updated skills

plugins/document-navigator/docs/security-stack/crypto/crypto-bin/README.md

@@ -19,7 +19,9 @@ browser/server consumers that just want primitives.
   - [hash-password](./src/bin/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
 - [hash-password](./src/hash-password/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
   - [hash-password](./src/hash-password/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+
 <!-- end:auto-docs -->  - [hash-password](./src/bin/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_- [hash-password](./src/hash-password/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_- [hash-password](./src/hash-password/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_- [hash-password](./src/bin/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_- [hash-password](./src/hash-password/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_- [hash-password](./src/hash-password/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_- [hash-password](./src/bin/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_- [hash-password](./src/hash-password/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_- [hash-password](./src/hash-password/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_- [hash-password](./src/bin/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_- [hash-password](./src/hash-password/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_  - [hash-password](./src/hash-password/hash-password.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Quickstart
 
 ```bash
@@ -102,4 +104,3 @@ surfaced via `env.writeError(...)` and a non-zero return value. See
 
 No dependency on `@suaveplan/cli` — argv parsing is hand-rolled (~40
 lines) so the bin stays small.
-

plugins/document-navigator/docs/security-stack/crypto/crypto-cipher/src/primitives/aes-256-gcm/aes-256-gcm.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [aes-256-gcm.select](./aes-256-gcm.select/aes-256-gcm.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.native](./impl/aes-256-gcm.native/aes-256-gcm.native.md) — <!-- begin:auto-docs --> _(no submodules)_  - [aes-256-gcm.native](./impl/aes-256-gcm.native/aes-256-gcm.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.noble](./impl/aes-256-gcm.noble/aes-256-gcm.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [aes-256-gcm.noble](./impl/aes-256-gcm.noble/aes-256-gcm.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm](./aes-256-gcm.md) — <!-- begin:auto-docs --> _(no submodules)_- aes-256-gcm.select — <!-- begin:auto-docs --> _(no s…
+- [aes-256-gcm.select](./aes-256-gcm.select/aes-256-gcm.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.native](./impl/aes-256-gcm.native/aes-256-gcm.native.md) — <!-- begin:auto-docs --> _(no submodules)_  - [aes-256-gcm.native](./impl/aes-256-gcm.native/aes-256-gcm.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.noble](./impl/aes-256-gcm.noble/aes-256-gcm.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [aes-256-gcm.noble](./impl/aes-256-gcm.noble/aes-256-gcm.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm](./aes-256-gcm.md) — <!-- begin:auto-docs --> _(no submodules)_- aes-256-gcm.select — <!-- begin:auto-docs --> _(no s…
 - [aes-256-gcm.select](./aes-256-gcm.select/aes-256-gcm.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.native](./impl/aes-256-gcm.native/aes-256-gcm.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.native](./impl/aes-256-gcm.native/aes-256-gcm.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.noble](./impl/aes-256-gcm.noble/aes-256-gcm.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.noble](./impl/aes-256-gcm.noble/aes-256-gcm.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm](./aes-256-gcm.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.select](./aes-256-gcm.select/aes-256-gcm.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.native](./impl/aes-256-gcm.native/aes-256-gcm.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.native](./impl/aes-256-gcm.native/aes-256-gcm.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.noble](./impl/aes-256-gcm.noble/aes-256-gcm.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.noble](./impl/aes-256-gcm.noble/aes-256-gcm.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm](./aes-256-gcm.md) — <!-- begin:auto-docs --> _(no submodules)_- aes-256-gcm.select — <!-- be…
 - [aes-256-gcm.select](./aes-256-gcm.select/aes-256-gcm.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.native](./impl/aes-256-gcm.native/aes-256-gcm.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.native](./impl/aes-256-gcm.native/aes-256-gcm.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.noble](./impl/aes-256-gcm.noble/aes-256-gcm.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.noble](./impl/aes-256-gcm.noble/aes-256-gcm.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm](./aes-256-gcm.md) — <!-- begin:auto-docs --> _(no submodules)_- aes-256-gcm.select — <!-- begin:auto-docs --> _(no…
 - [aes-256-gcm.select](./aes-256-gcm.select/aes-256-gcm.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.native](./impl/aes-256-gcm.native/aes-256-gcm.native.md) — <!-- begin:auto-docs --> _(no submodules)_  - [aes-256-gcm.native](./impl/aes-256-gcm.native/aes-256-gcm.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm.noble](./impl/aes-256-gcm.noble/aes-256-gcm.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [aes-256-gcm.noble](./impl/aes-256-gcm.noble/aes-256-gcm.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [aes-256-gcm](./aes-256-gcm.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 `aes-256-gcm.ts` is the stable public entry point for the AES-256-GCM AEAD primitive in `@suaveplan/crypto-cipher`. It re-exports everything from the generated `aes-256-gcm.select.ts`, which forwards to either the Noble-backed or native implementation according to `crypto.config.ts`.

plugins/document-navigator/docs/security-stack/crypto/crypto-cipher/src/primitives/chacha20-poly1305/chacha20-poly1305.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [chacha20-poly1305.select](./chacha20-poly1305.select/chacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.native](./impl/chacha20-poly1305.native/chacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_  - [chacha20-poly1305.native](./impl/chacha20-poly1305.native/chacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.noble](./impl/chacha20-poly1305.noble/chacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [chacha20-poly1305.noble](./impl/chacha20-poly1305.noble/chacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305](./chacha20-poly1305.md) — <!-- begin:auto-docs --> _(no submodules)_- chacha20-poly1305.select — <!-- begin:auto-docs -->…
+- [chacha20-poly1305.select](./chacha20-poly1305.select/chacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.native](./impl/chacha20-poly1305.native/chacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_  - [chacha20-poly1305.native](./impl/chacha20-poly1305.native/chacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.noble](./impl/chacha20-poly1305.noble/chacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [chacha20-poly1305.noble](./impl/chacha20-poly1305.noble/chacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305](./chacha20-poly1305.md) — <!-- begin:auto-docs --> _(no submodules)_- chacha20-poly1305.select — <!-- begin:auto-docs -->…
 - [chacha20-poly1305.select](./chacha20-poly1305.select/chacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.native](./impl/chacha20-poly1305.native/chacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.native](./impl/chacha20-poly1305.native/chacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.noble](./impl/chacha20-poly1305.noble/chacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.noble](./impl/chacha20-poly1305.noble/chacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305](./chacha20-poly1305.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.select](./chacha20-poly1305.select/chacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.native](./impl/chacha20-poly1305.native/chacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.native](./impl/chacha20-poly1305.native/chacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.noble](./impl/chacha20-poly1305.noble/chacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.noble](./impl/chacha20-poly1305.noble/chacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305](./chacha20-poly1305.md) — <!-- begin:auto-docs --> _(no submodules)_- chacha20-poly1305.select — <…
 - [chacha20-poly1305.select](./chacha20-poly1305.select/chacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.native](./impl/chacha20-poly1305.native/chacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.native](./impl/chacha20-poly1305.native/chacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.noble](./impl/chacha20-poly1305.noble/chacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.noble](./impl/chacha20-poly1305.noble/chacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305](./chacha20-poly1305.md) — <!-- begin:auto-docs --> _(no submodules)_- chacha20-poly1305.select — <!-- begin:auto-docs -->…
 - [chacha20-poly1305.select](./chacha20-poly1305.select/chacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.native](./impl/chacha20-poly1305.native/chacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_  - [chacha20-poly1305.native](./impl/chacha20-poly1305.native/chacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305.noble](./impl/chacha20-poly1305.noble/chacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [chacha20-poly1305.noble](./impl/chacha20-poly1305.noble/chacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [chacha20-poly1305](./chacha20-poly1305.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 `chacha20-poly1305.ts` is the stable public entry point for the ChaCha20-Poly1305 AEAD primitive in `@suaveplan/crypto-cipher`. It re-exports everything from the generated `chacha20-poly1305.select.ts`, which forwards to either the Noble-backed or native implementation based on `crypto.config.ts`.

plugins/document-navigator/docs/security-stack/crypto/crypto-cipher/src/primitives/xchacha20-poly1305/xchacha20-poly1305.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [xchacha20-poly1305.native](./impl/xchacha20-poly1305.native/xchacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.noble](./impl/xchacha20-poly1305.noble/xchacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [xchacha20-poly1305.noble](./impl/xchacha20-poly1305.noble/xchacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.select](./xchacha20-poly1305.select/xchacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [xchacha20-poly1305.select](./xchacha20-poly1305.select/xchacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305](./xchacha20-poly1305.md) — <!-- begin:auto-docs --> _(no submodules)_- xchacha20-poly1305.native — <!-- begin:auto-docs -->…
+- [xchacha20-poly1305.native](./impl/xchacha20-poly1305.native/xchacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.noble](./impl/xchacha20-poly1305.noble/xchacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [xchacha20-poly1305.noble](./impl/xchacha20-poly1305.noble/xchacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.select](./xchacha20-poly1305.select/xchacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [xchacha20-poly1305.select](./xchacha20-poly1305.select/xchacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305](./xchacha20-poly1305.md) — <!-- begin:auto-docs --> _(no submodules)_- xchacha20-poly1305.native — <!-- begin:auto-docs -->…
 - [xchacha20-poly1305.native](./impl/xchacha20-poly1305.native/xchacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.noble](./impl/xchacha20-poly1305.noble/xchacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.noble](./impl/xchacha20-poly1305.noble/xchacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.select](./xchacha20-poly1305.select/xchacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.select](./xchacha20-poly1305.select/xchacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305](./xchacha20-poly1305.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.native](./impl/xchacha20-poly1305.native/xchacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.noble](./impl/xchacha20-poly1305.noble/xchacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.noble](./impl/xchacha20-poly1305.noble/xchacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.select](./xchacha20-poly1305.select/xchacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.select](./xchacha20-poly1305.select/xchacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305](./xchacha20-poly1305.md) — <!-- begin:auto-docs --> _(no submodules)_- xchacha20-poly1305.native —…
 - [xchacha20-poly1305.native](./impl/xchacha20-poly1305.native/xchacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.noble](./impl/xchacha20-poly1305.noble/xchacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.noble](./impl/xchacha20-poly1305.noble/xchacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.select](./xchacha20-poly1305.select/xchacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.select](./xchacha20-poly1305.select/xchacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305](./xchacha20-poly1305.md) — <!-- begin:auto-docs --> _(no submodules)_- xchacha20-poly1305.native — <!-- begin:auto-docs --…
 - [xchacha20-poly1305.native](./impl/xchacha20-poly1305.native/xchacha20-poly1305.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.noble](./impl/xchacha20-poly1305.noble/xchacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [xchacha20-poly1305.noble](./impl/xchacha20-poly1305.noble/xchacha20-poly1305.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305.select](./xchacha20-poly1305.select/xchacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [xchacha20-poly1305.select](./xchacha20-poly1305.select/xchacha20-poly1305.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [xchacha20-poly1305](./xchacha20-poly1305.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 `xchacha20-poly1305.ts` is the stable public entry point for the XChaCha20-Poly1305 AEAD primitive in `@suaveplan/crypto-cipher`. It re-exports from the generated `xchacha20-poly1305.select.ts`, which forwards to the Noble-backed or native implementation based on `crypto.config.ts`.

plugins/document-navigator/docs/security-stack/crypto/crypto-core/README.md

@@ -39,6 +39,7 @@ Universal cryptographic primitives — engine-pluggable AEAD, Ed25519/ECDSA-P256
   - [ed25519](./src/sign/ed25519/ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
 - [noble-sign-engine](./src/sign/noble-sign-engine/noble-sign-engine.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
   - [noble-sign-engine](./src/sign/noble-sign-engine/noble-sign-engine.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+
 <!-- end:auto-docs -->  - [noble-aead-engine](./src/aead/noble-aead-engine/noble-aead-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-aead-engine](./src/aead/noble-aead-engine/noble-aead-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [aead](./src/aead/aead.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-agree-engine](./src/agree/noble-agree-engine/noble-agree-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-agree-engine](./src/agree/noble-agree-engine/noble-agree-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519](./src/agree/x25519/x25519.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519](./src/agree/x25519/x25519.md) — <!-- begin:auto-docs --> _(no submodules)_- [auth-box](./src/auth-box/auth-box.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-auth-box-engine](./src/auth-box/noble-auth-box-engine/noble-auth-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-auth-box-engine](./src/auth-box/noble-auth-box-engine/noble-auth-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [auth-box](./src/auth-box/auth-box.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-error](./src/errors/crypto-error/crypto-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-error](./src/errors/crypto-error/crypto-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [constant-time-equal](./src/primitives/constant-time-equal/constant-time-equal.md) — <!-- begin:auto-docs --> _(no submodules)_- [constant-time-equal](./src/primitives/constant-time-equal/constant-time-equal.md) — <!-- begin:auto-docs --> _(no submodules)_- [random-bytes](./src/primitives/random-bytes/random-bytes.md) — <!-- begin:auto-docs --> _(no submodules)_- [random-bytes](./src/primitives/random-bytes/random-bytes.md) — <!-- begin:auto-docs --> _(no submodules)_- [zeroize](./src/primitives/zeroize/zeroize.md) — <!-- begin:auto-docs --> _(no submodules)_- [zeroize](./src/primitives/zeroize/zeroize.md) — <!-- begin:auto-docs --> _(no submodules)_- [sealed-box](./src/sealed-box/sealed-box.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-sealed-box-engine](./src/sealed-box/noble-sealed-box-engine/noble-sealed-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-sealed-box-engine](./src/sealed-box/noble-sealed-box-engine/noble-sealed-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [sealed-box](./src/sealed-box/sealed-box.md) — <!-- begin:auto-docs --> _(no submodules)_- [ecdsa-p256](./src/sign/ecdsa-p256/ecdsa-p256.md) — <!-- begin:auto-docs --> _(no submodules)_- [ecdsa-p256](./src/sign/ecdsa-p256/ecdsa-p256.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519](./src/sign/ed25519/ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519](./src/sign/ed25519/ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-sign-engine](./src/sign/noble-sign-engine/noble-sign-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-sign-engine](./src/sign/noble-sign-engine/noble-sign-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-aead-engine — <!-- beg…
 
 - [noble-aead-engine](./src/aead/noble-aead-engine/noble-aead-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-aead-engine](./src/aead/noble-aead-engine/noble-aead-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [aead](./src/aead/aead.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-aead-engine — <!-- beg…
@@ -54,6 +55,7 @@ Universal cryptographic primitives — engine-pluggable AEAD, Ed25519/ECDSA-P256
 - [codes](./src/errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-error](./src/errors/crypto-error/crypto-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-error](./src/errors/crypto-error/crypto-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [constant-time-equal](./src/primitives/constant-time-equal/constant-time-equal.md) — <!-- begin:auto-docs --> _(no submodules)_- [constant-time-equal](./src/primitives/constant-time-equal/constant-time-equal.md) — <!-- begin:auto-docs --> _(no submodules)_- [random-bytes](./src/primitives/random-bytes/random-bytes.md) — <!-- begin:auto-docs --> _(no submodules)_- [random-bytes](./src/primitives/random-bytes/random-bytes.md) — <!-- begin:auto-docs --> _(no submodules)_- [zeroize](./src/primitives/zeroize/zeroize.md) — <!-- begin:auto-docs --> _(no submodules)_- [zeroize](./src/primitives/zeroize/zeroize.md) — <!-- begin:auto-docs --> _(no submodules)_- [sealed-box](./src/sealed-box/sealed-box.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-sealed-box-engine — <!-- begin:auto-docs -->…
   - [noble-sealed-box-engine](./src/sealed-box/noble-sealed-box-engine/noble-sealed-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-sealed-box-engine](./src/sealed-box/noble-sealed-box-engine/noble-sealed-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [sealed-box](./src/sealed-box/sealed-box.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-sealed-box-engine — <!-- begin:auto-docs -->…
 - [ecdsa-p256](./src/sign/ecdsa-p256/ecdsa-p256.md) — <!-- begin:auto-docs --> _(no submodules)_- [ecdsa-p256](./src/sign/ecdsa-p256/ecdsa-p256.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519](./src/sign/ed25519/ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519](./src/sign/ed25519/ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-sign-engine](./src/sign/noble-sign-engine/noble-sign-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-sign-engine](./src/sign/noble-sign-engine/noble-sign-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-aead-engine](./src/aead/noble-aead-engine/noble-aead-engine.md) — <!-- begin:auto-docs --> _(no submodules)_  - [noble-aead-engine](./src/aead/noble-aead-engine/noble-aead-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [aead](./src/aead/aead.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-agree-engine](./src/agree/noble-agree-engine/noble-agree-engine.md) — <!-- begin:auto-docs --> _(no submodules)_  - [noble-agree-engine](./src/agree/noble-agree-engine/noble-agree-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519](./src/agree/x25519/x25519.md) — <!-- begin:auto-docs --> _(no submodules)_  - [x25519](./src/agree/x25519/x25519.md) — <!-- begin:auto-docs --> _(no submodules)_- [auth-box](./src/auth-box/auth-box.md) — <!-- begin:auto-docs --> _(no submodules)_  - [noble-auth-box-engine](./src/auth-box/noble-auth-box-engine/noble-auth-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_    - [noble-auth-box-engine](./src/auth-box/noble-auth-box-engine/noble-auth-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_  - [auth-box](./src/auth-box/auth-box.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_  - [codes](./src/errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-error](./src/errors/crypto-error/crypto-error.md) — <!-- begin:auto-docs --> _(no submodules)_  - [crypto-error](./src/errors/crypto-error/crypto-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [constant-time-equal](./src/primitives/constant-time-equal/constant-time-equal.md) — <!-- begin:auto-docs --> _(no submodules)_  - [constant-time-equal](./src/primitives/constant-time-equal/constant-time-equal.md) — <!-- begin:auto-docs --> _(no submodules)_- [random-bytes](./src/primitives/random-bytes/random-bytes.md) — <!-- begin:auto-docs --> _(no submodules)_  - [random-bytes](./src/primitives/random-bytes/random-bytes.md) — <!-- begin:auto-docs --> _(no submodules)_- [zeroize](./src/primitives/zeroize/zeroize.md) — <!-- begin:auto-docs --> _(no submodules)_  - [zeroize](./src/primitives/zeroize/zeroize.md) — <!-- begin:auto-docs --> _(no submodules)_- [sealed-box](./src/sealed-box/sealed-box.md) — <!-- begin:auto-docs --> _(no submodules)_  - [noble-sealed-box-engine](./src/sealed-box/noble-sealed-box-engine/noble-sealed-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_    - [noble-sealed-box-engine](./src/sealed-box/noble-sealed-box-engine/noble-sealed-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_  - [sealed-box](./src/sealed-box/sealed-box.md) — <!-- begin:auto-docs --> _(no submodules)_- [ecdsa-p256](./src/sign/ecdsa-p256/ecdsa-p256.md) — <!-- begin:auto-docs --> _(no submodules)_  - [ecdsa-p256](./src/sign/ecdsa-p256/ecdsa-p256.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519](./src/sign/ed25519/ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_  - [ed25519](./src/sign/ed25519/ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-sign-engine](./src/sign/noble-sign-engine/noble-sign-engine.md) — <!-- begin:auto-docs --> _(no submodules)_  - [noble-sign-engine](./src/sign/noble-sign-engine/noble-sign-engine.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Install
 
 ```bash

plugins/document-navigator/docs/security-stack/crypto/crypto-core/src/aead/aead.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [noble-aead-engine](./noble-aead-engine/noble-aead-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [aead](./aead.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-aead-engine — <!-- begin:auto-docs --> _(no su…
+- [noble-aead-engine](./noble-aead-engine/noble-aead-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [aead](./aead.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-aead-engine — <!-- begin:auto-docs --> _(no su…
 - [noble-aead-engine](./noble-aead-engine/noble-aead-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [aead](./aead.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-aead-engine](./noble-aead-engine/noble-aead-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [aead](./aead.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-aead-engine — <!-- beg…
 - [noble-aead-engine](./noble-aead-engine/noble-aead-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [aead](./aead.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-aead-engine — <!-- begin:auto-docs --> _(no s…
 - [noble-aead-engine](./noble-aead-engine/noble-aead-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [aead](./aead.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 Provides authenticated encryption with associated data (AEAD) facade functions backed by `@noble/ciphers`. AEAD combines confidentiality and integrity in a single operation — encrypted data includes an authentication tag that is verified before decryption, making it safe against ciphertext tampering. The facade is engine-pluggable: pass `{ engine }` to swap in a WebCrypto-backed or libsodium-backed implementation without changing calling code.

plugins/document-navigator/docs/security-stack/crypto/crypto-core/src/auth-box/auth-box.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [noble-auth-box-engine](./noble-auth-box-engine/noble-auth-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [auth-box](./auth-box.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-auth-box-engine — <!-- begin:auto-docs --> _(n…
+- [noble-auth-box-engine](./noble-auth-box-engine/noble-auth-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [auth-box](./auth-box.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-auth-box-engine — <!-- begin:auto-docs --> _(n…
 - [noble-auth-box-engine](./noble-auth-box-engine/noble-auth-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [auth-box](./auth-box.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-auth-box-engine](./noble-auth-box-engine/noble-auth-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [auth-box](./auth-box.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-auth-box-engine — <!--…
 - [noble-auth-box-engine](./noble-auth-box-engine/noble-auth-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [auth-box](./auth-box.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-auth-box-engine — <!-- begin:auto-docs --> _(…
 - [noble-auth-box-engine](./noble-auth-box-engine/noble-auth-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [auth-box](./auth-box.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 Provides authenticated sealed-box encryption following `crypto_box` semantics. Unlike the anonymous `sealedBox`, the auth-box binds the sender's identity to the ciphertext: the recipient can verify that only the holder of the sender's secret key could have produced it. The protocol uses X25519 ECDH key agreement, HKDF-SHA256 key derivation, and XChaCha20-Poly1305 encryption. Both parties must hold each other's public keys before communicating, making this suitable for protocols with established key exchange such as Signal-style messaging or server-to-server encryption.

plugins/document-navigator/docs/security-stack/crypto/crypto-core/src/sealed-box/sealed-box.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [noble-sealed-box-engine](./noble-sealed-box-engine/noble-sealed-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [sealed-box](./sealed-box.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-sealed-box-engine — <!-- begin:auto-docs --> _…
+- [noble-sealed-box-engine](./noble-sealed-box-engine/noble-sealed-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [sealed-box](./sealed-box.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-sealed-box-engine — <!-- begin:auto-docs --> _…
 - [noble-sealed-box-engine](./noble-sealed-box-engine/noble-sealed-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [sealed-box](./sealed-box.md) — <!-- begin:auto-docs --> _(no submodules)_- [noble-sealed-box-engine](./noble-sealed-box-engine/noble-sealed-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [sealed-box](./sealed-box.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-sealed-box-engine — <!…
 - [noble-sealed-box-engine](./noble-sealed-box-engine/noble-sealed-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [sealed-box](./sealed-box.md) — <!-- begin:auto-docs --> _(no submodules)_- noble-sealed-box-engine — <!-- begin:auto-docs -->…
 - [noble-sealed-box-engine](./noble-sealed-box-engine/noble-sealed-box-engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [sealed-box](./sealed-box.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 Provides anonymous-sender sealed-box encryption following `crypto_box_seal` semantics. The sender generates an ephemeral X25519 keypair, performs ECDH with the recipient's public key, derives a symmetric key via HKDF-SHA256, then encrypts with XChaCha20-Poly1305. The ephemeral public key is prepended to the ciphertext blob so the recipient can derive the same symmetric key without the sender needing to reveal their identity. This pattern is commonly used for one-way encrypted messages where sender anonymity is desired.

plugins/document-navigator/docs/security-stack/crypto/crypto-curve/src/primitives/ed25519/ed25519.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [ed25519.select](./ed25519.select/ed25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.native](./impl/ed25519.native/ed25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_  - [ed25519.native](./impl/ed25519.native/ed25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.noble](./impl/ed25519.noble/ed25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [ed25519.noble](./impl/ed25519.noble/ed25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519](./ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_- ed25519.select — <!-- begin:auto-docs --> _(no submo…
+- [ed25519.select](./ed25519.select/ed25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.native](./impl/ed25519.native/ed25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_  - [ed25519.native](./impl/ed25519.native/ed25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.noble](./impl/ed25519.noble/ed25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [ed25519.noble](./impl/ed25519.noble/ed25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519](./ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_- ed25519.select — <!-- begin:auto-docs --> _(no submo…
 - [ed25519.select](./ed25519.select/ed25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.native](./impl/ed25519.native/ed25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.native](./impl/ed25519.native/ed25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.noble](./impl/ed25519.noble/ed25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.noble](./impl/ed25519.noble/ed25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519](./ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.select](./ed25519.select/ed25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.native](./impl/ed25519.native/ed25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.native](./impl/ed25519.native/ed25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.noble](./impl/ed25519.noble/ed25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.noble](./impl/ed25519.noble/ed25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519](./ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_- ed25519.select — <!-- begin:…
 - [ed25519.select](./ed25519.select/ed25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.native](./impl/ed25519.native/ed25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.native](./impl/ed25519.native/ed25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.noble](./impl/ed25519.noble/ed25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.noble](./impl/ed25519.noble/ed25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519](./ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_- ed25519.select — <!-- begin:auto-docs --> _(no subm…
 - [ed25519.select](./ed25519.select/ed25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.native](./impl/ed25519.native/ed25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_  - [ed25519.native](./impl/ed25519.native/ed25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519.noble](./impl/ed25519.noble/ed25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [ed25519.noble](./impl/ed25519.noble/ed25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [ed25519](./ed25519.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 Ed25519 is the Edwards-curve Digital Signature Algorithm defined in RFC 8032, the recommended signature scheme for new protocols. Compared with ECDSA it has deterministic signatures (no per-signature randomness needed), constant-time verification of well-formed inputs, small 32-byte public keys and 64-byte signatures, and formal soundness properties that make it the baseline choice for TLS, SSH, JWT signing, and peer-to-peer identity. This module exposes the primitive directly — key generation, signing, verification, and public-key derivation — as thin wrappers over `@noble/curves/ed25519`, with a paired `native` stub that throws `PrimitiveNotImplemented`. Selection between the two is controlled by `crypto.config.ts` at build time.

plugins/document-navigator/docs/security-stack/crypto/crypto-curve/src/primitives/p256/p256.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [p256.native](./impl/p256.native/p256.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.noble](./impl/p256.noble/p256.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p256.noble](./impl/p256.noble/p256.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.select](./p256.select/p256.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p256.select](./p256.select/p256.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256](./p256.md) — <!-- begin:auto-docs --> _(no submodules)_- p256.native — <!-- begin:auto-docs --> _(no submodul…
+- [p256.native](./impl/p256.native/p256.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.noble](./impl/p256.noble/p256.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p256.noble](./impl/p256.noble/p256.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.select](./p256.select/p256.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p256.select](./p256.select/p256.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256](./p256.md) — <!-- begin:auto-docs --> _(no submodules)_- p256.native — <!-- begin:auto-docs --> _(no submodul…
 - [p256.native](./impl/p256.native/p256.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.noble](./impl/p256.noble/p256.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.noble](./impl/p256.noble/p256.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.select](./p256.select/p256.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.select](./p256.select/p256.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256](./p256.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.native](./impl/p256.native/p256.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.noble](./impl/p256.noble/p256.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.noble](./impl/p256.noble/p256.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.select](./p256.select/p256.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.select](./p256.select/p256.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256](./p256.md) — <!-- begin:auto-docs --> _(no submodules)_- p256.native — <!-- begin:aut…
 - [p256.native](./impl/p256.native/p256.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.noble](./impl/p256.noble/p256.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.noble](./impl/p256.noble/p256.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.select](./p256.select/p256.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.select](./p256.select/p256.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256](./p256.md) — <!-- begin:auto-docs --> _(no submodules)_- p256.native — <!-- begin:auto-docs --> _(no submodu…
 - [p256.native](./impl/p256.native/p256.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.noble](./impl/p256.noble/p256.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p256.noble](./impl/p256.noble/p256.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256.select](./p256.select/p256.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p256.select](./p256.select/p256.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p256](./p256.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 `p256.ts` is the stable public entry point for the NIST P-256 elliptic-curve primitive in `@suaveplan/crypto-curve`. It re-exports everything from `p256.select.ts`, which forwards to either the Noble-backed or native implementation based on `crypto.config.ts`.

plugins/document-navigator/docs/security-stack/crypto/crypto-curve/src/primitives/p384/p384.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [p384.native](./impl/p384.native/p384.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.noble](./impl/p384.noble/p384.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p384.noble](./impl/p384.noble/p384.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.select](./p384.select/p384.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p384.select](./p384.select/p384.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384](./p384.md) — <!-- begin:auto-docs --> _(no submodules)_- p384.native — <!-- begin:auto-docs --> _(no submodul…
+- [p384.native](./impl/p384.native/p384.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.noble](./impl/p384.noble/p384.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p384.noble](./impl/p384.noble/p384.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.select](./p384.select/p384.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p384.select](./p384.select/p384.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384](./p384.md) — <!-- begin:auto-docs --> _(no submodules)_- p384.native — <!-- begin:auto-docs --> _(no submodul…
 - [p384.native](./impl/p384.native/p384.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.noble](./impl/p384.noble/p384.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.noble](./impl/p384.noble/p384.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.select](./p384.select/p384.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.select](./p384.select/p384.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384](./p384.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.native](./impl/p384.native/p384.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.noble](./impl/p384.noble/p384.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.noble](./impl/p384.noble/p384.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.select](./p384.select/p384.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.select](./p384.select/p384.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384](./p384.md) — <!-- begin:auto-docs --> _(no submodules)_- p384.native — <!-- begin:aut…
 - [p384.native](./impl/p384.native/p384.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.noble](./impl/p384.noble/p384.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.noble](./impl/p384.noble/p384.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.select](./p384.select/p384.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.select](./p384.select/p384.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384](./p384.md) — <!-- begin:auto-docs --> _(no submodules)_- p384.native — <!-- begin:auto-docs --> _(no submodu…
 - [p384.native](./impl/p384.native/p384.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.noble](./impl/p384.noble/p384.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p384.noble](./impl/p384.noble/p384.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384.select](./p384.select/p384.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p384.select](./p384.select/p384.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p384](./p384.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 `p384.ts` is the stable public entry point for the NIST P-384 elliptic-curve

plugins/document-navigator/docs/security-stack/crypto/crypto-curve/src/primitives/p521/p521.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [p521.native](./impl/p521.native/p521.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.noble](./impl/p521.noble/p521.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p521.noble](./impl/p521.noble/p521.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.select](./p521.select/p521.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p521.select](./p521.select/p521.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521](./p521.md) — <!-- begin:auto-docs --> _(no submodules)_- p521.native — <!-- begin:auto-docs --> _(no submodul…
+- [p521.native](./impl/p521.native/p521.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.noble](./impl/p521.noble/p521.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p521.noble](./impl/p521.noble/p521.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.select](./p521.select/p521.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p521.select](./p521.select/p521.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521](./p521.md) — <!-- begin:auto-docs --> _(no submodules)_- p521.native — <!-- begin:auto-docs --> _(no submodul…
 - [p521.native](./impl/p521.native/p521.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.noble](./impl/p521.noble/p521.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.noble](./impl/p521.noble/p521.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.select](./p521.select/p521.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.select](./p521.select/p521.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521](./p521.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.native](./impl/p521.native/p521.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.noble](./impl/p521.noble/p521.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.noble](./impl/p521.noble/p521.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.select](./p521.select/p521.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.select](./p521.select/p521.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521](./p521.md) — <!-- begin:auto-docs --> _(no submodules)_- p521.native — <!-- begin:aut…
 - [p521.native](./impl/p521.native/p521.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.noble](./impl/p521.noble/p521.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.noble](./impl/p521.noble/p521.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.select](./p521.select/p521.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.select](./p521.select/p521.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521](./p521.md) — <!-- begin:auto-docs --> _(no submodules)_- p521.native — <!-- begin:auto-docs --> _(no submodu…
 - [p521.native](./impl/p521.native/p521.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.noble](./impl/p521.noble/p521.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p521.noble](./impl/p521.noble/p521.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521.select](./p521.select/p521.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [p521.select](./p521.select/p521.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [p521](./p521.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 `p521.ts` is the stable public entry point for the NIST P-521 elliptic-curve

plugins/document-navigator/docs/security-stack/crypto/crypto-curve/src/primitives/secp256k1/secp256k1.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [secp256k1.native](./impl/secp256k1.native/secp256k1.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.noble](./impl/secp256k1.noble/secp256k1.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [secp256k1.noble](./impl/secp256k1.noble/secp256k1.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.select](./secp256k1.select/secp256k1.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [secp256k1.select](./secp256k1.select/secp256k1.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1](./secp256k1.md) — <!-- begin:auto-docs --> _(no submodules)_- secp256k1.native — <!-- begin:auto-docs --> _(no sub…
+- [secp256k1.native](./impl/secp256k1.native/secp256k1.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.noble](./impl/secp256k1.noble/secp256k1.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [secp256k1.noble](./impl/secp256k1.noble/secp256k1.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.select](./secp256k1.select/secp256k1.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [secp256k1.select](./secp256k1.select/secp256k1.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1](./secp256k1.md) — <!-- begin:auto-docs --> _(no submodules)_- secp256k1.native — <!-- begin:auto-docs --> _(no sub…
 - [secp256k1.native](./impl/secp256k1.native/secp256k1.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.noble](./impl/secp256k1.noble/secp256k1.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.noble](./impl/secp256k1.noble/secp256k1.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.select](./secp256k1.select/secp256k1.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.select](./secp256k1.select/secp256k1.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1](./secp256k1.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.native](./impl/secp256k1.native/secp256k1.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.noble](./impl/secp256k1.noble/secp256k1.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.noble](./impl/secp256k1.noble/secp256k1.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.select](./secp256k1.select/secp256k1.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.select](./secp256k1.select/secp256k1.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1](./secp256k1.md) — <!-- begin:auto-docs --> _(no submodules)_- secp256k1.native — <!-- begi…
 - [secp256k1.native](./impl/secp256k1.native/secp256k1.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.noble](./impl/secp256k1.noble/secp256k1.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.noble](./impl/secp256k1.noble/secp256k1.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.select](./secp256k1.select/secp256k1.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.select](./secp256k1.select/secp256k1.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1](./secp256k1.md) — <!-- begin:auto-docs --> _(no submodules)_- secp256k1.native — <!-- begin:auto-docs --> _(no su…
 - [secp256k1.native](./impl/secp256k1.native/secp256k1.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.noble](./impl/secp256k1.noble/secp256k1.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [secp256k1.noble](./impl/secp256k1.noble/secp256k1.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1.select](./secp256k1.select/secp256k1.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [secp256k1.select](./secp256k1.select/secp256k1.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [secp256k1](./secp256k1.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 `secp256k1.ts` is the stable public entry point for the secp256k1 elliptic-curve primitive in `@suaveplan/crypto-curve`. It re-exports everything from the generated selector file `secp256k1.select.ts`, which in turn forwards to either the Noble-backed or native implementation depending on `crypto.config.ts`.

plugins/document-navigator/docs/security-stack/crypto/crypto-curve/src/primitives/x25519/x25519.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [x25519.native](./impl/x25519.native/x25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.noble](./impl/x25519.noble/x25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [x25519.noble](./impl/x25519.noble/x25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.select](./x25519.select/x25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [x25519.select](./x25519.select/x25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519](./x25519.md) — <!-- begin:auto-docs --> _(no submodules)_- x25519.native — <!-- begin:auto-docs --> _(no submod…
+- [x25519.native](./impl/x25519.native/x25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.noble](./impl/x25519.noble/x25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [x25519.noble](./impl/x25519.noble/x25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.select](./x25519.select/x25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [x25519.select](./x25519.select/x25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519](./x25519.md) — <!-- begin:auto-docs --> _(no submodules)_- x25519.native — <!-- begin:auto-docs --> _(no submod…
 - [x25519.native](./impl/x25519.native/x25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.noble](./impl/x25519.noble/x25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.noble](./impl/x25519.noble/x25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.select](./x25519.select/x25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.select](./x25519.select/x25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519](./x25519.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.native](./impl/x25519.native/x25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.noble](./impl/x25519.noble/x25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.noble](./impl/x25519.noble/x25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.select](./x25519.select/x25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.select](./x25519.select/x25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519](./x25519.md) — <!-- begin:auto-docs --> _(no submodules)_- x25519.native — <!-- begin:a…
 - [x25519.native](./impl/x25519.native/x25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.noble](./impl/x25519.noble/x25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.noble](./impl/x25519.noble/x25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.select](./x25519.select/x25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.select](./x25519.select/x25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519](./x25519.md) — <!-- begin:auto-docs --> _(no submodules)_- x25519.native — <!-- begin:auto-docs --> _(no submo…
 - [x25519.native](./impl/x25519.native/x25519.native.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.noble](./impl/x25519.noble/x25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_  - [x25519.noble](./impl/x25519.noble/x25519.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519.select](./x25519.select/x25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_  - [x25519.select](./x25519.select/x25519.select.md) — <!-- begin:auto-docs --> _(no submodules)_- [x25519](./x25519.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 `x25519.ts` is the stable public entry point for the X25519 elliptic-curve Diffie-Hellman primitive in `@suaveplan/crypto-curve`. It re-exports everything from `x25519.select.ts`, which forwards to either the Noble-backed or native implementation based on `crypto.config.ts`.

plugins/document-navigator/docs/security-stack/crypto/crypto-hash/src/primitives/blake2b/blake2b.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [blake2b.noble](./impl/blake2b.noble/blake2b.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [blake2b](./blake2b.md) — <!-- begin:auto-docs --> _(no submodules)_- blake2b.noble — <!-- begin:auto-docs --> _(no submod…
+- [blake2b.noble](./impl/blake2b.noble/blake2b.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [blake2b](./blake2b.md) — <!-- begin:auto-docs --> _(no submodules)_- blake2b.noble — <!-- begin:auto-docs --> _(no submod…
 - [blake2b.noble](./impl/blake2b.noble/blake2b.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [blake2b](./blake2b.md) — <!-- begin:auto-docs --> _(no submodules)_- [blake2b.noble](./impl/blake2b.noble/blake2b.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [blake2b](./blake2b.md) — <!-- begin:auto-docs --> _(no submodules)_- blake2b.noble — <!-- begin:a…
 - [blake2b.noble](./impl/blake2b.noble/blake2b.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [blake2b](./blake2b.md) — <!-- begin:auto-docs --> _(no submodules)_- blake2b.noble — <!-- begin:auto-docs --> _(no submo…
 - [blake2b.noble](./impl/blake2b.noble/blake2b.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [blake2b](./blake2b.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 `blake2b.ts` is the public entry point for the BLAKE2b hash primitive (RFC 7693) in `@suaveplan/crypto-hash`. BLAKE2b is a fast, secure cryptographic hash function used by Argon2, password-manager keystreams, blockchain-protocol commitments (Zcash, Polkadot), and many other modern protocols. The suaveplan implementation routes through the per-primitive selector layout (`blake2b.select.ts`) so the noble engine can be replaced without changing caller imports.

plugins/document-navigator/docs/security-stack/crypto/crypto-hash/src/primitives/scrypt/scrypt.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [scrypt.noble](./impl/scrypt.noble/scrypt.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [scrypt](./scrypt.md) — <!-- begin:auto-docs --> _(no submodules)_- scrypt.noble — <!-- begin:auto-docs --> _(no submodu…
+- [scrypt.noble](./impl/scrypt.noble/scrypt.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [scrypt](./scrypt.md) — <!-- begin:auto-docs --> _(no submodules)_- scrypt.noble — <!-- begin:auto-docs --> _(no submodu…
 - [scrypt.noble](./impl/scrypt.noble/scrypt.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [scrypt](./scrypt.md) — <!-- begin:auto-docs --> _(no submodules)_- [scrypt.noble](./impl/scrypt.noble/scrypt.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [scrypt](./scrypt.md) — <!-- begin:auto-docs --> _(no submodules)_- scrypt.noble — <!-- begin:au…
 - [scrypt.noble](./impl/scrypt.noble/scrypt.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [scrypt](./scrypt.md) — <!-- begin:auto-docs --> _(no submodules)_- scrypt.noble — <!-- begin:auto-docs --> _(no submod…
 - [scrypt.noble](./impl/scrypt.noble/scrypt.noble.md) — <!-- begin:auto-docs --> _(no submodules)_- [scrypt](./scrypt.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 `scrypt.ts` is the public entry point for the scrypt KDF (RFC 7914) primitive in `@suaveplan/crypto-hash`. scrypt is a memory-hard password-based key derivation function — its `N` parameter forces an attacker to allocate `N * r * 64` bytes of fast memory per guess, which makes brute-force attacks on hardware accelerators dramatically more expensive than they would be against PBKDF2 or even bcrypt. It is the right KDF when callers want stronger memory-hardness than PBKDF2 but cannot adopt Argon2id (e.g. cross-stack interop with older Bitcoin / Litecoin tooling, or compatibility with the standard library on platforms that ship scrypt natively).

plugins/document-navigator/docs/security-stack/crypto/crypto-keys/README.md

@@ -189,4 +189,3 @@ with a stable `CHAIN_KEYS.*` code. Verification failures don't throw;
 they return `{ valid: false, errors: [...] }` so callers can chain
 multiple verification attempts without try/catch. Only construction-time
 errors (e.g. an invalid `domainTag`) throw synchronously.
-

plugins/document-navigator/docs/security-stack/crypto/crypto-rsa/README.md

@@ -20,75 +20,77 @@ encrypt / decrypt / key-generation entry points, the engine adapter (`@noble/cur
 <!-- begin:auto-docs -->
 ## Documentation tree
 
-- [__benchmarks__](./src/__benchmarks__/blinded_vs_unblinded_2048.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
-  - [blinded_vs_unblinded_2048](./src/__benchmarks__/blinded_vs_unblinded_2048.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
-- [rsa-2048-key](./src/__fixtures__/rsa-2048-key.md) — Real 2048-bit RSA keypair generated once at module-load time and exposed as canonical `RsaPublicKey` / `RsaPrivateKey`…
-- [test-keys](./src/__fixtures__/test-keys.md) — Tiny synthetic RSA keypair for unit tests that need an `RsaPrivateKey` / `RsaPublicKey` shape but don't need to run a r…
-- [reader](./src/asn1/reader.md) — Strict-DER reader scoped to the RSA key shapes defined in RFC 8017 Appendix A (PKCS#1), RFC 5280 §4.1 + Appendix A (`Su…
-- [writer](./src/asn1/writer.md) — Strict-DER encoder mirroring `asn1/reader`. Encodes the same minimal subset of ASN.1 needed to serialise RSA keys in PK…
-- [blinding](./src/blinding/blinding.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
-  - [blinding](./src/blinding/blinding.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
-- [oaep](./src/decrypt/oaep.md) — RSAES-OAEP decryption per RFC 8017 §7.1.2 — counterpart to `encrypt/oaep`. Modern default for RSA public-key encryption.
-- [pkcs1v15](./src/decrypt/pkcs1v15.md) — RSAES-PKCS1-v1_5 decryption per RFC 8017 §7.2.2. Counterpart to `encrypt/pkcs1v15`. Provides legacy interop for protoco…
-- [emsa-pkcs1-v1_5](./src/encoding/emsa-pkcs1-v1_5.md) — Implements EMSA-PKCS1-v1\_5-ENCODE from RFC 8017 §9.2 — the encoding method underlying RSASSA-PKCS1-v1\_5 signatures. T…
-- [emsa-pss-encode](./src/encoding/emsa-pss-encode.md) — Implements the EMSA-PSS encoding operation defined in RFC 8017 §9.1.1. Given a message digest, an encoded-message bit l…
-- [emsa-pss-verify](./src/encoding/emsa-pss-verify.md) — Implements the EMSA-PSS verification operation defined in RFC 8017 §9.1.2. Given the message digest, the candidate enco…
-- [mgf1](./src/encoding/mgf1.md) — Implements the MGF1 mask-generation function defined in RFC 8017 §B.2.1. MGF1 is the building block used by EMSA-PSS an…
-- [default-rng](./src/encrypt/default-rng.md) — Single canonical adapter that lifts the `crypto.getRandomValues` CSPRNG into the `@suaveplan/types` `Rng` interface eve…
-- [oaep](./src/encrypt/oaep.md) — RSAES-OAEP encryption per RFC 8017 §7.1.1. The Optimal Asymmetric Encryption Padding (OAEP) scheme is the modern defaul…
-- [pkcs1v15](./src/encrypt/pkcs1v15.md) — RSAES-PKCS1-v1_5 encryption per RFC 8017 §7.2.1 — the legacy public-key encryption padding scheme historically used by…
-- [noble](./src/engine/noble.md) — Default `RsaCryptoEngine` backed by the pure-JS noble primitives this package ships natively. Provides the `name: "nobl…
-- [select](./src/engine/select.md) — Resolve the default `RsaCryptoEngine` for the host runtime. When `globalThis.crypto.subtle` exposes the RSA algorithms…
-- [subtle](./src/engine/subtle.md) — `RsaCryptoEngine` adapter over `globalThis.crypto.subtle`. When the host runtime exposes WebCrypto, this engine routes…
-- [errors](./src/errors/errors.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
-  - [errors](./src/errors/errors.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
-- [format](./src/fingerprint/format.md) — Render a fingerprint byte sequence as a human- and machine-readable string. Provides four output formats covering every…
-- [spki](./src/fingerprint/spki.md) — Compute a deterministic fingerprint of an RSA public key by hashing its SPKI DER encoding (RFC 5280 §4.1 `SubjectPublic…
-- [registry](./src/handle/registry.md) — Process-wide registry for RSA key-handle providers. Every HSM, KMS, OS keychain, or PKCS#11 bridge registers a provider…
-- [software](./src/handle/software.md) — Reference `RsaKeyHandleProvider` wrapping in-memory `RsaPrivateKey` values. Implements the same interface as a real HSM…
-- [thumbprint-uri](./src/jwk/thumbprint-uri.md) — Compute the JWK Thumbprint URI per RFC 9278 §3 — the canonical `urn:ietf:params:oauth:jwk-thumbprint:<hash-alg>:<base64…
-- [thumbprint](./src/jwk/thumbprint.md) — Compute the JWK Thumbprint of an RSA public key per RFC 7638 §3.2. The thumbprint is a deterministic hash over the cano…
-- [exponent](./src/keygen/exponent.md) — Public-exponent validation for RSA key generation. The `e`-only constraints (odd, `> 1`, `< 2^256`) live here so they c…
-- [generate](./src/keygen/generate.md) — RSA key-pair generation per NIST FIPS 186-5 Appendix A.1 and SP 800-56B Rev. 2 §6.3. Two-prime by default; multi-prime…
-- [miller-rabin](./src/keygen/miller-rabin.md) — Probable-prime test per NIST FIPS 186-5 Appendix B.3.1, used by `generateRsaKeyPair` to qualify candidate primes during…
-- [multi-prime](./src/keygen/multi-prime.md) — Multi-prime RSA key generation per RFC 8017 §3 and PKCS #1 Appendix A.1.2 `OtherPrimeInfos` extension. Reachable via th…
-- [jwk-policy](./src/keys/jwk-policy.md) — Cross-check a JWK's `key_ops`, `use`, and `alg` members against the requested operation per RFC 7517 §4.2 / §4.3 / §4.4…
-- [oid](./src/keys/oid.md) — Centralised OID constants for the RSA wire formats handled by this package. Currently exports `OID_RSA_ENCRYPTION` (`1.…
-- [parse-jwk](./src/keys/parse-jwk.md) — Parses RSA JWKs per RFC 7517 §6.3.1 (public) and §6.3.2 (private). Accepts the JWK as a plain JS object literal, as a J…
-- [parse-pkcs1-private](./src/keys/parse-pkcs1-private.md) — Parses a DER-encoded `RSAPrivateKey` per RFC 8017 Appendix A.1.2 into the canonical `RsaPrivateKey` shape with mandator…
-- [parse-pkcs1-public](./src/keys/parse-pkcs1-public.md) — Parses a DER-encoded `RSAPublicKey ::= SEQUENCE { modulus INTEGER, publicExponent INTEGER }` per RFC 8017 Appendix A.1.…
-- [parse-pkcs8](./src/keys/parse-pkcs8.md) — Parses a PKCS#8 `PrivateKeyInfo` per RFC 5208 §5 — also accepts the RFC 5958 `OneAsymmetricKey` shape, which adds optio…
-- [parse-spki](./src/keys/parse-spki.md) — Parses an X.509 `SubjectPublicKeyInfo` per RFC 5280 §4.1 + Appendix A and unwraps the inner PKCS#1 `RSAPublicKey`. SPKI…
-- [parse](./src/keys/parse.md) — Public dispatcher entry-point unifying the four key-format parsers (PKCS#1, SPKI, PKCS#8, JWK) under one ergonomic call…
-- [serialize-jwk](./src/keys/serialize-jwk.md) — Inverse of `parseRsaPublicKeyJwk` and `parseRsaPrivateKeyJwk`. Emits an `RsaJwk` with every numeric field encoded as ba…
-- [serialize-pkcs1-private](./src/keys/serialize-pkcs1-private.md) — Inverse of `parseRsaPrivateKeyPkcs1`. Emits a DER `RSAPrivateKey` SEQUENCE per RFC 8017 Appendix A.1.2 from a canonical…
-- [serialize-pkcs1-public](./src/keys/serialize-pkcs1-public.md) — Inverse of `parseRsaPublicKeyPkcs1`. Emits a DER `RSAPublicKey` SEQUENCE per RFC 8017 Appendix A.1.1 from a canonical `…
-- [serialize-pkcs8](./src/keys/serialize-pkcs8.md) — Inverse of `parseRsaPrivateKeyPkcs8`. Wraps a serialised PKCS#1 `RSAPrivateKey` in a DER `PrivateKeyInfo` per RFC 5208…
-- [serialize-spki](./src/keys/serialize-spki.md) — Inverse of `parseRsaPublicKeySpki`. Wraps a serialised PKCS#1 `RSAPublicKey` in a DER `SubjectPublicKeyInfo` per RFC 52…
-- [serialize](./src/keys/serialize.md) — Public dispatcher entry-point inverse of `parse`. Selects the per-format serialiser via the same `format` discriminator…
-- [crt](./src/math/crt.md) — RSA private-key operation via the Chinese Remainder Theorem (RFC 8017 §5.1.2, second-form algorithm). Computes `m = c^d…
-- [i2osp](./src/math/i2osp.md) — Integer-to-Octet-String Primitive (RFC 8017 §4.1). Encodes a non-negative integer as a fixed-length big-endian byte str…
-- [modpow](./src/math/modpow.md) — Single-source-of-truth modular exponentiation for the entire `@suaveplan/crypto-rsa` package. Wraps `@noble/curves/abst…
-- [os2ip](./src/math/os2ip.md) — Octet-String-to-Integer Primitive (RFC 8017 §4.2). Decodes a big-endian byte string into a non-negative `bigint`. Used…
-- [metrics](./src/observability/metrics.md) — OpenTelemetry meter + instrument registry for `@suaveplan/crypto-rsa`. defines the full instrument set the prop…
-- [timing](./src/observability/timing.md) — Centralised high-resolution clock source used by every metric histogram in `@suaveplan/crypto-rsa`. Resolves to `perfor…
-- [labels](./src/pem/labels.md) — Centralised PEM textual labels per RFC 7468 §5/§10/§11 used by the public and private PEM parsers and serialisers in th…
-- [parse-private](./src/pem/parse-private.md) — Parse an RSA private key from RFC 7468 PEM textual encoding. Accepts the two canonical private-key armor labels — `"PRI…
-- [parse-public](./src/pem/parse-public.md) — Parse an RSA public key from RFC 7468 PEM textual encoding. Accepts both canonical armor labels — `"PUBLIC KEY"` (SPKI…
-- [pem-codec](./src/pem/pem-codec.md) — Underlying RFC 7468 textual-encoding codec used by the four PEM parse/serialise entry points in this module. Splits the…
-- [serialize-private](./src/pem/serialize-private.md) — Inverse of `parseRsaPrivateKeyPem`. Emits PEM textual encoding for an RSA private key in either PKCS#8 (`"PRIVATE KEY"`…
-- [serialize-public](./src/pem/serialize-public.md) — Inverse of `parseRsaPublicKeyPem`. Emits PEM textual encoding for an RSA public key in either SPKI (`"PUBLIC KEY"`, the…
-- [policy](./src/policy/modulus.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
-  - [modulus](./src/policy/modulus.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
-- [profile](./src/profile/profile.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
-  - [profile](./src/profile/profile.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
-- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
-  - [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
-- [pkcs1v15](./src/sign/pkcs1v15.md) — RSASSA-PKCS1-v1\_5 signature generation per RFC 8017 §8.2.1. Hashes the message with the configured algorithm, applies…
-- [pss](./src/sign/pss.md) — RSASSA-PSS signature generation per RFC 8017 §8.1.1. Hashes the message, draws a random salt of the configured length,…
-- [pkcs1v15](./src/verify/pkcs1v15.md) — RSASSA-PKCS1-v1\_5 signature verification per RFC 8017 §8.2.2. Recovers the encoded message from `signature` via `s^e m…
-- [pss](./src/verify/pss.md) — RSASSA-PSS signature verification per RFC 8017 §8.1.2. Recovers the encoded message via `s^e mod n`, then runs the EMSA…
++ [__benchmarks__](./src/__benchmarks__/blinded_vs_unblinded_2048.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+  + [blinded_vs_unblinded_2048](./src/__benchmarks__/blinded_vs_unblinded_2048.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
++ [rsa-2048-key](./src/__fixtures__/rsa-2048-key.md) — Real 2048-bit RSA keypair generated once at module-load time and exposed as canonical `RsaPublicKey` / `RsaPrivateKey`…
++ [test-keys](./src/__fixtures__/test-keys.md) — Tiny synthetic RSA keypair for unit tests that need an `RsaPrivateKey` / `RsaPublicKey` shape but don't need to run a r…
++ [reader](./src/asn1/reader.md) — Strict-DER reader scoped to the RSA key shapes defined in RFC 8017 Appendix A (PKCS#1), RFC 5280 §4.1 + Appendix A (`Su…
++ [writer](./src/asn1/writer.md) — Strict-DER encoder mirroring `asn1/reader`. Encodes the same minimal subset of ASN.1 needed to serialise RSA keys in PK…
++ [blinding](./src/blinding/blinding.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+  + [blinding](./src/blinding/blinding.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
++ [oaep](./src/decrypt/oaep.md) — RSAES-OAEP decryption per RFC 8017 §7.1.2 — counterpart to `encrypt/oaep`. Modern default for RSA public-key encryption.
++ [pkcs1v15](./src/decrypt/pkcs1v15.md) — RSAES-PKCS1-v1_5 decryption per RFC 8017 §7.2.2. Counterpart to `encrypt/pkcs1v15`. Provides legacy interop for protoco…
++ [emsa-pkcs1-v1_5](./src/encoding/emsa-pkcs1-v1_5.md) — Implements EMSA-PKCS1-v1\_5-ENCODE from RFC 8017 §9.2 — the encoding method underlying RSASSA-PKCS1-v1\_5 signatures. T…
++ [emsa-pss-encode](./src/encoding/emsa-pss-encode.md) — Implements the EMSA-PSS encoding operation defined in RFC 8017 §9.1.1. Given a message digest, an encoded-message bit l…
++ [emsa-pss-verify](./src/encoding/emsa-pss-verify.md) — Implements the EMSA-PSS verification operation defined in RFC 8017 §9.1.2. Given the message digest, the candidate enco…
++ [mgf1](./src/encoding/mgf1.md) — Implements the MGF1 mask-generation function defined in RFC 8017 §B.2.1. MGF1 is the building block used by EMSA-PSS an…
++ [default-rng](./src/encrypt/default-rng.md) — Single canonical adapter that lifts the `crypto.getRandomValues` CSPRNG into the `@suaveplan/types` `Rng` interface eve…
++ [oaep](./src/encrypt/oaep.md) — RSAES-OAEP encryption per RFC 8017 §7.1.1. The Optimal Asymmetric Encryption Padding (OAEP) scheme is the modern defaul…
++ [pkcs1v15](./src/encrypt/pkcs1v15.md) — RSAES-PKCS1-v1_5 encryption per RFC 8017 §7.2.1 — the legacy public-key encryption padding scheme historically used by…
++ [noble](./src/engine/noble.md) — Default `RsaCryptoEngine` backed by the pure-JS noble primitives this package ships natively. Provides the `name: "nobl…
++ [select](./src/engine/select.md) — Resolve the default `RsaCryptoEngine` for the host runtime. When `globalThis.crypto.subtle` exposes the RSA algorithms…
++ [subtle](./src/engine/subtle.md) — `RsaCryptoEngine` adapter over `globalThis.crypto.subtle`. When the host runtime exposes WebCrypto, this engine routes…
++ [errors](./src/errors/errors.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+  + [errors](./src/errors/errors.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
++ [format](./src/fingerprint/format.md) — Render a fingerprint byte sequence as a human- and machine-readable string. Provides four output formats covering every…
++ [spki](./src/fingerprint/spki.md) — Compute a deterministic fingerprint of an RSA public key by hashing its SPKI DER encoding (RFC 5280 §4.1 `SubjectPublic…
++ [registry](./src/handle/registry.md) — Process-wide registry for RSA key-handle providers. Every HSM, KMS, OS keychain, or PKCS#11 bridge registers a provider…
++ [software](./src/handle/software.md) — Reference `RsaKeyHandleProvider` wrapping in-memory `RsaPrivateKey` values. Implements the same interface as a real HSM…
++ [thumbprint-uri](./src/jwk/thumbprint-uri.md) — Compute the JWK Thumbprint URI per RFC 9278 §3 — the canonical `urn:ietf:params:oauth:jwk-thumbprint:<hash-alg>:<base64…
++ [thumbprint](./src/jwk/thumbprint.md) — Compute the JWK Thumbprint of an RSA public key per RFC 7638 §3.2. The thumbprint is a deterministic hash over the cano…
++ [exponent](./src/keygen/exponent.md) — Public-exponent validation for RSA key generation. The `e`-only constraints (odd, `> 1`, `< 2^256`) live here so they c…
++ [generate](./src/keygen/generate.md) — RSA key-pair generation per NIST FIPS 186-5 Appendix A.1 and SP 800-56B Rev. 2 §6.3. Two-prime by default; multi-prime…
++ [miller-rabin](./src/keygen/miller-rabin.md) — Probable-prime test per NIST FIPS 186-5 Appendix B.3.1, used by `generateRsaKeyPair` to qualify candidate primes during…
++ [multi-prime](./src/keygen/multi-prime.md) — Multi-prime RSA key generation per RFC 8017 §3 and PKCS #1 Appendix A.1.2 `OtherPrimeInfos` extension. Reachable via th…
++ [jwk-policy](./src/keys/jwk-policy.md) — Cross-check a JWK's `key_ops`, `use`, and `alg` members against the requested operation per RFC 7517 §4.2 / §4.3 / §4.4…
++ [oid](./src/keys/oid.md) — Centralised OID constants for the RSA wire formats handled by this package. Currently exports `OID_RSA_ENCRYPTION` (`1.…
++ [parse-jwk](./src/keys/parse-jwk.md) — Parses RSA JWKs per RFC 7517 §6.3.1 (public) and §6.3.2 (private). Accepts the JWK as a plain JS object literal, as a J…
++ [parse-pkcs1-private](./src/keys/parse-pkcs1-private.md) — Parses a DER-encoded `RSAPrivateKey` per RFC 8017 Appendix A.1.2 into the canonical `RsaPrivateKey` shape with mandator…
++ [parse-pkcs1-public](./src/keys/parse-pkcs1-public.md) — Parses a DER-encoded `RSAPublicKey ::= SEQUENCE { modulus INTEGER, publicExponent INTEGER }` per RFC 8017 Appendix A.1.…
++ [parse-pkcs8](./src/keys/parse-pkcs8.md) — Parses a PKCS#8 `PrivateKeyInfo` per RFC 5208 §5 — also accepts the RFC 5958 `OneAsymmetricKey` shape, which adds optio…
++ [parse-spki](./src/keys/parse-spki.md) — Parses an X.509 `SubjectPublicKeyInfo` per RFC 5280 §4.1 + Appendix A and unwraps the inner PKCS#1 `RSAPublicKey`. SPKI…
++ [parse](./src/keys/parse.md) — Public dispatcher entry-point unifying the four key-format parsers (PKCS#1, SPKI, PKCS#8, JWK) under one ergonomic call…
++ [serialize-jwk](./src/keys/serialize-jwk.md) — Inverse of `parseRsaPublicKeyJwk` and `parseRsaPrivateKeyJwk`. Emits an `RsaJwk` with every numeric field encoded as ba…
++ [serialize-pkcs1-private](./src/keys/serialize-pkcs1-private.md) — Inverse of `parseRsaPrivateKeyPkcs1`. Emits a DER `RSAPrivateKey` SEQUENCE per RFC 8017 Appendix A.1.2 from a canonical…
++ [serialize-pkcs1-public](./src/keys/serialize-pkcs1-public.md) — Inverse of `parseRsaPublicKeyPkcs1`. Emits a DER `RSAPublicKey` SEQUENCE per RFC 8017 Appendix A.1.1 from a canonical `…
++ [serialize-pkcs8](./src/keys/serialize-pkcs8.md) — Inverse of `parseRsaPrivateKeyPkcs8`. Wraps a serialised PKCS#1 `RSAPrivateKey` in a DER `PrivateKeyInfo` per RFC 5208…
++ [serialize-spki](./src/keys/serialize-spki.md) — Inverse of `parseRsaPublicKeySpki`. Wraps a serialised PKCS#1 `RSAPublicKey` in a DER `SubjectPublicKeyInfo` per RFC 52…
++ [serialize](./src/keys/serialize.md) — Public dispatcher entry-point inverse of `parse`. Selects the per-format serialiser via the same `format` discriminator…
++ [crt](./src/math/crt.md) — RSA private-key operation via the Chinese Remainder Theorem (RFC 8017 §5.1.2, second-form algorithm). Computes `m = c^d…
++ [i2osp](./src/math/i2osp.md) — Integer-to-Octet-String Primitive (RFC 8017 §4.1). Encodes a non-negative integer as a fixed-length big-endian byte str…
++ [modpow](./src/math/modpow.md) — Single-source-of-truth modular exponentiation for the entire `@suaveplan/crypto-rsa` package. Wraps `@noble/curves/abst…
++ [os2ip](./src/math/os2ip.md) — Octet-String-to-Integer Primitive (RFC 8017 §4.2). Decodes a big-endian byte string into a non-negative `bigint`. Used…
++ [metrics](./src/observability/metrics.md) — OpenTelemetry meter + instrument registry for `@suaveplan/crypto-rsa`. defines the full instrument set the prop…
++ [timing](./src/observability/timing.md) — Centralised high-resolution clock source used by every metric histogram in `@suaveplan/crypto-rsa`. Resolves to `perfor…
++ [labels](./src/pem/labels.md) — Centralised PEM textual labels per RFC 7468 §5/§10/§11 used by the public and private PEM parsers and serialisers in th…
++ [parse-private](./src/pem/parse-private.md) — Parse an RSA private key from RFC 7468 PEM textual encoding. Accepts the two canonical private-key armor labels — `"PRI…
++ [parse-public](./src/pem/parse-public.md) — Parse an RSA public key from RFC 7468 PEM textual encoding. Accepts both canonical armor labels — `"PUBLIC KEY"` (SPKI…
++ [pem-codec](./src/pem/pem-codec.md) — Underlying RFC 7468 textual-encoding codec used by the four PEM parse/serialise entry points in this module. Splits the…
++ [serialize-private](./src/pem/serialize-private.md) — Inverse of `parseRsaPrivateKeyPem`. Emits PEM textual encoding for an RSA private key in either PKCS#8 (`"PRIVATE KEY"`…
++ [serialize-public](./src/pem/serialize-public.md) — Inverse of `parseRsaPublicKeyPem`. Emits PEM textual encoding for an RSA public key in either SPKI (`"PUBLIC KEY"`, the…
++ [policy](./src/policy/modulus.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+  + [modulus](./src/policy/modulus.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
++ [profile](./src/profile/profile.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+  + [profile](./src/profile/profile.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
++ [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+  + [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
++ [pkcs1v15](./src/sign/pkcs1v15.md) — RSASSA-PKCS1-v1\_5 signature generation per RFC 8017 §8.2.1. Hashes the message with the configured algorithm, applies…
++ [pss](./src/sign/pss.md) — RSASSA-PSS signature generation per RFC 8017 §8.1.1. Hashes the message, draws a random salt of the configured length,…
++ [pkcs1v15](./src/verify/pkcs1v15.md) — RSASSA-PKCS1-v1\_5 signature verification per RFC 8017 §8.2.2. Recovers the encoded message from `signature` via `s^e m…
++ [pss](./src/verify/pss.md) — RSASSA-PSS signature verification per RFC 8017 §8.1.2. Recovers the encoded message via `s^e mod n`, then runs the EMSA…
+
 <!-- end:auto-docs -->  + [blinded_vs_unblinded_2048](./src/__benchmarks__/blinded_vs_unblinded_2048.md) — <!-- begin:auto-docs --> _(no submodules)_+ [rsa-2048-key](./src/__fixtures__/rsa-2048-key.md) — Real 2048-bit RSA keypair generated once at module-load time and exposed as canonical `RsaPublicKey` / `RsaPrivateKey`…
+
 + [test-keys](./src/__fixtures__/test-keys.md) — Tiny synthetic RSA keypair for unit tests that need an `RsaPrivateKey` / `RsaPublicKey` shape but don't need to run a r…
 + [reader](./src/asn1/reader.md) — Strict-DER reader scoped to the RSA key shapes defined in RFC 8017 Appendix A (PKCS#1), RFC 5280 §4.1 + Appendix A (`Su…
 + [writer](./src/asn1/writer.md) — Strict-DER encoder mirroring `asn1/reader`. Encodes the same minimal subset of ASN.1 needed to serialise RSA keys in PK…
@@ -461,4 +463,3 @@ const v = modPow(c, publicKey.e, publicKey.n); // public op
 ## License
 
 MIT
-

plugins/document-navigator/docs/security-stack/crypto/crypto-vault/README.md

@@ -39,7 +39,9 @@ instances that zeroize on lock.
   - [twoskd](./src/twoskd/twoskd.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
 - [types](./src/types/types.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
   - [types](./src/types/types.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+
 <!-- end:auto-docs -->  - [argon2id](./src/argon2id/argon2id.md) — <!-- begin:auto-docs --> _(no submodules)_- [bip39](./src/bip39/bip39.md) — <!-- begin:auto-docs --> _(no submodules)_- [bip39](./src/bip39/bip39.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes.md) — `codes.ts` is the canonical, frozen registry of every error code emitted by `@suaveplan/crypto-vault`. The registry exi…
+
 - [crypto-vault-error](./src/errors/crypto-vault-error.md) — `CryptoVaultError` is the umbrella error class for `@suaveplan/crypto-vault`. Every failure mode in the package — inval…
 - [handle](./src/handle/opaque-handle.md) — <!-- begin:auto-docs --> _(no submodules)_- [opaque-handle](./src/handle/opaque-handle.md) — <!-- begin:auto-docs --> _(no submodules)_- [hd-key](./src/hd-key/hd-key.md) — <!-- begin:auto-docs --> _(no submodules)_- [hd-key](./src/hd-key/hd-key.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-hierarchy](./src/key-hierarchy/key-hierarchy.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-hierarchy](./src/key-hierarchy/key-hierarchy.md) — <!-- begin:auto-docs --> _(no submodules)_- [otel](./src/otel/instruments.md) — <!-- begin:auto-docs --> _(no submodules)_- [instruments](./src/otel/instruments.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [secure](./src/secure/secure-buffer.md) — <!-- begin:auto-docs --> _(no submodules)_- [secure-buffer](./src/secure/secure-buffer.md) — <!-- begin:auto-docs --> _(no submodules)_- [srp-client](./src/srp/srp-client.md) — `srp-client.ts` implements the client side of the SRP-6a zero-knowledge password-authenticated key exchange per RFC 505…
 - [srp-group](./src/srp/srp-group.md) — `srp-group.ts` exports the canonical 2048-bit MODP group from RFC 5054 Appendix A as `bigint` constants. The SRP-6a cli…
@@ -56,6 +58,7 @@ instances that zeroize on lock.
 - [handle](./src/handle/opaque-handle.md) — <!-- begin:auto-docs --> _(no submodules)_  - [opaque-handle](./src/handle/opaque-handle.md) — <!-- begin:auto-docs --> _(no submodules)_- [hd-key](./src/hd-key/hd-key.md) — <!-- begin:auto-docs --> _(no submodules)_  - [hd-key](./src/hd-key/hd-key.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-hierarchy](./src/key-hierarchy/key-hierarchy.md) — <!-- begin:auto-docs --> _(no submodules)_  - [key-hierarchy](./src/key-hierarchy/key-hierarchy.md) — <!-- begin:auto-docs --> _(no submodules)_- [otel](./src/otel/instruments.md) — <!-- begin:auto-docs --> _(no submodules)_  - [instruments](./src/otel/instruments.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_  - [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [secure](./src/secure/secure-buffer.md) — <!-- begin:auto-docs --> _(no submodules)_  - [secure-buffer](./src/secure/secure-buffer.md) — <!-- begin:auto-docs --> _(no submodules)_- [srp-client](./src/srp/srp-client.md) — `srp-client.ts` implements the client side of the SRP-6a zero-knowledge password-authenticated key exchange per RFC 505…
 - [srp-group](./src/srp/srp-group.md) — `srp-group.ts` exports the canonical 2048-bit MODP group from RFC 5054 Appendix A as `bigint` constants. The SRP-6a cli…
 - [twoskd](./src/twoskd/twoskd.md) — <!-- begin:auto-docs --> _(no submodules)_  - [twoskd](./src/twoskd/twoskd.md) — <!-- begin:auto-docs --> _(no submodules)_- [types](./src/types/types.md) — <!-- begin:auto-docs --> _(no submodules)_  - [types](./src/types/types.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Install
 
 ```bash
@@ -150,4 +153,3 @@ console.log(wrapped.isClosed); // true
 ## License
 
 MIT
-

plugins/document-navigator/docs/security-stack/crypto/crypto-vault/src/orchestration/orchestration.md

@@ -96,7 +96,7 @@ console.log(decoded["sign"].publicKey === server2.publicKeys["sign"].publicKey);
   `Promise<ServerKeysResult>`. Deterministically derives a child master via
   `HMAC-SHA512(rootMaster, u32be(version))` truncated to 32 bytes. Throws
   `CryptoVaultError(CRYPTOVAULT.ORCHESTRATION.INVALID_VERSION)` on negative or
-  non-integer `version`. Public-key file is signed by the *root* sign slot.
+  non-integer `version`. Public-key file is signed by the _root_ sign slot.
 - `rollServerKeys(rootKeys, currentVersion, serverPassword, options?)` →
   `Promise<ServerKeysResult>`. Returns a result at `version = currentVersion + 1`.
   Throws the same `INVALID_VERSION` error on negative `currentVersion`.

plugins/document-navigator/docs/security-stack/crypto/crypto/README.md

@@ -57,7 +57,9 @@ Universal cryptographic primitives — engine-pluggable AEAD, Ed25519/ECDSA-P256
   - [trust-anchor](./src/trust-anchors/trust-anchor.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
 - [mnemonic](./src/vault/mnemonic/mnemonic.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
   - [mnemonic](./src/vault/mnemonic/mnemonic.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+
 <!-- end:auto-docs -->  - [authority](./src/authority/authority.md) — <!-- begin:auto-docs --> _(no submodules)_- [chain-bundle](./src/bundles/chain-bundle/chain-bundle.md) — <!-- begin:auto-docs --> _(no submodules)_- [chain-bundle](./src/bundles/chain-bundle/chain-bundle.md) — <!-- begin:auto-docs --> _(no submodules)_- [public-bundle](./src/bundles/public-bundle/public-bundle.md) — <!-- begin:auto-docs --> _(no submodules)_- [public-bundle](./src/bundles/public-bundle/public-bundle.md) — <!-- begin:auto-docs --> _(no submodules)_- [coordinate](./src/derivation/coordinate/coordinate.md) — <!-- begin:auto-docs --> _(no submodules)_- [coordinate](./src/derivation/coordinate/coordinate.md) — <!-- begin:auto-docs --> _(no submodules)_- [layouts](./src/derivation/layouts/layouts.md) — <!-- begin:auto-docs --> _(no submodules)_- [layouts](./src/derivation/layouts/layouts.md) — <!-- begin:auto-docs --> _(no submodules)_- [purposes](./src/derivation/purposes/purposes.md) — <!-- begin:auto-docs --> _(no submodules)_- [purposes](./src/derivation/purposes/purposes.md) — <!-- begin:auto-docs --> _(no submodules)_- [domain-tags](./src/domain-tags/domain-tags.md) — <!-- begin:auto-docs --> _(no submodules)_- [domain-tags](./src/domain-tags/domain-tags.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-error](./src/errors/crypto-error/crypto-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-error](./src/errors/crypto-error/crypto-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/keys-errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/keys-errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-keys-error](./src/errors/keys-errors/crypto-keys-error/crypto-keys-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-keys-error](./src/errors/keys-errors/crypto-keys-error/crypto-keys-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/vault-errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/vault-errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-vault-error](./src/errors/vault-errors/crypto-vault-error/crypto-vault-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-vault-error](./src/errors/vault-errors/crypto-vault-error/crypto-vault-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [keychain](./src/keychain/keychain.md) — <!-- begin:auto-docs --> _(no submodules)_- [algorithms](./src/keychain/algorithms/algorithms.md) — <!-- begin:auto-docs --> _(no submodules)_- [algorithms](./src/keychain/algorithms/algorithms.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./src/keychain/key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./src/keychain/key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./src/keychain/keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./src/keychain/keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./src/keychain/keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./src/keychain/keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./src/keychain/storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./src/keychain/storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./src/keychain/storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./src/keychain/storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./src/keychain/validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./src/keychain/validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [keychain](./src/keychain/keychain.md) — <!-- begin:auto-docs --> _(no submodules)_- [derive-key-from-password](./src/password/derive-key-from-password.md) — `derive-key-from-password.ts` is the low-level password-to-key derivation helper in `@suaveplan/crypto`. It accepts a p…
+
 - [encrypt-with-password](./src/password/encrypt-with-password.md) — `encrypt-with-password.ts` is the high-level password-based encryption helper in `@suaveplan/crypto`. It accepts a pass…
 - [trust-anchors](./src/trust-anchors/trust-anchor.md) — <!-- begin:auto-docs --> _(no submodules)_- [trust-anchor](./src/trust-anchors/trust-anchor.md) — <!-- begin:auto-docs --> _(no submodules)_- [mnemonic](./src/vault/mnemonic/mnemonic.md) — <!-- begin:auto-docs --> _(no submodules)_- [mnemonic](./src/vault/mnemonic/mnemonic.md) — <!-- begin:auto-docs --> _(no submodules)_- [authority](./src/authority/authority.md) — <!-- begin:auto-docs --> _(no submodules)_- [chain-bundle](./src/bundles/chain-bundle/chain-bundle.md) — <!-- begin:auto-docs --> _(no submodules)_- [chain-bundle](./src/bundles/chain-bundle/chain-bundle.md) — <!-- begin:auto-docs --> _(no submodules)_- [public-bundle](./src/bundles/public-bundle/public-bundle.md) — <!-- begin:auto-docs --> _(no submodules)_- [public-bundle](./src/bundles/public-bundle/public-bundle.md) — <!-- begin:auto-docs --> _(no submodules)_- [coordinate](./src/derivation/coordinate/coordinate.md) — <!-- begin:auto-docs --> _(no submodules)_- [coordinate](./src/derivation/coordinate/coordinate.md) — <!-- begin:auto-docs --> _(no submodules)_- [layouts](./src/derivation/layouts/layouts.md) — <!-- begin:auto-docs --> _(no submodules)_- [layouts](./src/derivation/layouts/layouts.md) — <!-- begin:auto-docs --> _(no submodules)_- [purposes](./src/derivation/purposes/purposes.md) — <!-- begin:auto-docs --> _(no submodules)_- [purposes](./src/derivation/purposes/purposes.md) — <!-- begin:auto-docs --> _(no submodules)_- [domain-tags](./src/domain-tags/domain-tags.md) — <!-- begin:auto-docs --> _(no submodules)_- [domain-tags](./src/domain-tags/domain-tags.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-error](./src/errors/crypto-error/crypto-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-error](./src/errors/crypto-error/crypto-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/keys-errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/keys-errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-keys-error](./src/errors/keys-errors/crypto-keys-error/crypto-keys-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-keys-error](./src/errors/keys-errors/crypto-keys-error/crypto-keys-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/vault-errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/vault-errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-vault-error](./src/errors/vault-errors/crypto-vault-error/crypto-vault-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-vault-error](./src/errors/vault-errors/crypto-vault-error/crypto-vault-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [keychain](./src/keychain/keychain.md) — <!-- begin:auto-docs --> _(no submodules)_- algorithms — <!-- begin:auto…
   - [algorithms](./src/keychain/algorithms/algorithms.md) — <!-- begin:auto-docs --> _(no submodules)_- [algorithms](./src/keychain/algorithms/algorithms.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./src/keychain/key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./src/keychain/key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./src/keychain/keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./src/keychain/keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./src/keychain/keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./src/keychain/keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./src/keychain/storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./src/keychain/storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./src/keychain/storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./src/keychain/storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./src/keychain/validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./src/keychain/validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [keychain](./src/keychain/keychain.md) — <!-- begin:auto-docs --> _(no submodules)_- algorithms — <!-- begin:auto…
@@ -70,6 +72,7 @@ Universal cryptographic primitives — engine-pluggable AEAD, Ed25519/ECDSA-P256
 - [trust-anchors](./src/trust-anchors/trust-anchor.md) — <!-- begin:auto-docs --> _(no submodules)_- [trust-anchor](./src/trust-anchors/trust-anchor.md) — <!-- begin:auto-docs --> _(no submodules)_- [mnemonic](./src/vault/mnemonic/mnemonic.md) — <!-- begin:auto-docs --> _(no submodules)_- [mnemonic](./src/vault/mnemonic/mnemonic.md) — <!-- begin:auto-docs --> _(no submodules)_- [authority](./src/authority/authority.md) — <!-- begin:auto-docs --> _(no submodules)_- [chain-bundle](./src/bundles/chain-bundle/chain-bundle.md) — <!-- begin:auto-docs --> _(no submodules)_  - [chain-bundle](./src/bundles/chain-bundle/chain-bundle.md) — <!-- begin:auto-docs --> _(no submodules)_- [public-bundle](./src/bundles/public-bundle/public-bundle.md) — <!-- begin:auto-docs --> _(no submodules)_  - [public-bundle](./src/bundles/public-bundle/public-bundle.md) — <!-- begin:auto-docs --> _(no submodules)_- [coordinate](./src/derivation/coordinate/coordinate.md) — <!-- begin:auto-docs --> _(no submodules)_  - [coordinate](./src/derivation/coordinate/coordinate.md) — <!-- begin:auto-docs --> _(no submodules)_- [layouts](./src/derivation/layouts/layouts.md) — <!-- begin:auto-docs --> _(no submodules)_  - [layouts](./src/derivation/layouts/layouts.md) — <!-- begin:auto-docs --> _(no submodules)_- [purposes](./src/derivation/purposes/purposes.md) — <!-- begin:auto-docs --> _(no submodules)_  - [purposes](./src/derivation/purposes/purposes.md) — <!-- begin:auto-docs --> _(no submodules)_- [domain-tags](./src/domain-tags/domain-tags.md) — <!-- begin:auto-docs --> _(no submodules)_  - [domain-tags](./src/domain-tags/domain-tags.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_  - [codes](./src/errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-error](./src/errors/crypto-error/crypto-error.md) — <!-- begin:auto-docs --> _(no submodules)_  - [crypto-error](./src/errors/crypto-error/crypto-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/keys-errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_  - [codes](./src/errors/keys-errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-keys-error](./src/errors/keys-errors/crypto-keys-error/crypto-keys-error.md) — <!-- begin:auto-docs --> _(no submodules)_  - [crypto-keys-error](./src/errors/keys-errors/crypto-keys-error/crypto-keys-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/vault-errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_  - [codes](./src/errors/vault-errors/codes/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-vault-error](./src/errors/vault-errors/crypto-vault-error/crypto-vault-error.md) — <!-- begin:auto-docs --> _(no submodules)_  - [crypto-vault-error](./src/errors/vault-errors/crypto-vault-error/crypto-vault-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [keychain](./src/keychain/keychain.md) — <!-- begin:auto-docs --> _(no submodules)_  - [algorithms](./src/keychain/algorithms/algorithms.md) — <!-- begin:auto-docs --> _(no submodules)_    - [algorithms](./src/keychain/algorithms/algorithms.md) — <!-- begin:auto-docs --> _(no submodules)_  - [key-slot](./src/keychain/key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_    - [key-slot](./src/keychain/key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_  - [generate](./src/keychain/keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_    - [generate](./src/keychain/keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_  - [validate](./src/keychain/keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_    - [validate](./src/keychain/keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_  - [memory](./src/keychain/storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_    - [memory](./src/keychain/storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_  - [serialized](./src/keychain/storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_    - [serialized](./src/keychain/storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_  - [validity](./src/keychain/validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_    - [validity](./src/keychain/validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_  - [keychain](./src/keychain/keychain.md) — <!-- begin:auto-docs --> _(no submodules)_- [derive-key-from-password](./src/password/derive-key-from-password.md) — `derive-key-from-password.ts` is the low-level password-to-key derivation helper in `@suaveplan/crypto`. It accepts a p…
 - [encrypt-with-password](./src/password/encrypt-with-password.md) — `encrypt-with-password.ts` is the high-level password-based encryption helper in `@suaveplan/crypto`. It accepts a pass…
 - [trust-anchors](./src/trust-anchors/trust-anchor.md) — <!-- begin:auto-docs --> _(no submodules)_  - [trust-anchor](./src/trust-anchors/trust-anchor.md) — <!-- begin:auto-docs --> _(no submodules)_- [mnemonic](./src/vault/mnemonic/mnemonic.md) — <!-- begin:auto-docs --> _(no submodules)_  - [mnemonic](./src/vault/mnemonic/mnemonic.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Install
 
 ```bash
@@ -213,4 +216,3 @@ import { CryptoError, CRYPTO_CODES } from "@suaveplan/crypto/errors";
 ```bash
 bunx turbo lint typecheck test:coverage --filter=@suaveplan/crypto
 ```
-

plugins/document-navigator/docs/security-stack/crypto/crypto/src/keychain/keychain.md

@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [algorithms](./algorithms/algorithms.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_  - [key-slot](./key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_  - [generate](./keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_  - [validate](./keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_  - [memory](./storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_  - [serialized](./storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_  - [validity](./validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [keychain](./keychain.md) — <!-- begin:auto-docs --> _(no submodules)_- algorithms — <!-- begin:auto-docs --> _(no submodule…
+- [algorithms](./algorithms/algorithms.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_  - [key-slot](./key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_  - [generate](./keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_  - [validate](./keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_  - [memory](./storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_  - [serialized](./storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_  - [validity](./validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [keychain](./keychain.md) — <!-- begin:auto-docs --> _(no submodules)_- algorithms — <!-- begin:auto-docs --> _(no submodule…
 - [algorithms](./algorithms/algorithms.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [keychain](./keychain.md) — <!-- begin:auto-docs --> _(no submodules)_- [algorithms](./algorithms/algorithms.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [keychain](./keychain.md) — <!-- begin:auto-docs --> _(no submodules)_- algorithms — <!-- begin:auto…
 - [algorithms](./algorithms/algorithms.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [keychain](./keychain.md) — <!-- begin:auto-docs --> _(no submodules)_- algorithms — <!-- begin:auto-docs --> _(no submodul…
 - [algorithms](./algorithms/algorithms.md) — <!-- begin:auto-docs --> _(no submodules)_- [key-slot](./key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_  - [key-slot](./key-slot/key-slot.md) — <!-- begin:auto-docs --> _(no submodules)_- [generate](./keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_  - [generate](./keypair/generate/generate.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate](./keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_  - [validate](./keypair/validate/validate.md) — <!-- begin:auto-docs --> _(no submodules)_- [memory](./storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_  - [memory](./storage/adapters/memory/memory.md) — <!-- begin:auto-docs --> _(no submodules)_- [serialized](./storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_  - [serialized](./storage/adapters/serialized/serialized.md) — <!-- begin:auto-docs --> _(no submodules)_- [validity](./validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_  - [validity](./validity/validity.md) — <!-- begin:auto-docs --> _(no submodules)_- [keychain](./keychain.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose
 
 A `Keychain` is the typed, eight-slot identity bundle for a single application instance. It encodes every cryptographic role a real system needs — master derivation, encryption, signing, key-agreement, salting, hashing, streaming, and device identity — under one coherent versioned address. This is the central artifact of the package: vaults serialise it, public bundles distribute its public projection, the Authority interface signs _through_ its slots, and every higher-level operation (Packer envelopes, chain traversal, audit log) ultimately resolves back to a slot in some keychain.