cursedbelt-core 2.5.0 → 2.7.0

package/dist/core/file-tree/fileTreeModel.d.ts

@@ -101,10 +101,12 @@ export interface FileTreeNode {
      * container of its own — a drop on the middle half of its row is `{ kind: 'into',
      * parentId: <the file> }`. `apps/desk` is why: a workbook is a leaf in its tree, and
      * dropping a sheet onto one makes the sheet one of its tabs (the owner, desk file `02`).
-     * The edges of the row, and the middle whenever {@link ResolveDropOptions.canDrop} vetoes
-     * the file, still mean *the folder the file is in* — so a column of such files is never a
-     * wall of rows that refuse everything that cannot go inside them. Absent or `false`, a
-     * file row means its folder along its whole height, exactly as before.
+     * The edges of the row still mean *the folder the file is in*, and so does the middle for
+     * any drag {@link ResolveDropOptions.takesDrop} says is not a candidate — so a column of
+     * such files is never a wall of rows that refuse everything that cannot go inside them.
+     * A candidate that {@link ResolveDropOptions.canDrop} vetoes is REFUSED with its words:
+     * the file was the target, and why it cannot take this one has a remedy worth saying.
+     * Absent or `false`, a file row means its folder along its whole height, as before.
      */
     acceptsDrop?: boolean;
     /**
@@ -233,6 +235,17 @@ export interface ResolveDropOptions {
      * this tree is that an impossible drop is never drawn as possible.
      */
     canDrop?: (dragId: string | null, target: FileTreeDrop) => string | null;
+    /**
+     * Whether a file that accepts drops (`acceptsDrop: true` on a FILE) is a candidate for
+     * THIS drag at all. Default: every drag is.
+     *
+     * 🔴 This is the question {@link canDrop} cannot answer, because its `null` means "allow":
+     * `apps/desk` takes a SHEET into a workbook and never a note, so a note over a workbook
+     * must mean the workbook's folder — not a refusal, and not a merge. `false` here is that:
+     * the row goes back to meaning its folder. `true` makes the file the target, and then
+     * `canDrop` decides, in words — *"“Beta” has 2 sheets"* is a refusal with a remedy.
+     */
+    takesDrop?: (dragId: string | null, file: FileTreeNode) => boolean;
 }
 /**
  * Where the pointer currently is, as a decision.
@@ -241,7 +254,7 @@ export interface ResolveDropOptions {
  * offered.** Every refusal below returns a reason rather than a null target, so the cursor
  * and the chip can say no while the row is still in the air.
  */
-export declare function resolveDrop({ nodes, row, offsetRatio, dragId, allowReorder, lockedReason, canDrop, }: ResolveDropOptions): DropOffer;
+export declare function resolveDrop({ nodes, row, offsetRatio, dragId, allowReorder, lockedReason, canDrop, takesDrop, }: ResolveDropOptions): DropOffer;
 export interface KeyboardMoveOptions {
     nodes: readonly FileTreeNode[];
     /** The rows on screen — siblings are read off these, which is every sibling by construction. */

package/dist/core/file-tree/fileTreeModel.js

@@ -125,7 +125,7 @@ export const INTO_ZONE = 0.5;
  * offered.** Every refusal below returns a reason rather than a null target, so the cursor
  * and the chip can say no while the row is still in the air.
  */
-export function resolveDrop({ nodes, row, offsetRatio, dragId, allowReorder = false, lockedReason = 'That folder is locked', canDrop, }) {
+export function resolveDrop({ nodes, row, offsetRatio, dragId, allowReorder = false, lockedReason = 'That folder is locked', canDrop, takesDrop, }) {
     // Blank space under the last row: out of every folder. The one gesture that needs no
     // target, and the only way to say "top level" when the top level has no row of its own.
     if (!row)
@@ -156,15 +156,17 @@ export function resolveDrop({ nodes, row, offsetRatio, dragId, allowReorder = fa
             return { target: null, refused: true, reason: lockedReason };
         return vetted({ target: { kind: 'into', parentId: target.id }, refused: false, reason: null });
     };
-    // A FILE the consumer opted in as a container takes the drop on the middle of its row —
-    // see `FileTreeNode.acceptsDrop`. Vetoed, it falls through to meaning its folder below.
-    if (target.kind === 'file' && !allowReorder && target.acceptsDrop === true && target.id !== dragId) {
+    // A FILE the consumer opted in as a container takes a CANDIDATE drag on the middle of its
+    // row, vetted with words — see `FileTreeNode.acceptsDrop` and `takesDrop`. Anything else
+    // falls through to meaning its folder below.
+    if (target.kind === 'file' &&
+        !allowReorder &&
+        target.acceptsDrop === true &&
+        target.id !== dragId &&
+        (takesDrop?.(dragId, target) ?? true)) {
         const band = (1 - INTO_ZONE) / 2;
-        if (offsetRatio > band && offsetRatio < 1 - band) {
-            const into = vetted({ target: { kind: 'into', parentId: target.id }, refused: false, reason: null });
-            if (into.target)
-                return into;
-        }
+        if (offsetRatio > band && offsetRatio < 1 - band)
+            return vetted({ target: { kind: 'into', parentId: target.id }, refused: false, reason: null });
     }
     // A FILE row means "the folder that row is in" — what every file explorer does, and what
     // keeps a long list of files from being a wall of rows nothing can be dropped on.

package/dist/core/passwordPolicy.d.ts

@@ -1,15 +1,17 @@
 /**
  * The one place a satellite's owner-password floor is decided.
  *
- * ── Why this is shared, and why the default is 9 ────────────────────────────
+ * ── Why this is shared, and why the default is 6 ────────────────────────────
  * Three apps had independently written a `MIN_PASSWORD_BYTES` constant into
  * their own `scripts/owner.ts`, and they had already drifted (9, 14, 14) with
  * a paragraph in each explaining itself against the others. A floor is a
  * POLICY, and a policy copied three times is three policies.
  *
- * The default is {@link DEFAULT_MIN_PASSWORD_BYTES} = 9, which is the floor the
- * owner wants for an ordinary satellite: long enough that it is not a PIN, short
- * enough that it does not push the owner toward writing it down or reusing one.
+ * The default is {@link DEFAULT_MIN_PASSWORD_BYTES} = 6 — the owner, 2026-09-24:
+ * *"make the minimum password length 6 characters"* (it was 9). It is a SIGN-IN
+ * floor: every door that uses it rate-limits guesses, so a short password costs
+ * an attacker attempts, not seconds. A secret that can be guessed OFFLINE (vault's
+ * passphrase, which derives its encryption key) raises it at its own call site.
  * Argon2id — what every caller hashes with — is what actually carries the cost
  * of a guess here; these apps have exactly ONE principal and no enumerable user
  * list, so the marginal value of characters 10–14 is small and the friction is
@@ -25,7 +27,7 @@
  * {@link resolveMinPasswordBytes} takes an optional override and **refuses to
  * go below the default**. An app that genuinely runs at higher stakes says so
  * at its own call site, in one visible argument, with a comment saying why.
- * No app overrides it today — the retired orch companion app did (14, as the single
+ * `vault` does (9, since 2026-09-24 — its passphrase is an encryption key). The retired orch companion app did (14, as the single
  * internet-facing door into the host that runs `claude` in every repo) until
  * the owner dropped it to the shared floor on 2026-07-26.
  *
@@ -38,12 +40,12 @@
  * they read, so a multi-byte character counts as more than one, which is the
  * conservative direction).
  */
-export declare const DEFAULT_MIN_PASSWORD_BYTES = 9;
+export declare const DEFAULT_MIN_PASSWORD_BYTES = 6;
 /**
  * The floor this app enforces: the default, or a higher one it asks for.
  *
  * Throws on an override below the default rather than silently clamping. A
- * caller passing 6 believes it is enforcing 6; being handed 9 without a word is
+ * caller passing 4 believes it is enforcing 4; being handed 6 without a word is
  * how a security floor becomes folklore.
  */
 export declare function resolveMinPasswordBytes(override?: number): number;

package/dist/core/passwordPolicy.js

@@ -1,15 +1,17 @@
 /**
  * The one place a satellite's owner-password floor is decided.
  *
- * ── Why this is shared, and why the default is 9 ────────────────────────────
+ * ── Why this is shared, and why the default is 6 ────────────────────────────
  * Three apps had independently written a `MIN_PASSWORD_BYTES` constant into
  * their own `scripts/owner.ts`, and they had already drifted (9, 14, 14) with
  * a paragraph in each explaining itself against the others. A floor is a
  * POLICY, and a policy copied three times is three policies.
  *
- * The default is {@link DEFAULT_MIN_PASSWORD_BYTES} = 9, which is the floor the
- * owner wants for an ordinary satellite: long enough that it is not a PIN, short
- * enough that it does not push the owner toward writing it down or reusing one.
+ * The default is {@link DEFAULT_MIN_PASSWORD_BYTES} = 6 — the owner, 2026-09-24:
+ * *"make the minimum password length 6 characters"* (it was 9). It is a SIGN-IN
+ * floor: every door that uses it rate-limits guesses, so a short password costs
+ * an attacker attempts, not seconds. A secret that can be guessed OFFLINE (vault's
+ * passphrase, which derives its encryption key) raises it at its own call site.
  * Argon2id — what every caller hashes with — is what actually carries the cost
  * of a guess here; these apps have exactly ONE principal and no enumerable user
  * list, so the marginal value of characters 10–14 is small and the friction is
@@ -25,7 +27,7 @@
  * {@link resolveMinPasswordBytes} takes an optional override and **refuses to
  * go below the default**. An app that genuinely runs at higher stakes says so
  * at its own call site, in one visible argument, with a comment saying why.
- * No app overrides it today — the retired orch companion app did (14, as the single
+ * `vault` does (9, since 2026-09-24 — its passphrase is an encryption key). The retired orch companion app did (14, as the single
  * internet-facing door into the host that runs `claude` in every repo) until
  * the owner dropped it to the shared floor on 2026-07-26.
  *
@@ -38,12 +40,12 @@
  * they read, so a multi-byte character counts as more than one, which is the
  * conservative direction).
  */
-export const DEFAULT_MIN_PASSWORD_BYTES = 9;
+export const DEFAULT_MIN_PASSWORD_BYTES = 6;
 /**
  * The floor this app enforces: the default, or a higher one it asks for.
  *
  * Throws on an override below the default rather than silently clamping. A
- * caller passing 6 believes it is enforcing 6; being handed 9 without a word is
+ * caller passing 4 believes it is enforcing 4; being handed 6 without a word is
  * how a security floor becomes folklore.
  */
 export function resolveMinPasswordBytes(override) {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-core",
-	"version": "2.5.0",
+	"version": "2.7.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "Framework-agnostic core of the cursedbelt split — isomorphic domain logic. cwip below it, cursedbelt-server and cursedbelt (react) above it.",

package/src/core/file-tree/fileTreeModel.spec.ts

@@ -246,8 +246,14 @@ describe('resolveDrop onto a file that accepts drops', () => {
     { id: 'loose', name: 'loose.csv', kind: 'file' },
   ];
   const rows = flattenFileTree(nodes, []);
-  const on = (id: string, dragId: string, offsetRatio: number, canDrop?: (d: string | null, t: FileTreeDrop) => string | null) =>
-    resolveDrop({ nodes, row: rowFor(rows, id), offsetRatio, dragId, ...(canDrop ? { canDrop } : {}) });
+  const on = (
+    id: string,
+    dragId: string,
+    offsetRatio: number,
+    canDrop?: (d: string | null, t: FileTreeDrop) => string | null,
+    takesDrop?: (d: string | null, file: FileTreeNode) => boolean,
+  ) =>
+    resolveDrop({ nodes, row: rowFor(rows, id), offsetRatio, dragId, ...(canDrop ? { canDrop } : {}), ...(takesDrop ? { takesDrop } : {}) });
 
   test('the middle of its row is INTO the file', () => {
     expect(on('q3', 'loose', 0.5).target).toEqual({ kind: 'into', parentId: 'q3' });
@@ -258,11 +264,22 @@ describe('resolveDrop onto a file that accepts drops', () => {
     expect(on('q3', 'loose', 0.9).target).toEqual({ kind: 'into', parentId: 'work' });
   });
 
-  test('🔴 a veto on the file falls back to its folder rather than refusing the row', () => {
-    const onlySheets = (dragId: string | null, target: FileTreeDrop) =>
-      target.kind === 'into' && target.parentId === 'q3' && dragId !== 'loose' ? 'Only a sheet can become a tab' : null;
-    expect(on('q3', 'report', 0.5, onlySheets).target).toEqual({ kind: 'into', parentId: 'work' });
-    expect(on('q3', 'loose', 0.5, onlySheets).target).toEqual({ kind: 'into', parentId: 'q3' });
+  test('🔴 a drag that is not a candidate means the folder — not a refusal, not the file', () => {
+    // desk: a note over a workbook files it beside the workbook.
+    const onlySheets = (dragId: string | null) => dragId === 'loose';
+    expect(on('q3', 'report', 0.5, undefined, onlySheets).target).toEqual({ kind: 'into', parentId: 'work' });
+    expect(on('q3', 'loose', 0.5, undefined, onlySheets).target).toEqual({ kind: 'into', parentId: 'q3' });
+  });
+
+  test('🔴 a candidate the consumer vetoes is REFUSED, in its words — the file was the target', () => {
+    const full = (_dragId: string | null, target: FileTreeDrop) =>
+      target.kind === 'into' && target.parentId === 'q3' ? '“loose” has 2 sheets' : null;
+    const offer = on('q3', 'loose', 0.5, full);
+    expect(offer.target).toBeNull();
+    expect(offer.refused).toBe(true);
+    expect(offer.reason).toBe('“loose” has 2 sheets');
+    // …and the edges still file it beside the workbook.
+    expect(on('q3', 'loose', 0.1, full).target).toEqual({ kind: 'into', parentId: 'work' });
   });
 
   test('a file never takes itself', () => {

package/src/core/file-tree/fileTreeModel.ts

@@ -104,10 +104,12 @@ export interface FileTreeNode {
    * container of its own — a drop on the middle half of its row is `{ kind: 'into',
    * parentId: <the file> }`. `apps/desk` is why: a workbook is a leaf in its tree, and
    * dropping a sheet onto one makes the sheet one of its tabs (the owner, desk file `02`).
-   * The edges of the row, and the middle whenever {@link ResolveDropOptions.canDrop} vetoes
-   * the file, still mean *the folder the file is in* — so a column of such files is never a
-   * wall of rows that refuse everything that cannot go inside them. Absent or `false`, a
-   * file row means its folder along its whole height, exactly as before.
+   * The edges of the row still mean *the folder the file is in*, and so does the middle for
+   * any drag {@link ResolveDropOptions.takesDrop} says is not a candidate — so a column of
+   * such files is never a wall of rows that refuse everything that cannot go inside them.
+   * A candidate that {@link ResolveDropOptions.canDrop} vetoes is REFUSED with its words:
+   * the file was the target, and why it cannot take this one has a remedy worth saying.
+   * Absent or `false`, a file row means its folder along its whole height, as before.
    */
   acceptsDrop?: boolean;
   /**
@@ -311,6 +313,17 @@ export interface ResolveDropOptions {
    * this tree is that an impossible drop is never drawn as possible.
    */
   canDrop?: (dragId: string | null, target: FileTreeDrop) => string | null;
+  /**
+   * Whether a file that accepts drops (`acceptsDrop: true` on a FILE) is a candidate for
+   * THIS drag at all. Default: every drag is.
+   *
+   * 🔴 This is the question {@link canDrop} cannot answer, because its `null` means "allow":
+   * `apps/desk` takes a SHEET into a workbook and never a note, so a note over a workbook
+   * must mean the workbook's folder — not a refusal, and not a merge. `false` here is that:
+   * the row goes back to meaning its folder. `true` makes the file the target, and then
+   * `canDrop` decides, in words — *"“Beta” has 2 sheets"* is a refusal with a remedy.
+   */
+  takesDrop?: (dragId: string | null, file: FileTreeNode) => boolean;
 }
 
 /**
@@ -328,6 +341,7 @@ export function resolveDrop({
   allowReorder = false,
   lockedReason = 'That folder is locked',
   canDrop,
+  takesDrop,
 }: ResolveDropOptions): DropOffer {
   // Blank space under the last row: out of every folder. The one gesture that needs no
   // target, and the only way to say "top level" when the top level has no row of its own.
@@ -362,14 +376,19 @@ export function resolveDrop({
     return vetted({ target: { kind: 'into', parentId: target.id }, refused: false, reason: null });
   };
 
-  // A FILE the consumer opted in as a container takes the drop on the middle of its row —
-  // see `FileTreeNode.acceptsDrop`. Vetoed, it falls through to meaning its folder below.
-  if (target.kind === 'file' && !allowReorder && target.acceptsDrop === true && target.id !== dragId) {
+  // A FILE the consumer opted in as a container takes a CANDIDATE drag on the middle of its
+  // row, vetted with words — see `FileTreeNode.acceptsDrop` and `takesDrop`. Anything else
+  // falls through to meaning its folder below.
+  if (
+    target.kind === 'file' &&
+    !allowReorder &&
+    target.acceptsDrop === true &&
+    target.id !== dragId &&
+    (takesDrop?.(dragId, target) ?? true)
+  ) {
     const band = (1 - INTO_ZONE) / 2;
-    if (offsetRatio > band && offsetRatio < 1 - band) {
-      const into = vetted({ target: { kind: 'into', parentId: target.id }, refused: false, reason: null });
-      if (into.target) return into;
-    }
+    if (offsetRatio > band && offsetRatio < 1 - band)
+      return vetted({ target: { kind: 'into', parentId: target.id }, refused: false, reason: null });
   }
 
   // A FILE row means "the folder that row is in" — what every file explorer does, and what

package/src/core/passwordPolicy.spec.ts

@@ -7,13 +7,13 @@ import { DEFAULT_MIN_PASSWORD_BYTES, resolveMinPasswordBytes } from './passwordP
 describe('resolveMinPasswordBytes', () => {
   it('is the shared default when an app asks for nothing', () => {
     expect(resolveMinPasswordBytes()).toBe(DEFAULT_MIN_PASSWORD_BYTES);
-    expect(DEFAULT_MIN_PASSWORD_BYTES).toBe(9);
+    expect(DEFAULT_MIN_PASSWORD_BYTES).toBe(6);
   });
   it('lets an app raise it, visibly, at its own call site', () => {
     expect(resolveMinPasswordBytes(14)).toBe(14);
   });
   it('🔴 refuses to go BELOW the default, and refuses a non-integer', () => {
-    expect(() => resolveMinPasswordBytes(8)).toThrow(/may only be RAISED/);
-    expect(() => resolveMinPasswordBytes(9.5)).toThrow(/must be an integer/);
+    expect(() => resolveMinPasswordBytes(5)).toThrow(/may only be RAISED/);
+    expect(() => resolveMinPasswordBytes(6.5)).toThrow(/must be an integer/);
   });
 });

package/src/core/passwordPolicy.ts

@@ -1,15 +1,17 @@
 /**
  * The one place a satellite's owner-password floor is decided.
  *
- * ── Why this is shared, and why the default is 9 ────────────────────────────
+ * ── Why this is shared, and why the default is 6 ────────────────────────────
  * Three apps had independently written a `MIN_PASSWORD_BYTES` constant into
  * their own `scripts/owner.ts`, and they had already drifted (9, 14, 14) with
  * a paragraph in each explaining itself against the others. A floor is a
  * POLICY, and a policy copied three times is three policies.
  *
- * The default is {@link DEFAULT_MIN_PASSWORD_BYTES} = 9, which is the floor the
- * owner wants for an ordinary satellite: long enough that it is not a PIN, short
- * enough that it does not push the owner toward writing it down or reusing one.
+ * The default is {@link DEFAULT_MIN_PASSWORD_BYTES} = 6 — the owner, 2026-09-24:
+ * *"make the minimum password length 6 characters"* (it was 9). It is a SIGN-IN
+ * floor: every door that uses it rate-limits guesses, so a short password costs
+ * an attacker attempts, not seconds. A secret that can be guessed OFFLINE (vault's
+ * passphrase, which derives its encryption key) raises it at its own call site.
  * Argon2id — what every caller hashes with — is what actually carries the cost
  * of a guess here; these apps have exactly ONE principal and no enumerable user
  * list, so the marginal value of characters 10–14 is small and the friction is
@@ -25,7 +27,7 @@
  * {@link resolveMinPasswordBytes} takes an optional override and **refuses to
  * go below the default**. An app that genuinely runs at higher stakes says so
  * at its own call site, in one visible argument, with a comment saying why.
- * No app overrides it today — the retired orch companion app did (14, as the single
+ * `vault` does (9, since 2026-09-24 — its passphrase is an encryption key). The retired orch companion app did (14, as the single
  * internet-facing door into the host that runs `claude` in every repo) until
  * the owner dropped it to the shared floor on 2026-07-26.
  *
@@ -39,13 +41,13 @@
  * they read, so a multi-byte character counts as more than one, which is the
  * conservative direction).
  */
-export const DEFAULT_MIN_PASSWORD_BYTES = 9;
+export const DEFAULT_MIN_PASSWORD_BYTES = 6;
 
 /**
  * The floor this app enforces: the default, or a higher one it asks for.
  *
  * Throws on an override below the default rather than silently clamping. A
- * caller passing 6 believes it is enforcing 6; being handed 9 without a word is
+ * caller passing 4 believes it is enforcing 4; being handed 6 without a word is
  * how a security floor becomes folklore.
  */
 export function resolveMinPasswordBytes(override?: number): number {