@knowttl/artium-axi 0.0.4 → 0.0.5

package/README.md

@@ -337,7 +337,8 @@ The native Kerberos provider and its installation script are unnecessary for thi
 
 Obtain a dedicated directory identity with read access only, its bind DN and password, and a directory URL whose certificate can be verified.
 At `/admin/tools/ldap-axi`, enter `url`, choose `auth=simple`, and enter `bindDn` and the password value in `bindPassword`.
-Use `ldaps://<directory-host>:636`, or `ldap://<directory-host>:389` with `startTls=true`.
+Use `ldaps://<directory-host>:636` with `startTls` left at the default (unset) or explicitly `false`, or `ldap://<directory-host>:389` with `startTls=true`.
+Saving an `ldaps://` URL with `startTls=true` is rejected with `INVALID_INPUT` and the message `startTls must be false for this URL.`
 Plaintext simple bind, anonymous authentication, disabled certificate verification and caller-supplied connection or credential overrides are refused.
 If a private CA is required, supply its PEM contents in `caFile`, not a server file path.
 The multi-line `caFile` editor preserves newlines through saving and private CA file materialization for each call.
@@ -762,7 +763,8 @@ Fake-service results do not establish live platform permissions or production re
 Never put tokens or keys in arguments, source files, images or logs.
 The server refuses the removed development-authentication settings `ARTIUM_AXI_DEV` and `ARTIUM_AXI_DEV_TOKEN_FILE`.
 
-Local passwords use Argon2id, require 15 to 128 code points and at most 512 UTF-8 bytes, preserve spaces and Unicode, and reject exact matches in the bundled common-password list.
+Local passwords use Argon2id and accept any non-empty password of at most 512 UTF-8 bytes, preserving spaces and Unicode.
+The byte cap bounds input to native hashing; there are no minimum-length, character-count or common-password rules.
 Access tokens last one hour within an 8-hour SSO CLI family or a 12-hour local CLI family; refresh-token reuse revokes the family.
 Password changes revoke existing CLI tokens and browser sessions.
 See [browser administration](#browser-administration) for session management and user archival.
@@ -802,18 +804,23 @@ pnpm test:containers
 See [checklist verification](docs/verification-s46.md) for the fake-only download, authentication, setup and first-call checks.
 It refuses unverified host platforms.
 
+The [Vitest configuration](vitest.config.ts) separates unit and integration projects.
+Only the integration project loads the [reduced-cost password hashing setup](test/fixtures/integration-setup.ts); local authentication unit tests and the native smoke retain production hashing costs, as does the dummy hash used for missing accounts.
+
 | Command | Scope |
 | --- | --- |
 | `pnpm lint` | Static TypeScript checking. |
 | `pnpm test` | Inventory/schema freshness checks and the full Vitest suite. |
 | `pnpm build` | Server compilation and standalone client bundle. |
 | `pnpm test:security` | Tests whose names contain `security`. |
-| `pnpm test:containers` | Mandatory fake-only runner, walking-skeleton, Graph headless and fake-service container acceptance. |
+| `pnpm test:containers` | Fake-only runner, walking-skeleton, Graph headless and fake-service container acceptance. |
 | `pnpm test:browser` | Real admin pages in an isolated Chrome session through `chrome-devtools-axi`, against the local fake browser harness. |
 | `pnpm test:containers --measure-cache` | The container block plus an identical-input warm runner build measurement. |
 | `pnpm errors:generate` | Regenerate the error reference after changing the catalogue. |
 
-The container block builds before probing, emits head/input/output evidence and timings, and removes its uniquely owned test images and private BuildKit cache.
+The container block builds before running independent acceptance phases concurrently, emits head/input/output evidence and timings, and waits for every phase before removing its uniquely owned test images and private BuildKit cache.
+The [gate configuration](.no-mistakes.yaml) owns the paths that require container acceptance and the CLI, documentation, workflow and skill-only exemptions.
+Every release requires container acceptance under the [release prerequisites](docs/runbook.md#npm-client-releases).
 Do not touch shared Docker resources or use real service credentials.
 Changed relevant inputs invalidate earlier container evidence.
 Upstream pins and integrity records live in [tools/package.json](tools/package.json), [tools/integrity.json](tools/integrity.json) and [tools/falcon-source.json](tools/falcon-source.json).
@@ -827,7 +834,7 @@ Before publishing a candidate, commit and build it, then set `ARTIUM_AXI_HYGIENE
 pnpm hygiene:check
 ```
 
-The UTF-8 list contains one literal term per line, matched case-insensitively after trimming whitespace; blanks and duplicates are ignored.
+The UTF-8 list contains one literal term per line, matched after trimming whitespace using context-independent Unicode simple case folding; blanks and case-equivalent duplicates are ignored.
 Unset, unreadable, empty or in-tree lists fail.
 Never copy real terms or the list into this repository.
 Record only its revision or SHA-256, candidate commit and pass/fail result.
@@ -835,7 +842,7 @@ Record only its revision or SHA-256, candidate commit and pass/fail result.
 The check scans tracked, untracked and ignored files, generated output and every commit message reachable from `HEAD`, excluding only `.git` metadata and installed `node_modules` directories.
 Supply intended release assets outside the checkout as additional `pnpm hygiene:check` arguments, keeping the list outside those directories too.
 Symlinks, unreadable files and BOM-marked UTF-16/UTF-32 assets fail rather than reducing coverage; convert unsupported encodings to UTF-8.
-Diagnostics report location and normalized entry number without secret excerpts, and redact labels whose paths match a term.
+Diagnostics report location (with one-based columns in the original text's UTF-16 code units) and normalized entry number without secret excerpts, and redact labels whose paths match a term using the same folding rule.
 The scan cannot guarantee absence of unknown sensitive values and does not approve publication.
 
 Further operational guidance lives in the [runbook](docs/runbook.md); local implementation and deferred live acceptance are tracked in the [evidence ledger](docs/evidence-ledger.md).

package/bin/artium-axi.mjs

@@ -19692,7 +19692,7 @@ var definitions = {
   PASSWORD_FILE_INVALID: { status: 400, message: "The password file is missing or unreadable.", next: "Supply a readable UTF-8 password file containing the exact password, without an added newline." },
   BOOTSTRAP_INCONSISTENT: { status: 503, message: "The store contains data without a bootstrap marker.", next: "Stop the server and restore a consistent bootstrapped store and matching master key." },
   RECOVERY_FAILED: { status: 500, message: "Administrator recovery did not complete.", next: "Use an existing local username in a bootstrapped store, check the matching master key and inspect local storage." },
-  PASSWORD_INVALID: { status: 400, message: "The password does not meet the local password rules.", next: "Use 15 to 128 Unicode code points, at most 512 UTF-8 bytes, and avoid common passwords." },
+  PASSWORD_INVALID: { status: 400, message: "The password must be non-empty and at most 512 UTF-8 bytes.", next: "Enter a password of at most 512 UTF-8 bytes." },
   SIGN_IN_FAILED: { status: 401, message: "The username or password is incorrect.", next: "Check your username and password." },
   SSO_STATE_INVALID: { status: 400, message: "The SSO sign-in request expired or was already used.", next: "Start a new sign-in from this browser." },
   SSO_TOKEN_INVALID: { status: 401, message: "The identity provider response could not be verified.", next: "Start a new sign-in or ask an administrator to check provider settings." },
@@ -19776,10 +19776,7 @@ var inputLimits = {
   files: 8
 };
 var byteLength = (value) => new TextEncoder().encode(value).length;
-var passwordSchema = external_exports.string().refine((value) => {
-  const length = [...value].length;
-  return length >= 15 && length <= 128 && byteLength(value) <= 512;
-}, "Expected 15 to 128 Unicode code points and at most 512 UTF-8 bytes");
+var passwordSchema = external_exports.string().min(1).refine((value) => byteLength(value) <= 512, "Expected at most 512 UTF-8 bytes");
 var passwordChangeSchema = external_exports.strictObject({ newPassword: external_exports.string(), currentPassword: external_exports.string().optional() });
 var loginSchema = external_exports.strictObject({ username: external_exports.string(), password: external_exports.string() });
 var refreshSchema = external_exports.strictObject({ refreshToken: external_exports.string().min(1) });
@@ -20452,7 +20449,7 @@ import { rootCertificates } from "node:tls";
 // package.json
 var package_default = {
   name: "artium-axi",
-  version: "0.0.4",
+  version: "0.0.5",
   private: true,
   license: "MIT",
   type: "module",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@knowttl/artium-axi",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "description": "Client CLI and embedded skill for the Artium managed tools server.",
   "license": "MIT",
   "type": "module",