admin
9bf56a806b
Relocate the ~6k-file docs tree from the repo root into plugins/document-navigator/docs/ so the plugin is self-contained and portable. docs/superpowers/ (specs and plans) stays at the repo root. Moved via cp+rm rather than git mv because directory rename() fails with EPERM on this WSL /mnt DrvFs mount; git rename-detection pairs the identical-content files at commit time. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
security-stack
Cryptography, vaults, security utilities, and threat-detection primitives.
Subcategories
2 subcategories, 28 packages.
crypto
Cryptographic primitives, ciphers, hashes, curves, and key management.
| Package | Description |
|---|---|
@suaveplan/crypto |
Universal cryptographic primitives — engine-pluggable AEAD, Ed25519/ECDSA-P256 signing, X25519 key agreement, sealed-box, and auth-box. Built on audited @noble… |
@suaveplan/crypto-bin |
Suaveplan password-hashing CLI. Ships the suaveplan-hash-password binary — Argon2id (default) and BLAKE2b password hashing + verification with PHC/MCF-format… |
@suaveplan/crypto-browser |
WebCrypto-backed engine implementations for @suaveplan/crypto — AES-256-GCM, Ed25519, ECDSA-P256/P384, X25519, ECDH-P256/P384, RSA, AES-KW, and non-extractab… |
@suaveplan/crypto-cipher |
Low-level AEAD (Authenticated Encryption with Associated Data) cipher primitives for the @suaveplan/crypto stack. Provides three algorithms — AES-256-GCM, Ch… |
@suaveplan/crypto-cli |
Suaveplan keychain CLI — root + server identity lifecycle (init, roll, revoke, inspect, verify, export-public, restore) |
@suaveplan/crypto-core |
Universal cryptographic primitives — engine-pluggable AEAD, Ed25519/ECDSA-P256 signing, X25519 key agreement, sealed-box, and auth-box. Built on audited @noble… |
@suaveplan/crypto-curve |
Low-level elliptic-curve building blocks for the @suaveplan/crypto stack. Exposes four curves — secp256k1, Ed25519, X25519, and NIST P-256 — each as a standa… |
@suaveplan/crypto-hash |
Pure-TypeScript hashing substrate. SHA-2 digests, HMAC, HKDF, PBKDF2, Argon2id, and hex/Base64 encoding — no WASM, no browser globals, fully tree-shakeable. |
@suaveplan/crypto-keys |
Hierarchical keychain chain-signing for the crypto ecosystem. Store-agnostic, free of node: / bun: imports. |
@suaveplan/crypto-rsa |
RSA primitives for Suaveplan — RFC 8017 PKCS #1 v2.2, RFC 5208 / RFC 5958 PKCS #8, RFC 5280 SPKI, RFC 7517 / RFC 7518 JWK, RFC 7468 PEM. Universal package (zer… |
@suaveplan/crypto-sodium |
libsodium-backed engine implementations for @suaveplan/crypto. Provides AEAD encryption, Ed25519 signing, X25519 key agreement, sealed-box, auth-box, determi… |
@suaveplan/crypto-utils |
Shared cryptographic utilities consumed internally by all other @suaveplan/crypto-* packages. Provides the low-level primitives that every crypto implementat… |
@suaveplan/crypto-vault |
Cryptographic foundation for the Vaulted password-manager ecosystem. Provides BIP39 mnemonic generation, OWASP-grade Argon2id derivation, two-secret key deriva… |
security
Have-I-Been-Pwned checks, JWS, licensing, and OTP utilities.
| Package | Description |
|---|---|
@suaveplan/hibp |
Privacy-preserving Have I Been Pwned v3 client. Universal — works in Node, Bun, Deno, browsers, edge workers. The only required runtime primitive is fetch. |
@suaveplan/jws |
RFC 7515 JSON Web Signature (verify + sign). Pure TypeScript over Uint8Array + DataView plus the workspace crypto primitives (@suaveplan/crypto-rsa,… |
@suaveplan/license |
Compact, offline-verifiable, secp256k1-signed software-license-key format. Bit-for-bit wire-format compatible with upstream @suaveplan/license. runs unchange… |
@suaveplan/otp |
RFC 4226 (HOTP) + RFC 6238 (TOTP) + RFC 6287 (OCRA) + Google Authenticator Key URI Format + Base32 (RFC 4648 §6) + recovery codes + clock-drift detector — zero browser/Node deps |
@suaveplan/password-formats |
Universal import/export layer for common password-manager export formats. Parses Apple Passwords CSV, Bitwarden JSON, Chrome CSV, and KeePass XML into a normal… |
@suaveplan/password-generator |
Cryptographically-strong password and passphrase generator — char-class, pronounceable, EFF Diceware, and PIN modes with bias-free RNG, real entropy estimates,… |
@suaveplan/password-strength |
zxcvbn-style password strength estimator — pattern-matching + dictionary cracker model per Wheeler 2016. Universal; zero browser/Node/React deps. Re-implementa… |
@suaveplan/security-codes |
Detect and sanitise sensitive security-code leakage in strings. Handles API keys, JWTs, credit cards, GitHub tokens, Stripe keys, SSH keys, PEM blocks, AWS acc… |
@suaveplan/server-keys |
Operator-facing CLI bundle for the Suaveplan server-key lifecycle: 18 bins covering root + server keychain generation (including hierarchical `ChainedKeySigner… |
@suaveplan/slsa |
SLSA L1-L2 supply-chain security for Suaveplan. Generates and verifies in-toto / SLSA v1.0 provenance, CycloneDX 1.5 SBOMs, DSSE attestation envelopes, and RFC… |
@suaveplan/srp |
SRP-6a zero-knowledge password proof per RFC 5054 / RFC 2945. Universal — client and server roles in one package, bundled 2048-bit safe-prime group, optional 1… |
@suaveplan/tpm-struct |
Zero-runtime-dep TPM 2.0 attestation-structure parser and serialiser. Decodes TPMS_ATTEST (TCG TPM 2.0 Library Part 2 §10.12), decodes TPMT_PUBLIC (§12.2),… |
@suaveplan/vault |
Vault orchestration layer for the Vaulted password-manager ecosystem. Provides a drive-backed encrypted SQLite-style container, a strict locked ↔ unlocked… |
@suaveplan/vault-sync |
Domain-specific sync and conflict-resolution engine for the Vaulted password-manager ecosystem. Builds on @suaveplan/crdt and @suaveplan/diff (RFC 6902 JSO… |
@suaveplan/x509 |
RFC 5280 X.509 v3 certificate parser and certification-path validator. Universal (zero browser, Node, or React deps). Pure TypeScript over Uint8Array / `Data… |