updated skills

2026-06-09 21:06:27 +01:00
parent db1ce43ee1
commit 427a5bd919
1283 changed files with 24684 additions and 2313 deletions
--- a/plugins/document-navigator/docs/security-stack/security/hibp/README.md
+++ b/plugins/document-navigator/docs/security-stack/security/hibp/README.md
@@ -36,10 +36,12 @@ required runtime primitive is `fetch`.
 - [paste.schema](./src/schemas/paste.schema.md) — `PasteSchema` validates the HIBP v3 `Paste` payload returned by `/pasteaccount/{email}`. Older paste records can omit `…
 - [pwned-result.schema](./src/schemas/pwned-result.schema.md) — `PwnedResultSchema` validates the runtime shape of every `checkPassword` result. It is the final boundary between the i…
 - [error-codes](./src/error-codes.md) — Hosts the canonical `HIBP_CODES` registry — exactly seven error codes that classify every failure path inside `@suavepl…
+
 <!-- end:auto-docs --> - lru — `LruHibpCache<V>` is the default cache for `H…
-  - [cache](./src/cache/cache.md) — <!-- begin:auto-docs --> _(no submodules)_- lru — `LruHibpCache<V>` is the default cache for `H…
-  - [lru](./src/cache/lru.md) — `LruHibpCache<V>` is the default cache for `HibpClient`. It holds up to `LRU_DEFAULT_CAPACITY` entries (10 000) with `L…
-  - [null](./src/cache/null.md) — `NullHibpCache<V>` is the always-miss adapter used by `HibpClient` when the caller explicitly opts out of caching (`cac…
+
+- [cache](./src/cache/cache.md) — <!-- begin:auto-docs --> _(no submodules)_- lru — `LruHibpCache<V>` is the default cache for `H…
+- [lru](./src/cache/lru.md) — `LruHibpCache<V>` is the default cache for `HibpClient`. It holds up to `LRU_DEFAULT_CAPACITY` entries (10 000) with `L…
+- [null](./src/cache/null.md) — `NullHibpCache<V>` is the always-miss adapter used by `HibpClient` when the caller explicitly opts out of caching (`cac…
 - [client](./src/client/client.md) — <!-- begin:auto-docs --> _(no submodules)_- options.schema — `HibpClientOptionsSchema` is the Z…
  - [client](./src/client/client.md) — <!-- begin:auto-docs --> _(no submodules)_- options.schema — `HibpClientOptionsSchema` is the Z…
  - [options.schema](./src/client/options.schema.md) — `HibpClientOptionsSchema` is the Zod boundary for the `HibpClient` constructor. It is `.strict()` — unknown keys cause…
@@ -219,4 +221,3 @@ Run with `bun run benchmark` (see `src/__benchmarks__/`).
 ## License

 MIT
-
--- a/plugins/document-navigator/docs/security-stack/security/hibp/src/cache/cache.md
+++ b/plugins/document-navigator/docs/security-stack/security/hibp/src/cache/cache.md
@@ -3,6 +3,7 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs --> - lru — `LruHibpCache<V>` is the default cache for `H…
+
 - [lru](./lru.md) — `LruHibpCache<V>` is the default cache for `HibpClient`. It holds up to `LRU_DEFAULT_CAPACITY` entries (10 000) with `L…
 - [null](./null.md) — `NullHibpCache<V>` is the always-miss adapter used by `HibpClient` when the caller explicitly opts out of caching (`cac…
 - lru — `LruHibpCache<V>` is the default cache for `H…
--- a/plugins/document-navigator/docs/security-stack/security/hibp/src/client/client.md
+++ b/plugins/document-navigator/docs/security-stack/security/hibp/src/client/client.md
@@ -3,6 +3,7 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs --> - options.schema — `HibpClientOptionsSchema` is the Z…
+
 - [options.schema](./options.schema.md) — `HibpClientOptionsSchema` is the Zod boundary for the `HibpClient` constructor. It is `.strict()` — unknown keys cause…
 - options.schema — `HibpClientOptionsSchema` is the Z…

--- a/plugins/document-navigator/docs/security-stack/security/jws/README.md
+++ b/plugins/document-navigator/docs/security-stack/security/jws/README.md
@@ -42,9 +42,11 @@ RFC 7515 **JSON Web Signature** (verify + sign). Pure TypeScript over `Uint8Arra
  - [sign-pipeline](./src/sign/sign-pipeline.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
 - [verify](./src/verify/verify-pipeline.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
  - [verify-pipeline](./src/verify/verify-pipeline.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+
 <!-- end:auto-docs -->  - [base64url](./src/base64url/base64url.md) — <!-- begin:auto-docs --> _(no submodules)_- [detached](./src/detached/detached.md) — <!-- begin:auto-docs --> _(no submodules)_- [detached](./src/detached/detached.md) — <!-- begin:auto-docs --> _(no submodules)_- [errors](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [error-codes](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [header](./src/header/header.md) — <!-- begin:auto-docs --> _(no submodules)_- [b64](./src/header/b64.md) — RFC 7797 §3 implements the `b64` header parameter, allowing JWS producers to embed unencoded payloads directly into the…
-  - [crit](./src/header/crit.md) — RFC 7515 §4.1.11 enforcement: every entry in `header.crit` MUST be in the caller's `acceptableCriticalHeaders` allowlis…
-  - [header](./src/header/header.md) — <!-- begin:auto-docs --> _(no submodules)_- [jwk](./src/keys/jwk.md) — Parse an RFC 7517 §4 / RFC 7518 §6 JSON Web Key into the typed key shape expected by the JWS algorithm impl for the dec…
+
+- [crit](./src/header/crit.md) — RFC 7515 §4.1.11 enforcement: every entry in `header.crit` MUST be in the caller's `acceptableCriticalHeaders` allowlis…
+- [header](./src/header/header.md) — <!-- begin:auto-docs --> _(no submodules)_- [jwk](./src/keys/jwk.md) — Parse an RFC 7517 §4 / RFC 7518 §6 JSON Web Key into the typed key shape expected by the JWS algorithm impl for the dec…
 - [resolver](./src/keys/resolver.md) — Caller-supplied key-resolution function consulted when `header.kid` is present and no key has been supplied via `opts.k…
 - [x5c](./src/keys/x5c.md) — Decode an RFC 7515 §4.1.6 `x5c` certificate chain, delegate trust-path validation to `@suaveplan/x509.validateChain`, a…
 - [observability](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [metrics](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [compact](./src/serialization/compact/compact.md) — <!-- begin:auto-docs --> _(no submodules)_- [compact](./src/serialization/compact/compact.md) — <!-- begin:auto-docs --> _(no submodules)_- [flat](./src/serialization/flat/flat.md) — <!-- begin:auto-docs --> _(no submodules)_- [flat](./src/serialization/flat/flat.md) — <!-- begin:auto-docs --> _(no submodules)_- [general](./src/serialization/general/general.md) — <!-- begin:auto-docs --> _(no submodules)_- [general](./src/serialization/general/general.md) — <!-- begin:auto-docs --> _(no submodules)_- [sign](./src/sign/sign-pipeline.md) — <!-- begin:auto-docs --> _(no submodules)_- [sign-pipeline](./src/sign/sign-pipeline.md) — <!-- begin:auto-docs --> _(no submodules)_- [verify](./src/verify/verify-pipeline.md) — <!-- begin:auto-docs --> _(no submodules)_- [verify-pipeline](./src/verify/verify-pipeline.md) — <!-- begin:auto-docs --> _(no submodules)_- [base64url](./src/base64url/base64url.md) — <!-- begin:auto-docs --> _(no submodules)_- [detached](./src/detached/detached.md) — <!-- begin:auto-docs --> _(no submodules)_- [detached](./src/detached/detached.md) — <!-- begin:auto-docs --> _(no submodules)_- [errors](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [error-codes](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [header](./src/header/header.md) — <!-- begin:auto-docs --> _(no submodules)_- [b64](./src/header/b64.md) — RFC 7797 §3 implements the `b64` header parameter, allowing JWS producers to embed unencoded payloads directly into the…
@@ -63,6 +65,7 @@ RFC 7515 **JSON Web Signature** (verify + sign). Pure TypeScript over `Uint8Arra
 - [resolver](./src/keys/resolver.md) — Caller-supplied key-resolution function consulted when `header.kid` is present and no key has been supplied via `opts.k…
 - [x5c](./src/keys/x5c.md) — Decode an RFC 7515 §4.1.6 `x5c` certificate chain, delegate trust-path validation to `@suaveplan/x509.validateChain`, a…
 - [observability](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_  - [metrics](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_  - [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [compact](./src/serialization/compact/compact.md) — <!-- begin:auto-docs --> _(no submodules)_  - [compact](./src/serialization/compact/compact.md) — <!-- begin:auto-docs --> _(no submodules)_- [flat](./src/serialization/flat/flat.md) — <!-- begin:auto-docs --> _(no submodules)_  - [flat](./src/serialization/flat/flat.md) — <!-- begin:auto-docs --> _(no submodules)_- [general](./src/serialization/general/general.md) — <!-- begin:auto-docs --> _(no submodules)_  - [general](./src/serialization/general/general.md) — <!-- begin:auto-docs --> _(no submodules)_- [sign](./src/sign/sign-pipeline.md) — <!-- begin:auto-docs --> _(no submodules)_  - [sign-pipeline](./src/sign/sign-pipeline.md) — <!-- begin:auto-docs --> _(no submodules)_- [verify](./src/verify/verify-pipeline.md) — <!-- begin:auto-docs --> _(no submodules)_  - [verify-pipeline](./src/verify/verify-pipeline.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Install

 ```sh
@@ -144,4 +147,3 @@ const result = await compactVerify(token, secret, { algorithms: ["HS256"] });
 ## License

 MIT.
-
--- a/plugins/document-navigator/docs/security-stack/security/license/README.md
+++ b/plugins/document-navigator/docs/security-stack/security/license/README.md
@@ -175,4 +175,3 @@ breaks the circular dependency between "decode needs the seed" and
 ## License

 MIT.
-
--- a/plugins/document-navigator/docs/security-stack/security/otp/README.md
+++ b/plugins/document-navigator/docs/security-stack/security/otp/README.md
@@ -38,7 +38,9 @@
 - [format-uri](./src/uri/format-uri.md) — Build a canonical `otpauth://` URI from an `OtpUri` value object. Round-trips with `parseUri` for every valid input. Pe…
 - [parse-uri](./src/uri/parse-uri.md) — Parse the `otpauth://` Key URI Format used by Google Authenticator and every compatible authenticator app. Supports bot…
 - [uri.schema](./src/uri/uri.schema.md) — Zod boundary schemas for the `OtpUri` discriminated union. `OtpTotpUriSchema` and `OtpHotpUriSchema` cover the per-vari…
+
 <!-- end:auto-docs -->  - [base32](./src/base32/base32.md) — <!-- begin:auto-docs --> _(no submodules)_- [drift](./src/drift/detect.md) — <!-- begin:auto-docs --> _(no submodules)_- [detect](./src/drift/detect.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes.md) — Stable, registered error codes for `@suaveplan/otp` plus the typed `OtpError` base class. Every failure that crosses th…
+
 - [zod-map](./src/errors/zod-map.md) — Translate Zod boundary failures into the most-specific `OtpErrorCode`. When a caller passes options that fail strict-mo…
 - [hotp](./src/hotp/hotp.md) — <!-- begin:auto-docs --> _(no submodules)_- hotp.schema — Zod boundary schema for `HotpOptions`…
  - [encode-counter](./src/hotp/encode-counter.md) — Encode an HOTP counter as the 8-byte big-endian block required by RFC 4226 §5.1. `bigint` is the canonical input type b…
@@ -204,4 +206,3 @@ const r = verify(code, secret);
 ## License

 MIT
-
--- a/plugins/document-navigator/docs/security-stack/security/otp/src/hotp/hotp.md
+++ b/plugins/document-navigator/docs/security-stack/security/otp/src/hotp/hotp.md
@@ -3,6 +3,7 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs --> - hotp.schema — Zod boundary schema for `HotpOptions`…
+
 - [hotp.schema](./hotp.schema.md) — Zod boundary schema for `HotpOptions`. Strict-mode parsing rejects unknown keys (so silent typos in caller configuratio…
 - hotp.schema — Zod boundary schema for `HotpOptions`…

--- a/plugins/document-navigator/docs/security-stack/security/otp/src/ocra/ocra.md
+++ b/plugins/document-navigator/docs/security-stack/security/otp/src/ocra/ocra.md
@@ -3,6 +3,7 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs --> - ocra.schema — Zod boundary schema for `OcraParams`……
+
 - [ocra.schema](./ocra.schema.md) — Zod boundary schema for `OcraParams` — the runtime parameter bag passed alongside a suite string and a key. Optional fi…
 - [suite](./suite.md) — Parse an OCRA suite string into a typed `OcraSuite` AST per RFC 6287 §6.1. Exposed separately so callers can validate s…
 - [verify-ocra](./verify-ocra.md) — Constant-time verify of an OCRA response. Recomputes the response under the supplied suite, key, and params, then compa…
--- a/plugins/document-navigator/docs/security-stack/security/otp/src/totp/totp.md
+++ b/plugins/document-navigator/docs/security-stack/security/otp/src/totp/totp.md
@@ -3,6 +3,7 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs --> - totp.schema — Zod boundary schemas for `TotpOptions…
+
 - [totp.schema](./totp.schema.md) — Zod boundary schemas for `TotpOptions` and `TotpVerifyOptions`. The TOTP schema covers algorithm / digits / period / t0…
 - [verify-many](./verify-many.md) — Backup-aware TOTP verify. Used during rotation windows where an old and a new TOTP secret coexist — the user's authenti…
 - [verify](./verify.md) — RFC 6238 §5.2 verify with drift window. Checks the supplied code against the current step and `±window` neighbouring st…
--- a/plugins/document-navigator/docs/security-stack/security/password-formats/README.md
+++ b/plugins/document-navigator/docs/security-stack/security/password-formats/README.md
--- a/plugins/document-navigator/docs/security-stack/security/password-generator/README.md
+++ b/plugins/document-navigator/docs/security-stack/security/password-generator/README.md
@@ -38,9 +38,11 @@ passphrase decoration, an entropy estimator, and a `assertStrength` guard.
 - [eff-long](./src/wordlists/eff-long.md) — Bundles the EFF Long Wordlist as a frozen `readonly string[]` so callers who only want passphrase generation pull this…
 - [eff-short](./src/wordlists/eff-short.md) — Bundles EFF's Short Wordlist #1 — 1296 entries (4-dice / 6⁴), ≈ 10.34 bits/word, every entry ≤ 5 ASCII characters. Sour…
 - [registry](./src/wordlists/registry.md) — The wordlist registry exposes a small plugin API — `registerWordlist`, `getWordlist`, `listWordlists` — that lets calle…
+
 <!-- end:auto-docs -->  - [charsets](./src/charsets/charsets.md) — <!-- begin:auto-docs --> _(no submodules)_- [entropy](./src/entropy/entropy.md) — <!-- begin:auto-docs --> _(no submodules)_- [entropy](./src/entropy/entropy.md) — <!-- begin:auto-docs --> _(no submodules)_- [errors](./src/errors/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [observability](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [metrics](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [passphrase](./src/passphrase/passphrase.md) — <!-- begin:auto-docs --> _(no submodules)_- [passphrase](./src/passphrase/passphrase.md) — <!-- begin:auto-docs --> _(no submodules)_- [password](./src/password/password.md) — <!-- begin:auto-docs --> _(no submodules)_- pronounceable — `generatePronounceablePassword(opts…
-  - [password](./src/password/password.md) — <!-- begin:auto-docs --> _(no submodules)_- pronounceable — `generatePronounceablePassword(opts…
-  - [pronounceable](./src/password/pronounceable.md) — `generatePronounceablePassword(opts, rng?)` emits CVC-pattern (consonant–vowel–consonant) syllables suitable for should…
+
+- [password](./src/password/password.md) — <!-- begin:auto-docs --> _(no submodules)_- pronounceable — `generatePronounceablePassword(opts…
+- [pronounceable](./src/password/pronounceable.md) — `generatePronounceablePassword(opts, rng?)` emits CVC-pattern (consonant–vowel–consonant) syllables suitable for should…
 - [pin](./src/pin/pin.md) — <!-- begin:auto-docs --> _(no submodules)_- [pin](./src/pin/pin.md) — <!-- begin:auto-docs --> _(no submodules)_- [default-rng](./src/random/default-rng.md) — `defaultRng()` builds the default `Rng` backed by `@suaveplan/crypto-utils.randomBytes`, which delegates to `crypto.get…
 - [fisher-yates](./src/random/fisher-yates.md) — `shuffleInPlace(array, rng)` performs an in-place Fisher–Yates / Knuth shuffle parameterised over the bias-free `random…
 - [random-int](./src/random/random-int.md) — `randomInt(rng, max)` returns a uniformly-distributed integer in the half-open interval `[0, max)` for any `max ∈ [1, 2…
@@ -160,4 +162,3 @@ list. A consumer that imports only `./pin` pulls neither wordlist.
 ## License

 MIT
-
--- a/plugins/document-navigator/docs/security-stack/security/password-generator/src/password/password.md
+++ b/plugins/document-navigator/docs/security-stack/security/password-generator/src/password/password.md
@@ -3,6 +3,7 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs --> - pronounceable — `generatePronounceablePassword(opts…
+
 - [pronounceable](./pronounceable.md) — `generatePronounceablePassword(opts, rng?)` emits CVC-pattern (consonant–vowel–consonant) syllables suitable for should…
 - pronounceable — `generatePronounceablePassword(opts…

--- a/plugins/document-navigator/docs/security-stack/security/password-strength/README.md
+++ b/plugins/document-navigator/docs/security-stack/security/password-strength/README.md
@@ -66,14 +66,16 @@ hard 200-character DoS guard.
 - [estimate-guesses](./src/scoring/estimate-guesses.md) — Implements the Wheeler 2016 section 4 closed-form guess estimates per pattern type: dictionary (rank × uppercase × l33t…
 - [most-guessable-match-sequence](./src/scoring/most-guessable-match-sequence.md) — Picks the lowest-`Π guesses × k!` cover of the password from the union of pattern matches plus implicit bruteforce-char…
 - [score](./src/scoring/score.md) — Maps a `guesses` count to a coarse integer score per Wheeler 2016 section 5. This score (`0`–`4`) is what most consumer…
+
 <!-- end:auto-docs -->  - [assess-reactive](./src/assess/assess-reactive.md) — Debounce + cancel-on-newer-input wrapper around `assess` for UI strength meters that update as the user types. Each new…
-  - [assess](./src/assess/assess.md) — <!-- begin:auto-docs --> _(no submodules)_- [dicts](./src/dicts/load-dictionaries.md) — <!-- begin:auto-docs --> _(no submodules)_- [de](./src/dicts/de/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [wikipedia](./src/dicts/de/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [english-wikipedia](./src/dicts/en/english-wikipedia.md) — Frequency-ranked dictionary of the most common English tokens observed in Wikipedia. The matcher uses this to flag pass…
-  - [names](./src/dicts/en/names.md) — Frequency-ranked dictionaries of common US given names (male and female) and surnames. Names are over-represented in pa…
-  - [passwords](./src/dicts/en/passwords.md) — Frequency-ranked dictionary of the most common passwords observed across public breach corpora (RockYou, HaveIBeenPwned…
-  - [es](./src/dicts/es/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [wikipedia](./src/dicts/es/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [fr](./src/dicts/fr/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [wikipedia](./src/dicts/fr/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [ru](./src/dicts/ru/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [wikipedia](./src/dicts/ru/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [zh-Hans](./src/dicts/zh-Hans/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [wikipedia](./src/dicts/zh-Hans/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [load-dictionaries](./src/dicts/load-dictionaries.md) — <!-- begin:auto-docs --> _(no submodules)_- [errors](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [error-codes](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [feedback](./src/feedback/feedback.md) — <!-- begin:auto-docs --> _(no submodules)_- [feedback](./src/feedback/feedback.md) — <!-- begin:auto-docs --> _(no submodules)_- [graphs](./src/graphs/validate-graph.md) — <!-- begin:auto-docs --> _(no submodules)_- [azerty](./src/graphs/azerty/azerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [azerty](./src/graphs/azerty/azerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./src/graphs/dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./src/graphs/dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./src/graphs/qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./src/graphs/qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate-graph](./src/graphs/validate-graph.md) — <!-- begin:auto-docs --> _(no submodules)_- [matchers](./src/matchers/types.md) — <!-- begin:auto-docs --> _(no submodules)_- [date](./src/matchers/date/date.md) — <!-- begin:auto-docs --> _(no submodules)_- [date](./src/matchers/date/date.md) — <!-- begin:auto-docs --> _(no submodules)_- [dictionary](./src/matchers/dictionary/dictionary.md) — <!-- begin:auto-docs --> _(no submodules)_- l33t-table — Provides the default character → lette…
-    - [dictionary](./src/matchers/dictionary/dictionary.md) — <!-- begin:auto-docs --> _(no submodules)_- l33t-table — Provides the default character → lette…
-    - [l33t-table](./src/matchers/dictionary/l33t-table.md) — Provides the default character → letter substitution table used by the `dictionaryMatch` matcher to recognise l33t-enco…
-  - [keyboard](./src/matchers/keyboard/keyboard.md) — <!-- begin:auto-docs --> _(no submodules)_- [keyboard](./src/matchers/keyboard/keyboard.md) — <!-- begin:auto-docs --> _(no submodules)_- [regex](./src/matchers/regex/regex.md) — <!-- begin:auto-docs --> _(no submodules)_- [regex](./src/matchers/regex/regex.md) — <!-- begin:auto-docs --> _(no submodules)_- [repeat](./src/matchers/repeat/repeat.md) — <!-- begin:auto-docs --> _(no submodules)_- [repeat](./src/matchers/repeat/repeat.md) — <!-- begin:auto-docs --> _(no submodules)_- [sequence](./src/matchers/sequence/sequence.md) — <!-- begin:auto-docs --> _(no submodules)_- [sequence](./src/matchers/sequence/sequence.md) — <!-- begin:auto-docs --> _(no submodules)_- [types](./src/matchers/types.md) — <!-- begin:auto-docs --> _(no submodules)_- [observability](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [metrics](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [crack-times](./src/scoring/crack-times.md) — Maps a `guesses` count to seconds-to-crack under the four canonical attack scenarios from Wheeler 2016 section 5: onlin…
+
+- [assess](./src/assess/assess.md) — <!-- begin:auto-docs --> _(no submodules)_- [dicts](./src/dicts/load-dictionaries.md) — <!-- begin:auto-docs --> _(no submodules)_- [de](./src/dicts/de/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [wikipedia](./src/dicts/de/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [english-wikipedia](./src/dicts/en/english-wikipedia.md) — Frequency-ranked dictionary of the most common English tokens observed in Wikipedia. The matcher uses this to flag pass…
+- [names](./src/dicts/en/names.md) — Frequency-ranked dictionaries of common US given names (male and female) and surnames. Names are over-represented in pa…
+- [passwords](./src/dicts/en/passwords.md) — Frequency-ranked dictionary of the most common passwords observed across public breach corpora (RockYou, HaveIBeenPwned…
+- [es](./src/dicts/es/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [wikipedia](./src/dicts/es/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [fr](./src/dicts/fr/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [wikipedia](./src/dicts/fr/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [ru](./src/dicts/ru/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [wikipedia](./src/dicts/ru/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [zh-Hans](./src/dicts/zh-Hans/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [wikipedia](./src/dicts/zh-Hans/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [load-dictionaries](./src/dicts/load-dictionaries.md) — <!-- begin:auto-docs --> _(no submodules)_- [errors](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [error-codes](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [feedback](./src/feedback/feedback.md) — <!-- begin:auto-docs --> _(no submodules)_- [feedback](./src/feedback/feedback.md) — <!-- begin:auto-docs --> _(no submodules)_- [graphs](./src/graphs/validate-graph.md) — <!-- begin:auto-docs --> _(no submodules)_- [azerty](./src/graphs/azerty/azerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [azerty](./src/graphs/azerty/azerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./src/graphs/dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./src/graphs/dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./src/graphs/qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./src/graphs/qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate-graph](./src/graphs/validate-graph.md) — <!-- begin:auto-docs --> _(no submodules)_- [matchers](./src/matchers/types.md) — <!-- begin:auto-docs --> _(no submodules)_- [date](./src/matchers/date/date.md) — <!-- begin:auto-docs --> _(no submodules)_- [date](./src/matchers/date/date.md) — <!-- begin:auto-docs --> _(no submodules)_- [dictionary](./src/matchers/dictionary/dictionary.md) — <!-- begin:auto-docs --> _(no submodules)_- l33t-table — Provides the default character → lette…
+  - [dictionary](./src/matchers/dictionary/dictionary.md) — <!-- begin:auto-docs --> _(no submodules)_- l33t-table — Provides the default character → lette…
+  - [l33t-table](./src/matchers/dictionary/l33t-table.md) — Provides the default character → letter substitution table used by the `dictionaryMatch` matcher to recognise l33t-enco…
+- [keyboard](./src/matchers/keyboard/keyboard.md) — <!-- begin:auto-docs --> _(no submodules)_- [keyboard](./src/matchers/keyboard/keyboard.md) — <!-- begin:auto-docs --> _(no submodules)_- [regex](./src/matchers/regex/regex.md) — <!-- begin:auto-docs --> _(no submodules)_- [regex](./src/matchers/regex/regex.md) — <!-- begin:auto-docs --> _(no submodules)_- [repeat](./src/matchers/repeat/repeat.md) — <!-- begin:auto-docs --> _(no submodules)_- [repeat](./src/matchers/repeat/repeat.md) — <!-- begin:auto-docs --> _(no submodules)_- [sequence](./src/matchers/sequence/sequence.md) — <!-- begin:auto-docs --> _(no submodules)_- [sequence](./src/matchers/sequence/sequence.md) — <!-- begin:auto-docs --> _(no submodules)_- [types](./src/matchers/types.md) — <!-- begin:auto-docs --> _(no submodules)_- [observability](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [metrics](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [crack-times](./src/scoring/crack-times.md) — Maps a `guesses` count to seconds-to-crack under the four canonical attack scenarios from Wheeler 2016 section 5: onlin…
 - [estimate-guesses](./src/scoring/estimate-guesses.md) — Implements the Wheeler 2016 section 4 closed-form guess estimates per pattern type: dictionary (rank × uppercase × l33t…
 - [most-guessable-match-sequence](./src/scoring/most-guessable-match-sequence.md) — Picks the lowest-`Π guesses × k!` cover of the password from the union of pattern matches plus implicit bruteforce-char…
 - [score](./src/scoring/score.md) — Maps a `guesses` count to a coarse integer score per Wheeler 2016 section 5. This score (`0`–`4`) is what most consumer…
@@ -204,4 +206,3 @@ locally. Indicative timings on commodity hardware (single fork, no warmup):
 | DP n=199 | ~12 ms |

 The 200-character DoS guard keeps p99 well under the 5 ms `it()` default.
-
--- a/plugins/document-navigator/docs/security-stack/security/password-strength/src/dicts/load-dictionaries.md
+++ b/plugins/document-navigator/docs/security-stack/security/password-strength/src/dicts/load-dictionaries.md
@@ -3,7 +3,7 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [wikipedia](./de/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [english-wikipedia](./en/english-wikipedia.md) — Frequency-ranked dictionary of the most common English tokens observed in Wikipedia. The matcher uses this to flag pass…
+- [wikipedia](./de/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [english-wikipedia](./en/english-wikipedia.md) — Frequency-ranked dictionary of the most common English tokens observed in Wikipedia. The matcher uses this to flag pass…
 - [names](./en/names.md) — Frequency-ranked dictionaries of common US given names (male and female) and surnames. Names are over-represented in pa…
 - [passwords](./en/passwords.md) — Frequency-ranked dictionary of the most common passwords observed across public breach corpora (RockYou, HaveIBeenPwned…
 - [es](./es/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_  - [wikipedia](./es/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [fr](./fr/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_  - [wikipedia](./fr/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [ru](./ru/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_  - [wikipedia](./ru/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [zh-Hans](./zh-Hans/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_  - [wikipedia](./zh-Hans/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [load-dictionaries](./load-dictionaries.md) — <!-- begin:auto-docs --> _(no submodules)_- wikipedia — <!-- begin:auto-docs --> _(no submodules…
@@ -22,6 +22,7 @@ _(no submodules)_
 - [names](./en/names.md) — Frequency-ranked dictionaries of common US given names (male and female) and surnames. Names are over-represented in pa…
 - [passwords](./en/passwords.md) — Frequency-ranked dictionary of the most common passwords observed across public breach corpora (RockYou, HaveIBeenPwned…
 - [es](./es/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_  - [wikipedia](./es/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [fr](./fr/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_  - [wikipedia](./fr/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [ru](./ru/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_  - [wikipedia](./ru/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [zh-Hans](./zh-Hans/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_  - [wikipedia](./zh-Hans/wikipedia.md) — <!-- begin:auto-docs --> _(no submodules)_- [load-dictionaries](./load-dictionaries.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose

 Builds a fresh `DictionarySet` value from a caller-supplied partial map,
--- a/plugins/document-navigator/docs/security-stack/security/password-strength/src/graphs/validate-graph.md
+++ b/plugins/document-navigator/docs/security-stack/security/password-strength/src/graphs/validate-graph.md
@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [azerty](./azerty/azerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_  - [dvorak](./dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_  - [qwerty](./qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate-graph](./validate-graph.md) — <!-- begin:auto-docs --> _(no submodules)_- azerty — <!-- begin:auto-docs --> _(no submodules)_…
+- [azerty](./azerty/azerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_  - [dvorak](./dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_  - [qwerty](./qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate-graph](./validate-graph.md) — <!-- begin:auto-docs --> _(no submodules)_- azerty — <!-- begin:auto-docs --> _(no submodules)_…
 - [azerty](./azerty/azerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate-graph](./validate-graph.md) — <!-- begin:auto-docs --> _(no submodules)_- [azerty](./azerty/azerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate-graph](./validate-graph.md) — <!-- begin:auto-docs --> _(no submodules)_- azerty — <!-- begin:auto-doc…
 - [azerty](./azerty/azerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate-graph](./validate-graph.md) — <!-- begin:auto-docs --> _(no submodules)_- azerty — <!-- begin:auto-docs --> _(no submodules)_…
 - [azerty](./azerty/azerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [dvorak](./dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_  - [dvorak](./dvorak/dvorak.md) — <!-- begin:auto-docs --> _(no submodules)_- [qwerty](./qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_  - [qwerty](./qwerty/qwerty.md) — <!-- begin:auto-docs --> _(no submodules)_- [validate-graph](./validate-graph.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose

 Validates that a user-supplied keyboard adjacency graph is well-formed
--- a/plugins/document-navigator/docs/security-stack/security/password-strength/src/matchers/dictionary/dictionary.md
+++ b/plugins/document-navigator/docs/security-stack/security/password-strength/src/matchers/dictionary/dictionary.md
@@ -3,6 +3,7 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs --> - l33t-table — Provides the default character → lette…
+
 - [l33t-table](./l33t-table.md) — Provides the default character → letter substitution table used by the `dictionaryMatch` matcher to recognise l33t-enco…
 - l33t-table — Provides the default character → lette…

--- a/plugins/document-navigator/docs/security-stack/security/password-strength/src/matchers/types.md
+++ b/plugins/document-navigator/docs/security-stack/security/password-strength/src/matchers/types.md
@@ -3,9 +3,9 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [date](./date/date.md) — <!-- begin:auto-docs --> _(no submodules)_- [dictionary](./dictionary/dictionary.md) — <!-- begin:auto-docs --> _(no submodules)_- l33t-table — Provides the default character → lette…
-  - [dictionary](./dictionary/dictionary.md) — <!-- begin:auto-docs --> _(no submodules)_- l33t-table — Provides the default character → lette…
-  - [l33t-table](./dictionary/l33t-table.md) — Provides the default character → letter substitution table used by the `dictionaryMatch` matcher to recognise l33t-enco…
+- [date](./date/date.md) — <!-- begin:auto-docs --> _(no submodules)_- [dictionary](./dictionary/dictionary.md) — <!-- begin:auto-docs --> _(no submodules)_- l33t-table — Provides the default character → lette…
+- [dictionary](./dictionary/dictionary.md) — <!-- begin:auto-docs --> _(no submodules)_- l33t-table — Provides the default character → lette…
+- [l33t-table](./dictionary/l33t-table.md) — Provides the default character → letter substitution table used by the `dictionaryMatch` matcher to recognise l33t-enco…
 - [keyboard](./keyboard/keyboard.md) — <!-- begin:auto-docs --> _(no submodules)_  - [keyboard](./keyboard/keyboard.md) — <!-- begin:auto-docs --> _(no submodules)_- [regex](./regex/regex.md) — <!-- begin:auto-docs --> _(no submodules)_  - [regex](./regex/regex.md) — <!-- begin:auto-docs --> _(no submodules)_- [repeat](./repeat/repeat.md) — <!-- begin:auto-docs --> _(no submodules)_  - [repeat](./repeat/repeat.md) — <!-- begin:auto-docs --> _(no submodules)_- [sequence](./sequence/sequence.md) — <!-- begin:auto-docs --> _(no submodules)_  - [sequence](./sequence/sequence.md) — <!-- begin:auto-docs --> _(no submodules)_- [types](./types.md) — <!-- begin:auto-docs --> _(no submodules)_- date — <!-- begin:auto-docs --> _(no submodules)_ <!…
 - [date](./date/date.md) — <!-- begin:auto-docs --> _(no submodules)_- [dictionary](./dictionary/dictionary.md) — <!-- begin:auto-docs --> _(no submodules)_- l33t-table — Provides the default character → lette…
  - [dictionary](./dictionary/dictionary.md) — <!-- begin:auto-docs --> _(no submodules)_- l33t-table — Provides the default character → lette…
@@ -20,6 +20,7 @@ _(no submodules)_
 - [keyboard](./keyboard/keyboard.md) — <!-- begin:auto-docs --> _(no submodules)_- [keyboard](./keyboard/keyboard.md) — <!-- begin:auto-docs --> _(no submodules)_- [regex](./regex/regex.md) — <!-- begin:auto-docs --> _(no submodules)_- [regex](./regex/regex.md) — <!-- begin:auto-docs --> _(no submodules)_- [repeat](./repeat/repeat.md) — <!-- begin:auto-docs --> _(no submodules)_- [repeat](./repeat/repeat.md) — <!-- begin:auto-docs --> _(no submodules)_- [sequence](./sequence/sequence.md) — <!-- begin:auto-docs --> _(no submodules)_- [sequence](./sequence/sequence.md) — <!-- begin:auto-docs --> _(no submodules)_- [types](./types.md) — <!-- begin:auto-docs --> _(no submodules)_- date — <!-- begin:auto-docs --> _(no submodules)_ <…
 - [date](./date/date.md) — <!-- begin:auto-docs --> _(no submodules)_- [dictionary](./dictionary/dictionary.md) — <!-- begin:auto-docs --> _(no submodules)_  - [dictionary](./dictionary/dictionary.md) — <!-- begin:auto-docs --> _(no submodules)_  - [l33t-table](./dictionary/l33t-table.md) — Provides the default character → letter substitution table used by the `dictionaryMatch` matcher to recognise l33t-enco…
 - [keyboard](./keyboard/keyboard.md) — <!-- begin:auto-docs --> _(no submodules)_  - [keyboard](./keyboard/keyboard.md) — <!-- begin:auto-docs --> _(no submodules)_- [regex](./regex/regex.md) — <!-- begin:auto-docs --> _(no submodules)_  - [regex](./regex/regex.md) — <!-- begin:auto-docs --> _(no submodules)_- [repeat](./repeat/repeat.md) — <!-- begin:auto-docs --> _(no submodules)_  - [repeat](./repeat/repeat.md) — <!-- begin:auto-docs --> _(no submodules)_- [sequence](./sequence/sequence.md) — <!-- begin:auto-docs --> _(no submodules)_  - [sequence](./sequence/sequence.md) — <!-- begin:auto-docs --> _(no submodules)_- [types](./types.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose

 Declares the cross-matcher discriminated-union types and shared shapes
--- a/plugins/document-navigator/docs/security-stack/security/security-codes/README.md
+++ b/plugins/document-navigator/docs/security-stack/security/security-codes/README.md
@@ -29,7 +29,9 @@ AWS access keys, OpenAI keys, Google API keys, and high-entropy heuristics.
  - [security-codes](./src/types/security-codes.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
 - [utils](./src/utils/luhn.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
  - [luhn](./src/utils/luhn.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+
 <!-- end:auto-docs -->  - [code-detector](./src/core/code-detector/code-detector.md) — <!-- begin:auto-docs --> _(no submodules)_- [code-sanitizer](./src/core/code-sanitizer/code-sanitizer.md) — <!-- begin:auto-docs --> _(no submodules)_- [code-sanitizer](./src/core/code-sanitizer/code-sanitizer.md) — <!-- begin:auto-docs --> _(no submodules)_- [errors](./src/errors/security-codes-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [security-codes-error](./src/errors/security-codes-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [aws](./src/patterns/aws.md) — Detects AWS Access Key IDs within arbitrary string input. AWS Access Key IDs are 20-character alphanumeric identifiers…
+
 - [credit-card](./src/patterns/credit-card.md) — Detects credit card numbers embedded in arbitrary strings using a combination of regex matching and the Luhn checksum a…
 - [entropy](./src/patterns/entropy.md) — Detects high-entropy strings that are likely secret tokens, API keys, or passwords using Shannon entropy analysis. This…
 - [github](./src/patterns/github.md) — Detects GitHub Personal Access Tokens (PATs) — both classic tokens (`ghp_…`) and the newer fine-grained tokens (`github…
@@ -70,6 +72,7 @@ AWS access keys, OpenAI keys, Google API keys, and high-entropy heuristics.
 - [ssh](./src/patterns/ssh.md) — Detects SSH private keys and public keys embedded in arbitrary strings. SSH private keys grant direct shell access to a…
 - [stripe](./src/patterns/stripe.md) — Detects Stripe API keys — both secret keys (`sk_live_` / `sk_test_`) and publishable keys (`pk_live_` / `pk_test_`) — e…
 - [types](./src/types/security-codes.md) — <!-- begin:auto-docs --> _(no submodules)_  - [security-codes](./src/types/security-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [utils](./src/utils/luhn.md) — <!-- begin:auto-docs --> _(no submodules)_  - [luhn](./src/utils/luhn.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Features

 - **10 built-in pattern detectors** covering the most common secret types
--- a/plugins/document-navigator/docs/security-stack/security/server-keys/README.md
+++ b/plugins/document-navigator/docs/security-stack/security/server-keys/README.md
@@ -192,4 +192,3 @@ await runFunction("custom-cmd", async (signal) => {
  license format requires secp256k1; the vault's sign slot is
  ed25519. The license bin therefore uses its own `keygen` sub-command
  rather than trying to reuse the vault's signing key.
-
--- a/plugins/document-navigator/docs/security-stack/security/slsa/README.md
+++ b/plugins/document-navigator/docs/security-stack/security/slsa/README.md
@@ -34,9 +34,11 @@ typed `SlsaError` subclasses with stable error codes.
 - [verification](./src/verification/verification.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
  - [checks](./src/verification/checks.md) — Individual, stateless verification rules that consume a provenance statement plus policy inputs and return a structured…
  - [verification](./src/verification/verification.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+
 <!-- end:auto-docs -->  - [assessment](./src/assessment/assessment.md) — <!-- begin:auto-docs --> _(no submodules)_- [dsse](./src/attestation/dsse/dsse.md) — <!-- begin:auto-docs --> _(no submodules)_- [dsse](./src/attestation/dsse/dsse.md) — <!-- begin:auto-docs --> _(no submodules)_- [errors](./src/errors/slsa-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [slsa-error](./src/errors/slsa-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [otel](./src/otel/slsa-otel.md) — <!-- begin:auto-docs --> _(no submodules)_- [slsa-otel](./src/otel/slsa-otel.md) — <!-- begin:auto-docs --> _(no submodules)_- [policy](./src/policy/policy.md) — <!-- begin:auto-docs --> _(no submodules)_- [policy](./src/policy/policy.md) — <!-- begin:auto-docs --> _(no submodules)_- [provenance](./src/provenance/provenance.md) — <!-- begin:auto-docs --> _(no submodules)_- [canonical-json](./src/provenance/canonical-json.md) — Produces a byte-stable, lexicographically-ordered JSON encoding for provenance statements, SBOM documents, and DSSE pay…
-  - [digest](./src/provenance/digest.md) — Single canonical entry point for SHA-256 digest computation inside the SLSA package. Deliberately routes through `@suav…
-  - [provenance](./src/provenance/provenance.md) — <!-- begin:auto-docs --> _(no submodules)_- [inclusion-proof](./src/rekor/inclusion-proof.md) — Verifies an RFC 6962 Merkle inclusion proof as returned by Sigstore Rekor. Given a leaf (the canonical body a Rekor ent…
+
+- [digest](./src/provenance/digest.md) — Single canonical entry point for SHA-256 digest computation inside the SLSA package. Deliberately routes through `@suav…
+- [provenance](./src/provenance/provenance.md) — <!-- begin:auto-docs --> _(no submodules)_- [inclusion-proof](./src/rekor/inclusion-proof.md) — Verifies an RFC 6962 Merkle inclusion proof as returned by Sigstore Rekor. Given a leaf (the canonical body a Rekor ent…
 - [rekor-client](./src/rekor/rekor-client.md) — Minimal Sigstore Rekor REST client for the two upload shapes Suaveplan cares about: `hashedrekord` v0.0.1 (when logging…
 - [sbom](./src/sbom/sbom.md) — <!-- begin:auto-docs --> _(no submodules)_- [sbom](./src/sbom/sbom.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/parse.md) — <!-- begin:auto-docs --> _(no submodules)_- [parse](./src/schemas/parse.md) — <!-- begin:auto-docs --> _(no submodules)_- [verification](./src/verification/verification.md) — <!-- begin:auto-docs --> _(no submodules)_- [checks](./src/verification/checks.md) — Individual, stateless verification rules that consume a provenance statement plus policy inputs and return a structured…
  - [verification](./src/verification/verification.md) — <!-- begin:auto-docs --> _(no submodules)_- [assessment](./src/assessment/assessment.md) — <!-- begin:auto-docs --> _(no submodules)_- [dsse](./src/attestation/dsse/dsse.md) — <!-- begin:auto-docs --> _(no submodules)_- [dsse](./src/attestation/dsse/dsse.md) — <!-- begin:auto-docs --> _(no submodules)_- [errors](./src/errors/slsa-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [slsa-error](./src/errors/slsa-error.md) — <!-- begin:auto-docs --> _(no submodules)_- [otel](./src/otel/slsa-otel.md) — <!-- begin:auto-docs --> _(no submodules)_- [slsa-otel](./src/otel/slsa-otel.md) — <!-- begin:auto-docs --> _(no submodules)_- [policy](./src/policy/policy.md) — <!-- begin:auto-docs --> _(no submodules)_- [policy](./src/policy/policy.md) — <!-- begin:auto-docs --> _(no submodules)_- [provenance](./src/provenance/provenance.md) — <!-- begin:auto-docs --> _(no submodules)_- [canonical-json](./src/provenance/canonical-json.md) — Produces a byte-stable, lexicographically-ordered JSON encoding for provenance statements, SBOM documents, and DSSE pay…
@@ -55,6 +57,7 @@ typed `SlsaError` subclasses with stable error codes.
 - [rekor-client](./src/rekor/rekor-client.md) — Minimal Sigstore Rekor REST client for the two upload shapes Suaveplan cares about: `hashedrekord` v0.0.1 (when logging…
 - [sbom](./src/sbom/sbom.md) — <!-- begin:auto-docs --> _(no submodules)_  - [sbom](./src/sbom/sbom.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/parse.md) — <!-- begin:auto-docs --> _(no submodules)_  - [parse](./src/schemas/parse.md) — <!-- begin:auto-docs --> _(no submodules)_- [verification](./src/verification/verification.md) — <!-- begin:auto-docs --> _(no submodules)_  - [checks](./src/verification/checks.md) — Individual, stateless verification rules that consume a provenance statement plus policy inputs and return a structured…
  - [verification](./src/verification/verification.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Install

 ```bash
@@ -135,4 +138,3 @@ console.log(assessSlsaLevel({ ...environment, hasRekorInclusion: true }).level);
 - Tests: 170 passing (13 files).
 - Coverage: 99.2% statements, 100% functions, 99.44% lines, 95.15% branches.
 - Typecheck, lint, and build all green.
-
--- a/plugins/document-navigator/docs/security-stack/security/srp/README.md
+++ b/plugins/document-navigator/docs/security-stack/security/srp/README.md
@@ -48,7 +48,9 @@ SRP-6a zero-knowledge password proof per [RFC 5054](https://www.rfc-editor.org/r
 - [server-start](./src/server/server-start.md) — Begin the SRP-6a handshake on the server side. Loads the stored verifier `v` (alongside the user's `(I, salt)`), draws…
 - [verifier](./src/verifier/verifier.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
  - [verifier](./src/verifier/verifier.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+
 <!-- end:auto-docs -->  - [errors](./src/errors/errors.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups](./src/groups/groups-2048.md) — <!-- begin:auto-docs --> _(no submodules)_- [1024](./src/groups/1024/groups-1024.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-1024](./src/groups/1024/groups-1024.md) — <!-- begin:auto-docs --> _(no submodules)_- [1536](./src/groups/1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-1536](./src/groups/1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_- [3072](./src/groups/3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-3072](./src/groups/3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_- [4096](./src/groups/4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-4096](./src/groups/4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_- [6144](./src/groups/6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-6144](./src/groups/6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_- [8192](./src/groups/8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-8192](./src/groups/8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-2048](./src/groups/groups-2048.md) — <!-- begin:auto-docs --> _(no submodules)_- [hash](./src/hash/hash-bridge.md) — <!-- begin:auto-docs --> _(no submodules)_- [hash-bridge](./src/hash/hash-bridge.md) — <!-- begin:auto-docs --> _(no submodules)_- [k](./src/math/k.md) — Compute the SRP-6a multiplier parameter `k = H(N | PAD(g))` per RFC 5054 §2.5.3. The multiplier is the structural chang…
+
 - [modpow](./src/math/modpow.md) — Modular exponentiation primitive for `@suaveplan/srp`. This is a thin wrapper over `@noble/curves`'s hardened `pow(num,…
 - [pad](./src/math/pad.md) — The `PAD(x, N)` helper from RFC 5054 §2.5.3. Returns a left-zero-extended copy of `x` whose length equals `N.byteLength…
 - [proof](./src/math/proof.md) — Internal helpers for computing the SRP-6a / RFC 2945 §3 mutual-authentication proofs `M1` and `M2`. Both client and ser…
@@ -93,6 +95,7 @@ SRP-6a zero-knowledge password proof per [RFC 5054](https://www.rfc-editor.org/r
 - [server-m2](./src/server/server-m2.md) — Split-roundtrip helper that computes the server proof `M2 = H(A | M1 | K)` independently of `serverFinishHandshake`. Us…
 - [server-start](./src/server/server-start.md) — Begin the SRP-6a handshake on the server side. Loads the stored verifier `v` (alongside the user's `(I, salt)`), draws…
 - [verifier](./src/verifier/verifier.md) — <!-- begin:auto-docs --> _(no submodules)_  - [verifier](./src/verifier/verifier.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Install

 ```bash
@@ -188,4 +191,3 @@ bun scripts/generate-srp-vectors.ts [--seed=42]
 ```

 Regenerates `src/__fixtures__/vectors-2048-sha256.json` deterministically.
-
--- a/plugins/document-navigator/docs/security-stack/security/srp/src/groups/groups-2048.md
+++ b/plugins/document-navigator/docs/security-stack/security/srp/src/groups/groups-2048.md
@@ -3,10 +3,11 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [groups-1024](./1024/groups-1024.md) — <!-- begin:auto-docs --> _(no submodules)_- [1536](./1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-1536](./1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_- [3072](./3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-3072](./3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_- [4096](./4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-4096](./4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_- [6144](./6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-6144](./6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_- [8192](./8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-8192](./8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-2048](./groups-2048.md) — <!-- begin:auto-docs --> _(no submodules)_- groups-1024 — <!-- begin:auto-docs --> _(no submodul…
+- [groups-1024](./1024/groups-1024.md) — <!-- begin:auto-docs --> _(no submodules)_- [1536](./1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-1536](./1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_- [3072](./3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-3072](./3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_- [4096](./4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-4096](./4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_- [6144](./6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-6144](./6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_- [8192](./8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-8192](./8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-2048](./groups-2048.md) — <!-- begin:auto-docs --> _(no submodules)_- groups-1024 — <!-- begin:auto-docs --> _(no submodul…
 - [groups-1024](./1024/groups-1024.md) — <!-- begin:auto-docs --> _(no submodules)_- [1536](./1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-1536](./1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_- [3072](./3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-3072](./3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_- [4096](./4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-4096](./4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_- [6144](./6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-6144](./6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_- [8192](./8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-8192](./8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-2048](./groups-2048.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-1024](./1024/groups-1024.md) — <!-- begin:auto-docs --> _(no submodules)_- [1536](./1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-1536](./1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_- [3072](./3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-3072](./3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_- [4096](./4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-4096](./4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_- [6144](./6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-6144](./6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_- [8192](./8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-8192](./8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-2048](./groups-2048.md) — <!-- begin:auto-docs --> _(no submodules)_- groups-1024 — <!-- begin:aut…
 - [groups-1024](./1024/groups-1024.md) — <!-- begin:auto-docs --> _(no submodules)_- [1536](./1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-1536](./1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_- [3072](./3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-3072](./3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_- [4096](./4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-4096](./4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_- [6144](./6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-6144](./6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_- [8192](./8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-8192](./8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-2048](./groups-2048.md) — <!-- begin:auto-docs --> _(no submodules)_- groups-1024 — <!-- begin:auto-docs --> _(no submodu…
 - [groups-1024](./1024/groups-1024.md) — <!-- begin:auto-docs --> _(no submodules)_- [1536](./1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-1536](./1536/groups-1536.md) — <!-- begin:auto-docs --> _(no submodules)_- [3072](./3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-3072](./3072/groups-3072.md) — <!-- begin:auto-docs --> _(no submodules)_- [4096](./4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-4096](./4096/groups-4096.md) — <!-- begin:auto-docs --> _(no submodules)_- [6144](./6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-6144](./6144/groups-6144.md) — <!-- begin:auto-docs --> _(no submodules)_- [8192](./8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_  - [groups-8192](./8192/groups-8192.md) — <!-- begin:auto-docs --> _(no submodules)_- [groups-2048](./groups-2048.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose

 The bundled 2048-bit safe-prime group from RFC 5054 Appendix A. This is the default SRP-6a group every consumer of `@suaveplan/srp` gets without any additional import: `N_2048` is a 256-byte modulus, `g_2048` is the single byte `0x02`, and `BIT_LENGTH` is the literal `2048`. RFC 5054 deliberately bundles a small set of fixed safe primes to side-step trust-on-first-use over arbitrary moduli; we ship the 2048-bit one as the default because it sits at the contemporary security floor while keeping a 2048-bit `modPow` cheap enough (~5–20 ms) for an interactive login.
--- a/plugins/document-navigator/docs/security-stack/security/tpm-struct/README.md
+++ b/plugins/document-navigator/docs/security-stack/security/tpm-struct/README.md
@@ -43,9 +43,11 @@ available at the WebAuthn step-5/step-8 call site.
  - [serialize](./src/public/serialize.md) — `serializeTpmtPublic` re-emits a parsed `TpmtPublic` value as the TCG-canonical byte string per Library Part 2 §12.2. I…
 - [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
  - [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+
 <!-- end:auto-docs -->  - [alg](./src/alg/alg.md) — <!-- begin:auto-docs --> _(no submodules)_- [attest](./src/attest/attest.md) — <!-- begin:auto-docs --> _(no submodules)_- serialize — `serializeTpmsAttest` re-emits a parsed…
-  - [attest](./src/attest/attest.md) — <!-- begin:auto-docs --> _(no submodules)_- serialize — `serializeTpmsAttest` re-emits a parsed…
-  - [serialize](./src/attest/serialize.md) — `serializeTpmsAttest` re-emits a parsed `TpmsAttest` value as the TCG-canonical byte string per Library Part 2 §10.12.…
+
+- [attest](./src/attest/attest.md) — <!-- begin:auto-docs --> _(no submodules)_- serialize — `serializeTpmsAttest` re-emits a parsed…
+- [serialize](./src/attest/serialize.md) — `serializeTpmsAttest` re-emits a parsed `TpmsAttest` value as the TCG-canonical byte string per Library Part 2 §10.12.…
 - [buffer](./src/buffer/buffer.md) — <!-- begin:auto-docs --> _(no submodules)_- [buffer](./src/buffer/buffer.md) — <!-- begin:auto-docs --> _(no submodules)_- [diagnostic](./src/diagnostic/diagnostic.md) — <!-- begin:auto-docs --> _(no submodules)_- [diagnostic](./src/diagnostic/diagnostic.md) — <!-- begin:auto-docs --> _(no submodules)_- [errors](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [error-codes](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [extra-data](./src/extra-data/extra-data.md) — <!-- begin:auto-docs --> _(no submodules)_- [extra-data](./src/extra-data/extra-data.md) — <!-- begin:auto-docs --> _(no submodules)_- [name](./src/name/name.md) — <!-- begin:auto-docs --> _(no submodules)_- [name](./src/name/name.md) — <!-- begin:auto-docs --> _(no submodules)_- [observability](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [metrics](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [public](./src/public/public.md) — <!-- begin:auto-docs --> _(no submodules)_- serialize — `serializeTpmtPublic` re-emits a parsed…
  - [object-attributes](./src/public/object-attributes.md) — `decodeObjectAttributes` (and its inverse `encodeObjectAttributes`) walk the 32-bit `TPMA_OBJECT` bitfield documented i…
  - [public](./src/public/public.md) — <!-- begin:auto-docs --> _(no submodules)_- serialize — `serializeTpmtPublic` re-emits a parsed…
@@ -68,6 +70,7 @@ available at the WebAuthn step-5/step-8 call site.
 - [buffer](./src/buffer/buffer.md) — <!-- begin:auto-docs --> _(no submodules)_  - [buffer](./src/buffer/buffer.md) — <!-- begin:auto-docs --> _(no submodules)_- [diagnostic](./src/diagnostic/diagnostic.md) — <!-- begin:auto-docs --> _(no submodules)_  - [diagnostic](./src/diagnostic/diagnostic.md) — <!-- begin:auto-docs --> _(no submodules)_- [errors](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_  - [error-codes](./src/errors/error-codes.md) — <!-- begin:auto-docs --> _(no submodules)_- [extra-data](./src/extra-data/extra-data.md) — <!-- begin:auto-docs --> _(no submodules)_  - [extra-data](./src/extra-data/extra-data.md) — <!-- begin:auto-docs --> _(no submodules)_- [name](./src/name/name.md) — <!-- begin:auto-docs --> _(no submodules)_  - [name](./src/name/name.md) — <!-- begin:auto-docs --> _(no submodules)_- [observability](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_  - [metrics](./src/observability/metrics.md) — <!-- begin:auto-docs --> _(no submodules)_- [public](./src/public/public.md) — <!-- begin:auto-docs --> _(no submodules)_  - [object-attributes](./src/public/object-attributes.md) — `decodeObjectAttributes` (and its inverse `encodeObjectAttributes`) walk the 32-bit `TPMA_OBJECT` bitfield documented i…
  - [public](./src/public/public.md) — <!-- begin:auto-docs --> _(no submodules)_  - [serialize](./src/public/serialize.md) — `serializeTpmtPublic` re-emits a parsed `TpmtPublic` value as the TCG-canonical byte string per Library Part 2 §12.2. I…
 - [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_  - [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Install

 ```bash
@@ -130,4 +133,3 @@ if (
 ## License

 MIT.
-
--- a/plugins/document-navigator/docs/security-stack/security/tpm-struct/src/attest/attest.md
+++ b/plugins/document-navigator/docs/security-stack/security/tpm-struct/src/attest/attest.md
@@ -3,6 +3,7 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs --> - serialize — `serializeTpmsAttest` re-emits a parsed…
+
 - [serialize](./serialize.md) — `serializeTpmsAttest` re-emits a parsed `TpmsAttest` value as the TCG-canonical byte string per Library Part 2 §10.12.…
 - serialize — `serializeTpmsAttest` re-emits a parsed…

--- a/plugins/document-navigator/docs/security-stack/security/tpm-struct/src/public/public.md
+++ b/plugins/document-navigator/docs/security-stack/security/tpm-struct/src/public/public.md
@@ -3,6 +3,7 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs --> - serialize — `serializeTpmtPublic` re-emits a parsed…
+
 - [serialize](./serialize.md) — `serializeTpmtPublic` re-emits a parsed `TpmtPublic` value as the TCG-canonical byte string per Library Part 2 §12.2. I…
 - serialize — `serializeTpmtPublic` re-emits a parsed…

--- a/plugins/document-navigator/docs/security-stack/security/vault-sync/README.md
+++ b/plugins/document-navigator/docs/security-stack/security/vault-sync/README.md
@@ -33,7 +33,9 @@ vector-clock causal ordering, and XChaCha20-Poly1305 sync payloads.
  - [types](./src/types/types.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
 - [vector-clock](./src/vector-clock/vector-clock.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
  - [vector-clock](./src/vector-clock/vector-clock.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs -->
+
 <!-- end:auto-docs -->  - [crypto-sync](./src/crypto-sync/crypto-sync.md) — <!-- begin:auto-docs --> _(no submodules)_- [engine](./src/engine/engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [engine](./src/engine/engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes.md) — `codes.ts` defines the canonical, frozen registry of every fully-qualified error code emitted by `@suaveplan/vault-sync…
+
 - [vault-sync-error](./src/errors/vault-sync-error.md) — `VaultSyncError` is the single concrete error class thrown from every production path inside `@suaveplan/vault-sync`. I…
 - [merge](./src/merge/merge.md) — <!-- begin:auto-docs --> _(no submodules)_- [merge](./src/merge/merge.md) — <!-- begin:auto-docs --> _(no submodules)_- [otel](./src/otel/instruments.md) — <!-- begin:auto-docs --> _(no submodules)_- [instruments](./src/otel/instruments.md) — <!-- begin:auto-docs --> _(no submodules)_- [patch](./src/patch/patch.md) — <!-- begin:auto-docs --> _(no submodules)_- [patch](./src/patch/patch.md) — <!-- begin:auto-docs --> _(no submodules)_- [queue](./src/queue/queue.md) — <!-- begin:auto-docs --> _(no submodules)_- [queue](./src/queue/queue.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [types](./src/types/types.md) — <!-- begin:auto-docs --> _(no submodules)_- [types](./src/types/types.md) — <!-- begin:auto-docs --> _(no submodules)_- [vector-clock](./src/vector-clock/vector-clock.md) — <!-- begin:auto-docs --> _(no submodules)_- [vector-clock](./src/vector-clock/vector-clock.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-sync](./src/crypto-sync/crypto-sync.md) — <!-- begin:auto-docs --> _(no submodules)_- [engine](./src/engine/engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [engine](./src/engine/engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes.md) — `codes.ts` defines the canonical, frozen registry of every fully-qualified error code emitted by `@suaveplan/vault-sync…
 - [vault-sync-error](./src/errors/vault-sync-error.md) — `VaultSyncError` is the single concrete error class thrown from every production path inside `@suaveplan/vault-sync`. I…
@@ -42,6 +44,7 @@ vector-clock causal ordering, and XChaCha20-Poly1305 sync payloads.
 - [merge](./src/merge/merge.md) — <!-- begin:auto-docs --> _(no submodules)_- [merge](./src/merge/merge.md) — <!-- begin:auto-docs --> _(no submodules)_- [otel](./src/otel/instruments.md) — <!-- begin:auto-docs --> _(no submodules)_- [instruments](./src/otel/instruments.md) — <!-- begin:auto-docs --> _(no submodules)_- [patch](./src/patch/patch.md) — <!-- begin:auto-docs --> _(no submodules)_- [patch](./src/patch/patch.md) — <!-- begin:auto-docs --> _(no submodules)_- [queue](./src/queue/queue.md) — <!-- begin:auto-docs --> _(no submodules)_- [queue](./src/queue/queue.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [types](./src/types/types.md) — <!-- begin:auto-docs --> _(no submodules)_- [types](./src/types/types.md) — <!-- begin:auto-docs --> _(no submodules)_- [vector-clock](./src/vector-clock/vector-clock.md) — <!-- begin:auto-docs --> _(no submodules)_- [vector-clock](./src/vector-clock/vector-clock.md) — <!-- begin:auto-docs --> _(no submodules)_- [crypto-sync](./src/crypto-sync/crypto-sync.md) — <!-- begin:auto-docs --> _(no submodules)_- [engine](./src/engine/engine.md) — <!-- begin:auto-docs --> _(no submodules)_  - [engine](./src/engine/engine.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes.md) — `codes.ts` defines the canonical, frozen registry of every fully-qualified error code emitted by `@suaveplan/vault-sync…
 - [vault-sync-error](./src/errors/vault-sync-error.md) — `VaultSyncError` is the single concrete error class thrown from every production path inside `@suaveplan/vault-sync`. I…
 - [merge](./src/merge/merge.md) — <!-- begin:auto-docs --> _(no submodules)_  - [merge](./src/merge/merge.md) — <!-- begin:auto-docs --> _(no submodules)_- [otel](./src/otel/instruments.md) — <!-- begin:auto-docs --> _(no submodules)_  - [instruments](./src/otel/instruments.md) — <!-- begin:auto-docs --> _(no submodules)_- [patch](./src/patch/patch.md) — <!-- begin:auto-docs --> _(no submodules)_  - [patch](./src/patch/patch.md) — <!-- begin:auto-docs --> _(no submodules)_- [queue](./src/queue/queue.md) — <!-- begin:auto-docs --> _(no submodules)_  - [queue](./src/queue/queue.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_  - [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [types](./src/types/types.md) — <!-- begin:auto-docs --> _(no submodules)_  - [types](./src/types/types.md) — <!-- begin:auto-docs --> _(no submodules)_- [vector-clock](./src/vector-clock/vector-clock.md) — <!-- begin:auto-docs --> _(no submodules)_  - [vector-clock](./src/vector-clock/vector-clock.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Install

 ```bash
@@ -123,4 +126,3 @@ bunx turbo test --filter=@suaveplan/vault-sync
 bunx turbo test:coverage --filter=@suaveplan/vault-sync   # 100/100/100/100
 bunx turbo lint typecheck --filter=@suaveplan/vault-sync
 ```
-
--- a/plugins/document-navigator/docs/security-stack/security/vault/README.md
+++ b/plugins/document-navigator/docs/security-stack/security/vault/README.md
@@ -39,7 +39,9 @@ Vault orchestration layer for the Vaulted password-manager ecosystem. Provides a
  - [lifecycle](./src/vault/lifecycle.md) — `lifecycle.ts` extracts the two side-effecting helpers that drive the unlock path: `deriveVaultKeyBuffer` (running 2SKD…
  - [vault](./src/vault/vault.md) — <!-- begin:auto-docs --> _(no submodules)_ <!-- end:auto-docs --> - wiring — `wiring.ts` extracts the per-unlock module…
  - [wiring](./src/vault/wiring.md) — `wiring.ts` extracts the per-unlock module factories used by `Vault`: `buildItems`, `buildSearch`, `buildAttachments`,…
+
 <!-- end:auto-docs -->  - [attachments](./src/attachments/attachments.md) — <!-- begin:auto-docs --> _(no submodules)_- [container](./src/container/container.md) — <!-- begin:auto-docs --> _(no submodules)_- [container](./src/container/container.md) — <!-- begin:auto-docs --> _(no submodules)_- [encryption](./src/encryption/field-encryption.md) — <!-- begin:auto-docs --> _(no submodules)_- [field-encryption](./src/encryption/field-encryption.md) — <!-- begin:auto-docs --> _(no submodules)_- [codes](./src/errors/codes.md) — `codes.ts` defines the stable error-code registry for `@suaveplan/vault`. Every failure raised by the orchestration lay…
+
 - [vault-error](./src/errors/vault-error.md) — `vault-error.ts` defines `VaultError`, the concrete `SuaveplanError` subclass thrown by every public path in `@suavepla…
 - [items](./src/items/items.md) — <!-- begin:auto-docs --> _(no submodules)_- [migrations](./src/items/migrations/migrations.md) — <!-- begin:auto-docs --> _(no submodules)_- [migrations](./src/items/migrations/migrations.md) — <!-- begin:auto-docs --> _(no submodules)_- [helpers](./src/items/helpers.md) — `items-helpers.ts` extracts the pure transformation helpers used by the items repository: row-to-item projection (with…
  - [items](./src/items/items.md) — <!-- begin:auto-docs --> _(no submodules)_- [manifest](./src/manifest/manifest.md) — <!-- begin:auto-docs --> _(no submodules)_- [manifest](./src/manifest/manifest.md) — <!-- begin:auto-docs --> _(no submodules)_- [otel](./src/otel/instruments.md) — <!-- begin:auto-docs --> _(no submodules)_- [instruments](./src/otel/instruments.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [schemas](./src/schemas/schemas.md) — <!-- begin:auto-docs --> _(no submodules)_- [search](./src/search/search.md) — <!-- begin:auto-docs --> _(no submodules)_- [search](./src/search/search.md) — <!-- begin:auto-docs --> _(no submodules)_- [shares](./src/shares/shares.md) — <!-- begin:auto-docs --> _(no submodules)_- [shares](./src/shares/shares.md) — <!-- begin:auto-docs --> _(no submodules)_- [sync](./src/sync/sync.md) — <!-- begin:auto-docs --> _(no submodules)_- [sync](./src/sync/sync.md) — <!-- begin:auto-docs --> _(no submodules)_- [types](./src/types/types.md) — <!-- begin:auto-docs --> _(no submodules)_- [adapters](./src/types/adapters.md) — `adapters.ts` defines the Phase-1 adapter contracts the vault orchestration layer uses to talk to blob storage, share-l…
@@ -153,4 +155,3 @@ await vault.lock(); // zeroizes all key material
 ## Phased delivery

 This is the Phase-1 landing. Adapter interfaces (`DriveLike`, `DriveSharingLike`, `VaultSyncLike`) are defined inline; production wiring binds the real `@suaveplan/drive`, `@suaveplan/drive-sharing`, and `@suaveplan/vault-sync` packages without changes to this surface.
-
--- a/plugins/document-navigator/docs/security-stack/security/vault/src/items/items.md
+++ b/plugins/document-navigator/docs/security-stack/security/vault/src/items/items.md
@@ -3,7 +3,7 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs -->
-  - [migrations](./migrations/migrations.md) — <!-- begin:auto-docs --> _(no submodules)_- [helpers](./helpers.md) — `items-helpers.ts` extracts the pure transformation helpers used by the items repository: row-to-item projection (with…
+- [migrations](./migrations/migrations.md) — <!-- begin:auto-docs --> _(no submodules)_- [helpers](./helpers.md) — `items-helpers.ts` extracts the pure transformation helpers used by the items repository: row-to-item projection (with…
 - [items](./items.md) — <!-- begin:auto-docs --> _(no submodules)_- migrations — <!-- begin:auto-docs --> _(no submodule…
 - [migrations](./migrations/migrations.md) — <!-- begin:auto-docs --> _(no submodules)_- [helpers](./helpers.md) — `items-helpers.ts` extracts the pure transformation helpers used by the items repository: row-to-item projection (with…
 - [items](./items.md) — <!-- begin:auto-docs --> _(no submodules)_- [migrations](./migrations/migrations.md) — <!-- begin:auto-docs --> _(no submodules)_- [helpers](./helpers.md) — `items-helpers.ts` extracts the pure transformation helpers used by the items repository: row-to-item projection (with…
@@ -12,6 +12,7 @@ _(no submodules)_
 - [items](./items.md) — <!-- begin:auto-docs --> _(no submodules)_- migrations — <!-- begin:auto-docs --> _(no submodul…
 - [migrations](./migrations/migrations.md) — <!-- begin:auto-docs --> _(no submodules)_- [helpers](./helpers.md) — `items-helpers.ts` extracts the pure transformation helpers used by the items repository: row-to-item projection (with…
 - [items](./items.md) — <!-- begin:auto-docs --> _(no submodules)_
+
 ## Purpose

 `items.ts` exposes the `VaultItems` class, the in-memory CRUD repository over the vault container's item map. It is the boundary between the public `vault.items` surface and the underlying state — every public method validates input via Zod, mutates the container `Map<string, VaultItemRow>`, appends an audit entry to the container history, encrypts concealed-field values per item, and notifies the orchestrator that a flush is due.
--- a/plugins/document-navigator/docs/security-stack/security/vault/src/vault/vault.md
+++ b/plugins/document-navigator/docs/security-stack/security/vault/src/vault/vault.md
@@ -3,6 +3,7 @@
 <!-- begin:auto-docs -->
 _(no submodules)_
 <!-- end:auto-docs --> - wiring — `wiring.ts` extracts the per-unlock module…
+
 - [wiring](./wiring.md) — `wiring.ts` extracts the per-unlock module factories used by `Vault`: `buildItems`, `buildSearch`, `buildAttachments`,…
 - wiring — `wiring.ts` extracts the per-unlock module…

--- a/plugins/document-navigator/docs/security-stack/security/x509/README.md
+++ b/plugins/document-navigator/docs/security-stack/security/x509/README.md
@@ -41,7 +41,9 @@ RFC 5280 X.509 v3 certificate parser and certification-path validator. Universal
 - [verify](./src/signature/verify.md) — The `signature/verify` module is part of the certificate signature-verify pipeline. Together with the rest of the `sign…
 - [trust-anchor](./src/validate/trust-anchor.md) — `validate/trust-anchor` is the core of the certificate path-validation pipeline. `validateChain` walks the certificate…
 - [validate-chain](./src/validate/validate-chain.md) — `validate/validate-chain` is the core of the certificate path-validation pipeline. `validateChain` walks the certificat…
+
 <!-- end:auto-docs -->  - [build-certs](./src/__fixtures__/build-certs.md) — <!-- begin:auto-docs --> _(no submodules)_- [decoder](./src/asn1/decoder.md) — Implements `decodeAsn1(bytes, mode)` covering every ASN.1 production used by RFC 5280 Appendix A: primitive scalars (`I…
+
 - [encoder](./src/asn1/encoder.md) — Implements `encodeAsn1(node)` producing canonical DER bytes per X.690 paragraph 10 for any `Asn1Node` the decoder accep…
 - [oid](./src/asn1/oid.md) — Encodes and decodes ASN.1 OBJECT IDENTIFIER bodies per X.690 paragraph 8.19. OIDs in X.509 identify algorithms, extensi…
 - [strings](./src/asn1/strings.md) — Decodes and encodes the typed ASN.1 string types used inside X.509 Names and SubjectAltName entries: `UTF8String`, `Pri…
@@ -202,4 +204,3 @@ console.log(result.trustedPath.length); // 3
 - __Certificate issuance / signing__ — follow-up `@suaveplan/x509-ca`.
 - __Policy mapping / policy constraints__ — decoded as `RawExtension`; critical occurrence triggers `CRITICAL_EXTENSION_UNRECOGNIZED` per RFC 5280 §6.1.4(f).
 - __PKCS#12 / PKCS#11 / smartcard__ — not in scope.
-