/scoring/estimate-guesses.md) — Implements the Wheeler 2016 section 4 closed-form guess estimates per pattern type: dictionary (rank × uppercase × l33t…
 - [most-guessable-match-sequence](./src/scoring/most-guessable-match-sequence.md) — Picks the lowest-`Π guesses × k!` cover of the password from the union of pattern matches plus implicit bruteforce-char…
 - [score](./src/scoring/score.md) — Maps a `guesses` count to a coarse integer score per Wheeler 2016 section 5. This score (`0`–`4`) is what most consumer…
+
 <!-- end:auto-docs -->  - [assess-reactive](./src/assess/assess-reactive.md) — Debounce + cancel-on-newer-input wrapper around `assess` for UI strength meters that update as the user types. Each new…
-  - [assess](./src/assess/assess.md) — <!-- begin:auto-docs --> _(no submodules)_- [dicts](./src/dicts/load-dictionaries.md) — <!-- begin:auto-docs --> _(no submodules)_- [de](./src/dicts/de/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [wikipedia](./src/dicts/de/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [english-wikipedia](./src/dicts/en/english-wikipedia.md) — Frequency-ranked dictionary of the most common English tokens observed in Wikipedia. The matcher uses this to flag pass…
-  - [names](./src/dicts/en/names.md) — Frequency-ranked dictionaries of common US given names (male and female) and surnames. Names are over-represented in pa…
-  - [passwords](./src/dicts/en/passwords.md) — Frequency-ranked dictionary of the most common passwords observed across public breach corpora (RockYou, HaveIBeenPwned…
-  - [es](./src/dicts/es/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [wikipedia](./src/dicts/es/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [fr](./src/dicts/fr/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [wikipedia](./src/dicts/fr/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [ru](./src/dicts/ru/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [wikipedia](./src/dicts/ru/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [zh-Hans](./src/dicts/zh-Hans/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [wikipedia](./src/dicts/zh-Hans/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [load-dictionaries](./src/dicts/load-dictionaries.md) — <!-- begin:auto-docs --> _(no submodules)_- [errors](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [error-codes](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [feedback](./src/feedback/feedback.md) — <!-- begin:auto-docs --> _(no submodules)_- [feedback](./src/feedback/feedback.md) — <!-- begin:auto-docs --> _(no submodules)_- [graphs](./src/graphs/validate-graph.md) — <!-- begin:auto-docs --> _(no submodules)_- [azerty](./src/graphs/azerty/azerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [azerty](./src/graphs/azerty/azerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./src/graphs/dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./src/graphs/dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./src/graphs/qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./src/graphs/qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate-graph](./src/graphs/validate-graph.md) — <!-- begin:auto-docs --> _(no submodules)_- [matchers](./src/matchers/types.md) — <!-- begin:auto-docs --> _(no submodules)_- [date](./src/matchers/date/date.md) — <!-- begin:auto-docs --> _(no submodules)_- [date](./src/matchers/date/date.md) — <!-- begin:auto-docs --> _(no submodules)_- [dictionary](./src/matchers/dictionary/dictionary.md) — <!-- begin:auto-docs --> _(no submodules)_- l33t-table — Provides the default character → lette…
-    - [dictionary](./src/matchers/dictionary/dictionary.md) — <!-- begin:auto-docs --> _(no submodules)_- l33t-table — Provides the default character → lette…
-    - [l33t-table](./src/matchers/dictionary/l33t-table.md) — Provides the default character → letter substitution table used by the `dictionaryMatch` matcher to recognise l33t-enco…
-  - [keyboard](./src/matchers/keyboard/keyboard.md) — <!-- begin:auto-docs --> _(no submodules)_- [keyboard](./src/matchers/keyboard/keyboard.md) — <!-- begin:auto-docs --> _(no submodules)_- [regex](./src/matchers/regex/regex.md) — <!-- begin:auto-docs --> _(no submodules)_- [regex](./src/matchers/regex/regex.md) — <!-- begin:auto-docs --> _(no submodules)_- [repeat](./src/matchers/repeat/repeat.md) — <!-- begin:auto-docs --> _(no submodules)_- [repeat](./src/matchers/repeat/repeat.md) — <!-- begin:auto-docs --> _(no submodules)_- [sequence](./src/matchers/sequence/sequence.md) — <!-- begin:auto-docs --> _(no submodules)_- [sequence](./src/matchers/sequence/sequence.md) — <!-- begin:auto-docs --> _(no submodules)_- [types](./src/matchers/types.md) — <!-- begin:auto-docs --> _(no submodules)_- [observability](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [metrics](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [crack-times](./src/scoring/crack-times.md) — Maps a `guesses` count to seconds-to-crack under the four canonical attack scenarios from Wheeler 2016 section 5: onlin…
+
+- [assess](./src/assess/assess.md) — <!-- begin:auto-docs --> _(no submodules)_- [dicts](./src/dicts/load-dictionaries.md) — <!-- begin:auto-docs --> _(no submodules)_- [de](./src/dicts/de/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [wikipedia](./src/dicts/de/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [english-wikipedia](./src/dicts/en/english-wikipedia.md) — Frequency-ranked dictionary of the most common English tokens observed in Wikipedia. The matcher uses this to flag pass…
+- [names](./src/dicts/en/names.md) — Frequency-ranked dictionaries of common US given names (male and female) and surnames. Names are over-represented in pa…
+- [passwords](./src/dicts/en/passwords.md) — Frequency-ranked dictionary of the most common passwords observed across public breach corpora (RockYou, HaveIBeenPwned…
+- [es](./src/dicts/es/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [wikipedia](./src/dicts/es/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [fr](./src/dicts/fr/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [wikipedia](./src/dicts/fr/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [ru](./src/dicts/ru/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [wikipedia](./src/dicts/ru/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [zh-Hans](./src/dicts/zh-Hans/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [wikipedia](./src/dicts/zh-Hans/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [load-dictionaries](./src/dicts/load-dictionaries.md) — <!-- begin:auto-docs --> _(no submodules)_- [errors](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [error-codes](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [feedback](./src/feedback/feedback.md) — <!-- begin:auto-docs --> _(no submodules)_- [feedback](./src/feedback/feedback.md) — <!-- begin:auto-docs --> _(no submodules)_- [graphs](./src/graphs/validate-graph.md) — <!-- begin:auto-docs --> _(no submodules)_- [azerty](./src/graphs/azerty/azerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [azerty](./src/graphs/azerty/azerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./src/graphs/dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./src/graphs/dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./src/graphs/qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./src/graphs/qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate-graph](./src/graphs/validate-graph.md) — <!-- begin:auto-docs --> _(no submodules)_- [matchers](./src/matchers/types.md) — <!-- begin:auto-docs --> _(no submodules)_- [date](./src/matchers/date/date.md) — <!-- begin:auto-docs --> _(no submodules)_- [date](./src/matchers/date/date.md) — <!-- begin:auto-docs --> _(no submodules)_- [dictionary](./src/matchers/dictionary/dictionary.md) — <!-- begin:auto-docs --> _(no submodules)_- l33t-table — Provides the default character → lette…
+  - [dictionary](./src/matchers/dictionary/dictionary.md) — <!-- begin:auto-docs --> _(no submodules)_- l33t-table — Provides the default character → lette…
+  - [l33t-table](./src/matchers/dictionary/l33t-table.md) — Provides the default character → letter substitution table used by the `dictionaryMatch` matcher to recognise l33t-enco…
+- [keyboard](./src/matchers/keyboard/keyboard.md) — <!-- begin:auto-docs --> _(no submodules)_- [keyboard](./src/matchers/keyboard/keyboard.md) — <!-- begin:auto-docs --> _(no submodules)_- [regex](./src/matchers/regex/regex.md) — <!-- begin:auto-docs --> _(no submodules)_- [regex](./src/matchers/regex/regex.md) — <!-- begin:auto-docs --> _(no submodules)_- [repeat](./src/matchers/repeat/repeat.md) — <!-- begin:auto-docs --> _(no submodules)_- [repeat](./src/matchers/repeat/repeat.md) — <!-- begin:auto-docs --> _(no submodules)_- [sequence](./src/matchers/sequence/sequence.md) — <!-- begin:auto-docs --> _(no submodules)_- [sequence](./src/matchers/sequence/sequence.md) — <!-- begin:auto-docs --> _(no submodules)_- [types](./src/matchers/types.md) — <!-- begin:auto-docs --> _(no submodules)_- [observability](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [metrics](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [crack-times](./src/scoring/crack-times.md) — Maps a `guesses` count to seconds-to-crack under the four canonical attack scenarios from Wheeler 2016 section 5: onlin…
 - [estimate-guesses](./src/scoring/estimate-guesses.md) — Implements the Wheeler 2016 section 4 closed-form guess estimates per pattern type: dictionary (rank × uppercase × l33t…
 - [most-guessable-match-sequence](./src/scoring/most-guessable-match-sequence.md) — Picks the lowest-`Π guesses × k!` cover of the password from the union of pattern matches plus implicit bruteforce-char…
 - [score](./src/scoring/score.md) — Maps a `guesses` count to a coarse integer score per Wheeler 2016 section 5. This score (`0`–`4`) is what most consumer…
@@ -204,4 +206,3 @@ locally. Indicative timings on commodity hardware (single fork, no warmup):
 | DP n=199 | ~12 ms |
 
 The 200-character DoS guard keeps p99 well under the 5 ms `it()` default.
-

plugins/document-navigator/docs/security-stack/security/password-strength/src/dicts/load-dictionaries.md

@@ -3,7 +3,7 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [wikipedia](./de/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [english-wikipedia](./en/english-wikipedia.md) — Frequency-ranked dictionary of the most common English tokens observed in Wikipedia. The matcher uses this to flag pass…
+- [wikipedia](./de/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [english-wikipedia](./en/english-wikipedia.md) — Frequency-ranked dictionary of the most common English tokens observed in Wikipedia. The matcher uses this to flag pass…
 - [names](./en/names.md) — Frequency-ranked dictionaries of common US given names (male and female) and surnames. Names are over-represented in pa…
 - [passwords](./en/passwords.md) — Frequency-ranked dictionary of the most common passwords observed across public breach corpora (RockYou, HaveIBeenPwned…
 - [es](./es/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_  - [wikipedia](./es/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [fr](./fr/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_  - [wikipedia](./fr/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [ru](./ru/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_  - [wikipedia](./ru/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [zh-Hans](./zh-Hans/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_  - [wikipedia](./zh-Hans/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [load-dictionaries](./load-dictionaries.md) — <!-- begin:auto-docs --> _(no submodules)_- wikipedia — <!-- begin:auto-docs --> _(no submodules…
@@ -22,6 +22,7 @@ _(no submodules)_
 - [names](./en/names.md) — Frequency-ranked dictionaries of common US given names (male and female) and surnames. Names are over-represented in pa…
 - [passwords](./en/passwords.md) — Frequency-ranked dictionary of the most common passwords observed across public breach corpora (RockYou, HaveIBeenPwned…
 - [es](./es/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_  - [wikipedia](./es/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [fr](./fr/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_  - [wikipedia](./fr/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [ru](./ru/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_  - [wikipedia](./ru/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [zh-Hans](./zh-Hans/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_  - [wikipedia](./zh-Hans/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [load-dictionaries](./load-dictionaries.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 Builds a fresh `DictionarySet` value from a caller-supplied partial map,

plugins/document-navigator/docs/security-stack/security/password-strength/src/graphs/validate-graph.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [azerty](./azerty/azerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_  - [dvorak](./dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_  - [qwerty](./qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate-graph](./validate-graph.md) — <!-- begin:auto-docs --> _(no submodules)_- azerty — <!-- begin:auto-docs --> _(no submodules)_…
+- [azerty](./azerty/azerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_  - [dvorak](./dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_  - [qwerty](./qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate-graph](./validate-graph.md) — <!-- begin:auto-docs --> _(no submodules)_- azerty — <!-- begin:auto-docs --> _(no submodules)_…
 - [azerty](./azerty/azerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate-graph](./validate-graph.md) — <!-- begin:auto-docs --> _(no submodules)_- [azerty](./azerty/azerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate-graph](./validate-graph.md) — <!-- begin:auto-docs --> _(no submodules)_- azerty — <!-- begin:auto-doc…
 - [azerty](./azerty/azerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate-graph](./validate-graph.md) — <!-- begin:auto-docs --> _(no submodules)_- azerty — <!-- begin:auto-docs --> _(no submodules)_…
 - [azerty](./azerty/azerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_  - [dvorak](./dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_  - [qwerty](./qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate-graph](./validate-graph.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 Validates that a user-supplied keyboard adjacency graph is well-formed

plugins/document-navigator/docs/security-stack/security/password-strength/src/matchers/dictionary/dictionary.md

@@ -3,6 +3,7 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs --> - l33t-table — Provides the default character → lette…
+
 - [l33t-table](./l33t-table.md) — Provides the default character → letter substitution table used by the `dictionaryMatch` matcher to recognise l33t-enco…
 - l33t-table — Provides the default character → lette…
 

plugins/document-navigator/docs/security-stack/security/password-strength/src/matchers/types.md

@@ -3,9 +3,9 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [date](./date/date.md) — <!-- begin:auto-docs --> _(no submodules)_- [dictionary](./dictionary/dictionary.md) — <!-- begin:auto-docs --> _(no submodules)_- l33t-table — Provides the default character → lette…
-  - [dictionary](./dictionary/dictionary.md) — <!-- begin:auto-docs --> _(no submodules)_- l33t-table — Provides the default character → lette…
-  - [l33t-table](./dictionary/l33t-table.md) — Provides the default character → letter substitution table used by the `dictionaryMatch` matcher to recognise l33t-enco…
+- [date](./date/date.md) — <!-- begin:auto-docs --> _(no submodules)_- [dictionary](./dictionary/dictionary.md) — <!-- begin:auto-docs --> _(no submodules)_- l33t-table — Provides the default character → lette…
+- [dictionary](./dictionary/dictionary.md) — <!-- begin:auto-docs --> _(no submodules)_- l33t-table — Provides the default character → lette…
+- [l33t-table](./dictionary/l33t-table.md) — Provides the default character → letter substitution table used by the `dictionaryMatch` matcher to recognise l33t-enco…
 - [keyboard](./keyboard/keyboard.md) — <!-- begin:auto-docs --> _(no submodules)_  - [keyboard](./keyboard/keyboard.md) — <!-- begin:auto-docs --> _(no submodules)_- [regex](./regex/regex.md) — <!-- begin:auto-docs --> _(no submodules)_  - [regex](./regex/regex.md) — <!-- begin:auto-docs --> _(no submodules)_- [repeat](./repeat/repeat.md) — <!-- begin:auto-docs --> _(no submodules)_  - [repeat](./repeat/repeat.md) — <!-- begin:auto-docs --> _(no submodules)_- [sequence](./sequence/sequence.md) — <!-- begin:auto-docs --> _(no submodules)_  - [sequence](./sequence/sequence.md) — <!-- begin:auto-docs --> _(no submodules)_- [types](./types.md) — <!-- begin:auto-docs --> _(no submodules)_- date — <!-- begin:auto-docs --> _(no submodules)_ <!…
 - [date](./date/date.md) — <!-- begin:auto-docs --> _(no submodules)_- [dictionary](./dictionary/dictionary.md) — <!-- begin:auto-docs --> _(no submodules)_- l33t-table — Provides the default character → lette…
   - [dictionary](./dictionary/dictionary.md) — <!-- begin:auto-docs --> _(no submodules)_- l33t-table — Provides the default character → lette…
@@ -20,6 +20,7 @@ _(no submodules)_
 - [keyboard](./keyboard/keyboard.md) — <!-- begin:auto-docs --> _(no submodules)_- [keyboard](./keyboard/keyboard.md) — <!-- begin:auto-docs --> _(no submodules)_- [regex](./regex/regex.md) — <!-- begin:auto-docs --> _(no submodules)_- [regex](./regex/regex.md) — <!-- begin:auto-docs --> _(no submodules)_- [repeat](./repeat/repeat.md) — <!-- begin:auto-docs --> _(no submodules)_- [repeat](./repeat/repeat.md) — <!-- begin:auto-docs --> _(no submodules)_- [sequence](./sequence/sequence.md) — <!-- begin:auto-docs --> _(no submodules)_- [sequence](./sequence/sequence.md) — <!-- begin:auto-docs --> _(no submodules)_- [types](./types.md) — <!-- begin:auto-docs --> _(no submodules)_- date — <!-- begin:auto-docs --> _(no submodules)_ <…
 - [date](./date/date.md) — <!-- begin:auto-docs --> _(no submodules)_- [dictionary](./dictionary/dictionary.md) — <!-- begin:auto-docs --> _(no submodules)_  - [dictionary](./dictionary/dictionary.md) — <!-- begin:auto-docs --> _(no submodules)_  - [l33t-table](./dictionary/l33t-table.md) — Provides the default character → letter substitution table used by the `dictionaryMatch` matcher to recognise l33t-enco…
 - [keyboard](./keyboard/keyboard.md) — <!-- begin:auto-docs --> _(no submodules)_  - [keyboard](./keyboard/keyboard.md) — <!-- begin:auto-docs --> _(no submodules)_- [regex](./regex/regex.md) — <!-- begin:auto-docs --> _(no submodules)_  - [regex](./regex/regex.md) — <!-- begin:auto-docs --> _(no submodules)_- [repeat](./repeat/repeat.md) — <!-- begin:auto-docs --> _(no submodules)_  - [repeat](./repeat/repeat.md) — <!-- begin:auto-docs --> _(no submodules)_- [sequence](./sequence/sequence.md) — <!-- begin:auto-docs --> _(no submodules)_  - [sequence](./sequence/sequence.md) — <!-- begin:auto-docs --> _(no submodules)_- [types](./types.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 Declares the cross-matcher discriminated-union types and shared shapes

plugins/document-navigator/docs/security-stack/security/security-codes/README.md

@@ -29,7 +29,9 @@ AWS access keys, OpenAI keys, Google API keys, and high-entropy heuristics.
   - [security-codes](./src/types/security-codes.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
 - [utils](./src/utils/luhn.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
   - [luhn](./src/utils/luhn.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+
 <!-- end:auto-docs -->  - [code-detector](./src/core/code-detector/code-detector.md) — <!-- begin:auto-docs --> _(no submodules)_- [code-sanitizer](./src/core/code-sanitizer/code-sanitizer.md) — <!-- begin:auto-docs --> _(no submodules)_- [code-sanitizer](./src/core/code-sanitizer/code-sanitizer.md) — <!-- begin:auto-docs --> _(no submodules)_- [errors](./src/errors/security-codes-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [security-codes-error](./src/errors/security-codes-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [aws](./src/patterns/aws.md) — Detects AWS Access Key IDs within arbitrary string input. AWS Access Key IDs are 20-character alphanumeric identifiers…
+
 - [credit-card](./src/patterns/credit-card.md) — Detects credit card numbers embedded in arbitrary strings using a combination of regex matching and the Luhn checksum a…
 - [entropy](./src/patterns/entropy.md) — Detects high-entropy strings that are likely secret tokens, API keys, or passwords using Shannon entropy analysis. This…
 - [github](./src/patterns/github.md) — Detects GitHub Personal Access Tokens (PATs) — both classic tokens (`ghp_…`) and the newer fine-grained tokens (`github…
@@ -70,6 +72,7 @@ AWS access keys, OpenAI keys, Google API keys, and high-entropy heuristics.
 - [ssh](./src/patterns/ssh.md) — Detects SSH private keys and public keys embedded in arbitrary strings. SSH private keys grant direct shell access to a…
 - [stripe](./src/patterns/stripe.md) — Detects Stripe API keys — both secret keys (`sk_live_` / `sk_test_`) and publishable keys (`pk_live_` / `pk_test_`) — e…
 - [types](./src/types/security-codes.md) — <!-- begin:auto-docs --> _(no submodules)_  - [security-codes](./src/types/security-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [utils](./src/utils/luhn.md) — <!-- begin:auto-docs --> _(no submodules)_  - [luhn](./src/utils/luhn.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Features
 
 - **10 built-in pattern detectors** covering the most common secret types

plugins/document-navigator/docs/security-stack/security/server-keys/README.md

@@ -192,4 +192,3 @@ await runFunction("custom-cmd", async (signal) => {
   license format requires secp256k1; the vault's sign slot is
   ed25519. The license bin therefore uses its own `keygen` sub-command
   rather than trying to reuse the vault's signing key.
-

plugins/document-navigator/docs/security-stack/security/slsa/README.md

@@ -34,9 +34,11 @@ typed `SlsaError` subclasses with stable error codes.
 - [verification](./src/verification/verification.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
   - [checks](./src/verification/checks.md) — Individual, stateless verification rules that consume a provenance statement plus policy inputs and return a structured…
   - [verification](./src/verification/verification.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+
 <!-- end:auto-docs -->  - [assessment](./src/assessment/assessment.md) — <!-- begin:auto-docs --> _(no submodules)_- [dsse](./src/attestation/dsse/dsse.md) — <!-- begin:auto-docs --> _(no submodules)_- [dsse](./src/attestation/dsse/dsse.md) — <!-- begin:auto-docs --> _(no submodules)_- [errors](./src/errors/slsa-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [slsa-error](./src/errors/slsa-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [otel](./src/otel/slsa-otel.md) — <!-- begin:auto-docs --> _(no submodules)_- [slsa-otel](./src/otel/slsa-otel.md) — <!-- begin:auto-docs --> _(no submodules)_- [policy](./src/policy/policy.md) — <!-- begin:auto-docs --> _(no submodules)_- [policy](./src/policy/policy.md) — <!-- begin:auto-docs --> _(no submodules)_- [provenance](./src/provenance/provenance.md) — <!-- begin:auto-docs --> _(no submodules)_- [canonical-json](./src/provenance/canonical-json.md) — Produces a byte-stable, lexicographically-ordered JSON encoding for provenance statements, SBOM documents, and DSSE pay…
-  - [digest](./src/provenance/digest.md) — Single canonical entry point for SHA-256 digest computation inside the SLSA package. Deliberately routes through `@suav…
-  - [provenance](./src/provenance/provenance.md) — <!-- begin:auto-docs --> _(no submodules)_- [inclusion-proof](./src/rekor/inclusion-proof.md) — Verifies an RFC 6962 Merkle inclusion proof as returned by Sigstore Rekor. Given a leaf (the canonical body a Rekor ent…
+
+- [digest](./src/provenance/digest.md) — Single canonical entry point for SHA-256 digest computation inside the SLSA package. Deliberately routes through `@suav…
+- [provenance](./src/provenance/provenance.md) — <!-- begin:auto-docs --> _(no submodules)_- [inclusion-proof](./src/rekor/inclusion-proof.md) — Verifies an RFC 6962 Merkle inclusion proof as returned by Sigstore Rekor. Given a leaf (the canonical body a Rekor ent…
 - [rekor-client](./src/rekor/rekor-client.md) — Minimal Sigstore Rekor REST client for the two upload shapes Suaveplan cares about: `hashedrekord` v0.0.1 (when logging…
 - [sbom](./src/sbom/sbom.md) — <!-- begin:auto-docs --> _(no submodules)_- [sbom](./src/sbom/sbom.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/parse.md) — <!-- begin:auto-docs --> _(no submodules)_- [parse](./src/schemas/parse.md) — <!-- begin:auto-docs --> _(no submodules)_- [verification](./src/verification/verification.md) — <!-- begin:auto-docs --> _(no submodules)_- [checks](./src/verification/checks.md) — Individual, stateless verification rules that consume a provenance statement plus policy inputs and return a structured…
   - [verification](./src/verification/verification.md) — <!-- begin:auto-docs --> _(no submodules)_- [assessment](./src/assessment/assessment.md) — <!-- begin:auto-docs --> _(no submodules)_- [dsse](./src/attestation/dsse/dsse.md) — <!-- begin:auto-docs --> _(no submodules)_- [dsse](./src/attestation/dsse/dsse.md) — <!-- begin:auto-docs --> _(no submodules)_- [errors](./src/errors/slsa-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [slsa-error](./src/errors/slsa-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [otel](./src/otel/slsa-otel.md) — <!-- begin:auto-docs --> _(no submodules)_- [slsa-otel](./src/otel/slsa-otel.md) — <!-- begin:auto-docs --> _(no submodules)_- [policy](./src/policy/policy.md) — <!-- begin:auto-docs --> _(no submodules)_- [policy](./src/policy/policy.md) — <!-- begin:auto-docs --> _(no submodules)_- [provenance](./src/provenance/provenance.md) — <!-- begin:auto-docs --> _(no submodules)_- [canonical-json](./src/provenance/canonical-json.md) — Produces a byte-stable, lexicographically-ordered JSON encoding for provenance statements, SBOM documents, and DSSE pay…
@@ -55,6 +57,7 @@ typed `SlsaError` subclasses with stable error codes.
 - [rekor-client](./src/rekor/rekor-client.md) — Minimal Sigstore Rekor REST client for the two upload shapes Suaveplan cares about: `hashedrekord` v0.0.1 (when logging…
 - [sbom](./src/sbom/sbom.md) — <!-- begin:auto-docs --> _(no submodules)_  - [sbom](./src/sbom/sbom.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/parse.md) — <!-- begin:auto-docs --> _(no submodules)_  - [parse](./src/schemas/parse.md) — <!-- begin:auto-docs --> _(no submodules)_- [verification](./src/verification/verification.md) — <!-- begin:auto-docs --> _(no submodules)_  - [checks](./src/verification/checks.md) — Individual, stateless verification rules that consume a provenance statement plus policy inputs and return a structured…
   - [verification](./src/verification/verification.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Install
 
 ```bash
@@ -135,4 +138,3 @@ console.log(assessSlsaLevel({ ...environment, hasRekorInclusion: true }).level);
 - Tests: 170 passing (13 files).
 - Coverage: 99.2% statements, 100% functions, 99.44% lines, 95.15% branches.
 - Typecheck, lint, and build all green.
-

plugins/document-navigator/docs/security-stack/security/srp/README.md

@@ -48,7 +48,9 @@ SRP-6a zero-knowledge password proof per [RFC 5054](https://www.rfc-editor.org/r
 - [server-start](./src/server/server-start.md) — Begin the SRP-6a handshake on the server side. Loads the stored verifier `v` (alongside the user's `(I, salt)`), draws…
 - [verifier](./src/verifier/verifier.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
   - [verifier](./src/verifier/verifier.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+
 <!-- end:auto-docs -->  - [errors](./src/errors/errors.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups](./src/groups/groups-2048.md) — <!-- begin:auto-docs --> _(no submodules)_- [1024](./src/groups/1024/groups-1024.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-1024](./src/groups/1024/groups-1024.md) — <!-- begin:auto-docs --> _(no submodules)_- [1536](./src/groups/1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-1536](./src/groups/1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_- [3072](./src/groups/3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-3072](./src/groups/3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_- [4096](./src/groups/4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-4096](./src/groups/4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_- [6144](./src/groups/6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-6144](./src/groups/6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_- [8192](./src/groups/8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-8192](./src/groups/8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-2048](./src/groups/groups-2048.md) — <!-- begin:auto-docs --> _(no submodules)_- [hash](./src/hash/hash-bridge.md) — <!-- begin:auto-docs --> _(no submodules)_- [hash-bridge](./src/hash/hash-bridge.md) — <!-- begin:auto-docs --> _(no submodules)_- [k](./src/math/k.md) — Compute the SRP-6a multiplier parameter `k = H(N | PAD(g))` per RFC 5054 §2.5.3. The multiplier is the structural chang…
+
 - [modpow](./src/math/modpow.md) — Modular exponentiation primitive for `@suaveplan/srp`. This is a thin wrapper over `@noble/curves`'s hardened `pow(num,…
 - [pad](./src/math/pad.md) — The `PAD(x, N)` helper from RFC 5054 §2.5.3. Returns a left-zero-extended copy of `x` whose length equals `N.byteLength…
 - [proof](./src/math/proof.md) — Internal helpers for computing the SRP-6a / RFC 2945 §3 mutual-authentication proofs `M1` and `M2`. Both client and ser…
@@ -93,6 +95,7 @@ SRP-6a zero-knowledge password proof per [RFC 5054](https://www.rfc-editor.org/r
 - [server-m2](./src/server/server-m2.md) — Split-roundtrip helper that computes the server proof `M2 = H(A | M1 | K)` independently of `serverFinishHandshake`. Us…
 - [server-start](./src/server/server-start.md) — Begin the SRP-6a handshake on the server side. Loads the stored verifier `v` (alongside the user's `(I, salt)`), draws…
 - [verifier](./src/verifier/verifier.md) — <!-- begin:auto-docs --> _(no submodules)_  - [verifier](./src/verifier/verifier.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Install
 
 ```bash
@@ -188,4 +191,3 @@ bun scripts/generate-srp-vectors.ts [--seed=42]
 ```
 
 Regenerates `src/__fixtures__/vectors-2048-sha256.json` deterministically.
-

plugins/document-navigator/docs/security-stack/security/srp/src/groups/groups-2048.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [groups-1024](./1024/groups-1024.md) — <!-- begin:auto-docs --> _(no submodules)_- [1536](./1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-1536](./1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_- [3072](./3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-3072](./3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_- [4096](./4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-4096](./4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_- [6144](./6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-6144](./6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_- [8192](./8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-8192](./8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-2048](./groups-2048.md) — <!-- begin:auto-docs --> _(no submodules)_- groups-1024 — <!-- begin:auto-docs --> _(no submodul…
+- [groups-1024](./1024/groups-1024.md) — <!-- begin:auto-docs --> _(no submodules)_- [1536](./1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-1536](./1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_- [3072](./3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-3072](./3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_- [4096](./4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-4096](./4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_- [6144](./6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-6144](./6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_- [8192](./8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-8192](./8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-2048](./groups-2048.md) — <!-- begin:auto-docs --> _(no submodules)_- groups-1024 — <!-- begin:auto-docs --> _(no submodul…
 - [groups-1024](./1024/groups-1024.md) — <!-- begin:auto-docs --> _(no submodules)_- [1536](./1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-1536](./1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_- [3072](./3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-3072](./3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_- [4096](./4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-4096](./4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_- [6144](./6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-6144](./6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_- [8192](./8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-8192](./8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-2048](./groups-2048.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-1024](./1024/groups-1024.md) — <!-- begin:auto-docs --> _(no submodules)_- [1536](./1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-1536](./1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_- [3072](./3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-3072](./3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_- [4096](./4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-4096](./4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_- [6144](./6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-6144](./6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_- [8192](./8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-8192](./8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-2048](./groups-2048.md) — <!-- begin:auto-docs --> _(no submodules)_- groups-1024 — <!-- begin:aut…
 - [groups-1024](./1024/groups-1024.md) — <!-- begin:auto-docs --> _(no submodules)_- [1536](./1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-1536](./1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_- [3072](./3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-3072](./3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_- [4096](./4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-4096](./4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_- [6144](./6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-6144](./6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_- [8192](./8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-8192](./8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-2048](./groups-2048.md) — <!-- begin:auto-docs --> _(no submodules)_- groups-1024 — <!-- begin:auto-docs --> _(no submodu…
 - [groups-1024](./1024/groups-1024.md) — <!-- begin:auto-docs --> _(no submodules)_- [1536](./1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-1536](./1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_- [3072](./3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-3072](./3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_- [4096](./4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-4096](./4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_- [6144](./6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-6144](./6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_- [8192](./8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-8192](./8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-2048](./groups-2048.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 The bundled 2048-bit safe-prime group from RFC 5054 Appendix A. This is the default SRP-6a group every consumer of `@suaveplan/srp` gets without any additional import: `N_2048` is a 256-byte modulus, `g_2048` is the single byte `0x02`, and `BIT_LENGTH` is the literal `2048`. RFC 5054 deliberately bundles a small set of fixed safe primes to side-step trust-on-first-use over arbitrary moduli; we ship the 2048-bit one as the default because it sits at the contemporary security floor while keeping a 2048-bit `modPow` cheap enough (~5–20 ms) for an interactive login.

plugins/document-navigator/docs/security-stack/security/tpm-struct/README.md

@@ -43,9 +43,11 @@ available at the WebAuthn step-5/step-8 call site.
   - [serialize](./src/public/serialize.md) — `serializeTpmtPublic` re-emits a parsed `TpmtPublic` value as the TCG-canonical byte string per Library Part 2 §12.2. I…
 - [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
   - [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+
 <!-- end:auto-docs -->  - [alg](./src/alg/alg.md) — <!-- begin:auto-docs --> _(no submodules)_- [attest](./src/attest/attest.md) — <!-- begin:auto-docs --> _(no submodules)_- serialize — `serializeTpmsAttest` re-emits a parsed…
-  - [attest](./src/attest/attest.md) — <!-- begin:auto-docs --> _(no submodules)_- serialize — `serializeTpmsAttest` re-emits a parsed…
-  - [serialize](./src/attest/serialize.md) — `serializeTpmsAttest` re-emits a parsed `TpmsAttest` value as the TCG-canonical byte string per Library Part 2 §10.12.…
+
+- [attest](./src/attest/attest.md) — <!-- begin:auto-docs --> _(no submodules)_- serialize — `serializeTpmsAttest` re-emits a parsed…
+- [serialize](./src/attest/serialize.md) — `serializeTpmsAttest` re-emits a parsed `TpmsAttest` value as the TCG-canonical byte string per Library Part 2 §10.12.…
 - [buffer](./src/buffer/buffer.md) — <!-- begin:auto-docs --> _(no submodules)_- [buffer](./src/buffer/buffer.md) — <!-- begin:auto-docs --> _(no submodules)_- [diagnostic](./src/diagnostic/diagnostic.md) — <!-- begin:auto-docs --> _(no submodules)_- [diagnostic](./src/diagnostic/diagnostic.md) — <!-- begin:auto-docs --> _(no submodules)_- [errors](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [error-codes](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [extra-data](./src/extra-data/extra-data.md) — <!-- begin:auto-docs --> _(no submodules)_- [extra-data](./src/extra-data/extra-data.md) — <!-- begin:auto-docs --> _(no submodules)_- [name](./src/name/name.md) — <!-- begin:auto-docs --> _(no submodules)_- [name](./src/name/name.md) — <!-- begin:auto-docs --> _(no submodules)_- [observability](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [metrics](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [public](./src/public/public.md) — <!-- begin:auto-docs --> _(no submodules)_- serialize — `serializeTpmtPublic` re-emits a parsed…
   - [object-attributes](./src/public/object-attributes.md) — `decodeObjectAttributes` (and its inverse `encodeObjectAttributes`) walk the 32-bit `TPMA_OBJECT` bitfield documented i…
   - [public](./src/public/public.md) — <!-- begin:auto-docs --> _(no submodules)_- serialize — `serializeTpmtPublic` re-emits a parsed…
@@ -68,6 +70,7 @@ available at the WebAuthn step-5/step-8 call site.
 - [buffer](./src/buffer/buffer.md) — <!-- begin:auto-docs --> _(no submodules)_  - [buffer](./src/buffer/buffer.md) — <!-- begin:auto-docs --> _(no submodules)_- [diagnostic](./src/diagnostic/diagnostic.md) — <!-- begin:auto-docs --> _(no submodules)_  - [diagnostic](./src/diagnostic/diagnostic.md) — <!-- begin:auto-docs --> _(no submodules)_- [errors](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_  - [error-codes](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [extra-data](./src/extra-data/extra-data.md) — <!-- begin:auto-docs --> _(no submodules)_  - [extra-data](./src/extra-data/extra-data.md) — <!-- begin:auto-docs --> _(no submodules)_- [name](./src/name/name.md) — <!-- begin:auto-docs --> _(no submodules)_  - [name](./src/name/name.md) — <!-- begin:auto-docs --> _(no submodules)_- [observability](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_  - [metrics](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [public](./src/public/public.md) — <!-- begin:auto-docs --> _(no submodules)_  - [object-attributes](./src/public/object-attributes.md) — `decodeObjectAttributes` (and its inverse `encodeObjectAttributes`) walk the 32-bit `TPMA_OBJECT` bitfield documented i…
   - [public](./src/public/public.md) — <!-- begin:auto-docs --> _(no submodules)_  - [serialize](./src/public/serialize.md) — `serializeTpmtPublic` re-emits a parsed `TpmtPublic` value as the TCG-canonical byte string per Library Part 2 §12.2. I…
 - [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_  - [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Install
 
 ```bash
@@ -130,4 +133,3 @@ if (
 ## License
 
 MIT.
-

plugins/document-navigator/docs/security-stack/security/tpm-struct/src/attest/attest.md

@@ -3,6 +3,7 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs --> - serialize — `serializeTpmsAttest` re-emits a parsed…
+
 - [serialize](./serialize.md) — `serializeTpmsAttest` re-emits a parsed `TpmsAttest` value as the TCG-canonical byte string per Library Part 2 §10.12.…
 - serialize — `serializeTpmsAttest` re-emits a parsed…
 

plugins/document-navigator/docs/security-stack/security/tpm-struct/src/public/public.md

@@ -3,6 +3,7 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs --> - serialize — `serializeTpmtPublic` re-emits a parsed…
+
 - [serialize](./serialize.md) — `serializeTpmtPublic` re-emits a parsed `TpmtPublic` value as the TCG-canonical byte string per Library Part 2 §12.2. I…
 - serialize — `serializeTpmtPublic` re-emits a parsed…
 

plugins/document-navigator/docs/security-stack/security/vault-sync/README.md

@@ -33,7 +33,9 @@ vector-clock causal ordering, and XChaCha20-Poly1305 sync payloads.
   - [types](./src/types/types.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
 - [vector-clock](./src/vector-clock/vector-clock.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
   - [vector-clock](./src/vector-clock/vector-clock.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+
 <!-- end:auto-docs -->  - [crypto-sync](./src/crypto-sync/crypto-sync.md) — <!-- begin:auto-docs --> _(no submodules)_- [engine](./src/engine/engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [engine](./src/engine/engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes.md) — `codes.ts` defines the canonical, frozen registry of every fully-qualified error code emitted by `@suaveplan/vault-sync…
+
 - [vault-sync-error](./src/errors/vault-sync-error.md) — `VaultSyncError` is the single concrete error class thrown from every production path inside `@suaveplan/vault-sync`. I…
 - [merge](./src/merge/merge.md) — <!-- begin:auto-docs --> _(no submodules)_- [merge](./src/merge/merge.md) — <!-- begin:auto-docs --> _(no submodules)_- [otel](./src/otel/instruments.md) — <!-- begin:auto-docs --> _(no submodules)_- [instruments](./src/otel/instruments.md) — <!-- begin:auto-docs --> _(no submodules)_- [patch](./src/patch/patch.md) — <!-- begin:auto-docs --> _(no submodules)_- [patch](./src/patch/patch.md) — <!-- begin:auto-docs --> _(no submodules)_- [queue](./src/queue/queue.md) — <!-- begin:auto-docs --> _(no submodules)_- [queue](./src/queue/queue.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [types](./src/types/types.md) — <!-- begin:auto-docs --> _(no submodules)_- [types](./src/types/types.md) — <!-- begin:auto-docs --> _(no submodules)_- [vector-clock](./src/vector-clock/vector-clock.md) — <!-- begin:auto-docs --> _(no submodules)_- [vector-clock](./src/vector-clock/vector-clock.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-sync](./src/crypto-sync/crypto-sync.md) — <!-- begin:auto-docs --> _(no submodules)_- [engine](./src/engine/engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [engine](./src/engine/engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes.md) — `codes.ts` defines the canonical, frozen registry of every fully-qualified error code emitted by `@suaveplan/vault-sync…
 - [vault-sync-error](./src/errors/vault-sync-error.md) — `VaultSyncError` is the single concrete error class thrown from every production path inside `@suaveplan/vault-sync`. I…
@@ -42,6 +44,7 @@ vector-clock causal ordering, and XChaCha20-Poly1305 sync payloads.
 - [merge](./src/merge/merge.md) — <!-- begin:auto-docs --> _(no submodules)_- [merge](./src/merge/merge.md) — <!-- begin:auto-docs --> _(no submodules)_- [otel](./src/otel/instruments.md) — <!-- begin:auto-docs --> _(no submodules)_- [instruments](./src/otel/instruments.md) — <!-- begin:auto-docs --> _(no submodules)_- [patch](./src/patch/patch.md) — <!-- begin:auto-docs --> _(no submodules)_- [patch](./src/patch/patch.md) — <!-- begin:auto-docs --> _(no submodules)_- [queue](./src/queue/queue.md) — <!-- begin:auto-docs --> _(no submodules)_- [queue](./src/queue/queue.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [types](./src/types/types.md) — <!-- begin:auto-docs --> _(no submodules)_- [types](./src/types/types.md) — <!-- begin:auto-docs --> _(no submodules)_- [vector-clock](./src/vector-clock/vector-clock.md) — <!-- begin:auto-docs --> _(no submodules)_- [vector-clock](./src/vector-clock/vector-clock.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-sync](./src/crypto-sync/crypto-sync.md) — <!-- begin:auto-docs --> _(no submodules)_- [engine](./src/engine/engine.md) — <!-- begin:auto-docs --> _(no submodules)_  - [engine](./src/engine/engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes.md) — `codes.ts` defines the canonical, frozen registry of every fully-qualified error code emitted by `@suaveplan/vault-sync…
 - [vault-sync-error](./src/errors/vault-sync-error.md) — `VaultSyncError` is the single concrete error class thrown from every production path inside `@suaveplan/vault-sync`. I…
 - [merge](./src/merge/merge.md) — <!-- begin:auto-docs --> _(no submodules)_  - [merge](./src/merge/merge.md) — <!-- begin:auto-docs --> _(no submodules)_- [otel](./src/otel/instruments.md) — <!-- begin:auto-docs --> _(no submodules)_  - [instruments](./src/otel/instruments.md) — <!-- begin:auto-docs --> _(no submodules)_- [patch](./src/patch/patch.md) — <!-- begin:auto-docs --> _(no submodules)_  - [patch](./src/patch/patch.md) — <!-- begin:auto-docs --> _(no submodules)_- [queue](./src/queue/queue.md) — <!-- begin:auto-docs --> _(no submodules)_  - [queue](./src/queue/queue.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_  - [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [types](./src/types/types.md) — <!-- begin:auto-docs --> _(no submodules)_  - [types](./src/types/types.md) — <!-- begin:auto-docs --> _(no submodules)_- [vector-clock](./src/vector-clock/vector-clock.md) — <!-- begin:auto-docs --> _(no submodules)_  - [vector-clock](./src/vector-clock/vector-clock.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Install
 
 ```bash
@@ -123,4 +126,3 @@ bunx turbo test --filter=@suaveplan/vault-sync
 bunx turbo test:coverage --filter=@suaveplan/vault-sync   # 100/100/100/100
 bunx turbo lint typecheck --filter=@suaveplan/vault-sync
 ```
-

plugins/document-navigator/docs/security-stack/security/vault/README.md

@@ -39,7 +39,9 @@ Vault orchestration layer for the Vaulted password-manager ecosystem. Provides a
   - [lifecycle](./src/vault/lifecycle.md) — `lifecycle.ts` extracts the two side-effecting helpers that drive the unlock path: `deriveVaultKeyBuffer` (running 2SKD…
   - [vault](./src/vault/vault.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs --> - wiring — `wiring.ts` extracts the per-unlock module…
   - [wiring](./src/vault/wiring.md) — `wiring.ts` extracts the per-unlock module factories used by `Vault`: `buildItems`, `buildSearch`, `buildAttachments`,…
+
 <!-- end:auto-docs -->  - [attachments](./src/attachments/attachments.md) — <!-- begin:auto-docs --> _(no submodules)_- [container](./src/container/container.md) — <!-- begin:auto-docs --> _(no submodules)_- [container](./src/container/container.md) — <!-- begin:auto-docs --> _(no submodules)_- [encryption](./src/encryption/field-encryption.md) — <!-- begin:auto-docs --> _(no submodules)_- [field-encryption](./src/encryption/field-encryption.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes.md) — `codes.ts` defines the stable error-code registry for `@suaveplan/vault`. Every failure raised by the orchestration lay…
+
 - [vault-error](./src/errors/vault-error.md) — `vault-error.ts` defines `VaultError`, the concrete `SuaveplanError` subclass thrown by every public path in `@suavepla…
 - [items](./src/items/items.md) — <!-- begin:auto-docs --> _(no submodules)_- [migrations](./src/items/migrations/migrations.md) — <!-- begin:auto-docs --> _(no submodules)_- [migrations](./src/items/migrations/migrations.md) — <!-- begin:auto-docs --> _(no submodules)_- [helpers](./src/items/helpers.md) — `items-helpers.ts` extracts the pure transformation helpers used by the items repository: row-to-item projection (with…
   - [items](./src/items/items.md) — <!-- begin:auto-docs --> _(no submodules)_- [manifest](./src/manifest/manifest.md) — <!-- begin:auto-docs --> _(no submodules)_- [manifest](./src/manifest/manifest.md) — <!-- begin:auto-docs --> _(no submodules)_- [otel](./src/otel/instruments.md) — <!-- begin:auto-docs --> _(no submodules)_- [instruments](./src/otel/instruments.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [search](./src/search/search.md) — <!-- begin:auto-docs --> _(no submodules)_- [search](./src/search/search.md) — <!-- begin:auto-docs --> _(no submodules)_- [shares](./src/shares/shares.md) — <!-- begin:auto-docs --> _(no submodules)_- [shares](./src/shares/shares.md) — <!-- begin:auto-docs --> _(no submodules)_- [sync](./src/sync/sync.md) — <!-- begin:auto-docs --> _(no submodules)_- [sync](./src/sync/sync.md) — <!-- begin:auto-docs --> _(no submodules)_- [types](./src/types/types.md) — <!-- begin:auto-docs --> _(no submodules)_- [adapters](./src/types/adapters.md) — `adapters.ts` defines the Phase-1 adapter contracts the vault orchestration layer uses to talk to blob storage, share-l…
@@ -153,4 +155,3 @@ await vault.lock(); // zeroizes all key material
 ## Phased delivery
 
 This is the Phase-1 landing. Adapter interfaces (`DriveLike`, `DriveSharingLike`, `VaultSyncLike`) are defined inline; production wiring binds the real `@suaveplan/drive`, `@suaveplan/drive-sharing`, and `@suaveplan/vault-sync` packages without changes to this surface.
-

plugins/document-navigator/docs/security-stack/security/vault/src/items/items.md

@@ -3,7 +3,7 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [migrations](./migrations/migrations.md) — <!-- begin:auto-docs --> _(no submodules)_- [helpers](./helpers.md) — `items-helpers.ts` extracts the pure transformation helpers used by the items repository: row-to-item projection (with…
+- [migrations](./migrations/migrations.md) — <!-- begin:auto-docs --> _(no submodules)_- [helpers](./helpers.md) — `items-helpers.ts` extracts the pure transformation helpers used by the items repository: row-to-item projection (with…
 - [items](./items.md) — <!-- begin:auto-docs --> _(no submodules)_- migrations — <!-- begin:auto-docs --> _(no submodule…
 - [migrations](./migrations/migrations.md) — <!-- begin:auto-docs --> _(no submodules)_- [helpers](./helpers.md) — `items-helpers.ts` extracts the pure transformation helpers used by the items repository: row-to-item projection (with…
 - [items](./items.md) — <!-- begin:auto-docs --> _(no submodules)_- [migrations](./migrations/migrations.md) — <!-- begin:auto-docs --> _(no submodules)_- [helpers](./helpers.md) — `items-helpers.ts` extracts the pure transformation helpers used by the items repository: row-to-item projection (with…
@@ -12,6 +12,7 @@ _(no submodules)_
 - [items](./items.md) — <!-- begin:auto-docs --> _(no submodules)_- migrations — <!-- begin:auto-docs --> _(no submodul…
 - [migrations](./migrations/migrations.md) — <!-- begin:auto-docs --> _(no submodules)_- [helpers](./helpers.md) — `items-helpers.ts` extracts the pure transformation helpers used by the items repository: row-to-item projection (with…
 - [items](./items.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 `items.ts` exposes the `VaultItems` class, the in-memory CRUD repository over the vault container's item map. It is the boundary between the public `vault.items` surface and the underlying state — every public method validates input via Zod, mutates the container `Map<string, VaultItemRow>`, appends an audit entry to the container history, encrypts concealed-field values per item, and notifies the orchestrator that a flush is due.

plugins/document-navigator/docs/security-stack/security/vault/src/vault/vault.md

@@ -3,6 +3,7 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs --> - wiring — `wiring.ts` extracts the per-unlock module…
+
 - [wiring](./wiring.md) — `wiring.ts` extracts the per-unlock module factories used by `Vault`: `buildItems`, `buildSearch`, `buildAttachments`,…
 - wiring — `wiring.ts` extracts the per-unlock module…
 

plugins/document-navigator/docs/security-stack/security/x509/README.md

@@ -41,7 +41,9 @@ RFC 5280 X.509 v3 certificate parser and certification-path validator. Universal
 - [verify](./src/signature/verify.md) — The `signature/verify` module is part of the certificate signature-verify pipeline. Together with the rest of the `sign…
 - [trust-anchor](./src/validate/trust-anchor.md) — `validate/trust-anchor` is the core of the certificate path-validation pipeline. `validateChain` walks the certificate…
 - [validate-chain](./src/validate/validate-chain.md) — `validate/validate-chain` is the core of the certificate path-validation pipeline. `validateChain` walks the certificat…
+
 <!-- end:auto-docs -->  - [build-certs](./src/__fixtures__/build-certs.md) — <!-- begin:auto-docs --> _(no submodules)_- [decoder](./src/asn1/decoder.md) — Implements `decodeAsn1(bytes, mode)` covering every ASN.1 production used by RFC 5280 Appendix A: primitive scalars (`I…
+
 - [encoder](./src/asn1/encoder.md) — Implements `encodeAsn1(node)` producing canonical DER bytes per X.690 paragraph 10 for any `Asn1Node` the decoder accep…
 - [oid](./src/asn1/oid.md) — Encodes and decodes ASN.1 OBJECT IDENTIFIER bodies per X.690 paragraph 8.19. OIDs in X.509 identify algorithms, extensi…
 - [strings](./src/asn1/strings.md) — Decodes and encodes the typed ASN.1 string types used inside X.509 Names and SubjectAltName entries: `UTF8String`, `Pri…
@@ -202,4 +204,3 @@ console.log(result.trustedPath.length); // 3
 - __Certificate issuance / signing__ — follow-up `@suaveplan/x509-ca`.
 - __Policy mapping / policy constraints__ — decoded as `RawExtension`; critical occurrence triggers `CRITICAL_EXTENSION_UNRECOGNIZED` per RFC 5280 §6.1.4(f).
 - __PKCS#12 / PKCS#11 / smartcard__ — not in scope.
-