cursedbelt-core 2.6.0 → 2.7.0

package/dist/core/passwordPolicy.d.ts

@@ -1,15 +1,17 @@
 /**
  * The one place a satellite's owner-password floor is decided.
  *
- * ── Why this is shared, and why the default is 9 ────────────────────────────
+ * ── Why this is shared, and why the default is 6 ────────────────────────────
  * Three apps had independently written a `MIN_PASSWORD_BYTES` constant into
  * their own `scripts/owner.ts`, and they had already drifted (9, 14, 14) with
  * a paragraph in each explaining itself against the others. A floor is a
  * POLICY, and a policy copied three times is three policies.
  *
- * The default is {@link DEFAULT_MIN_PASSWORD_BYTES} = 9, which is the floor the
- * owner wants for an ordinary satellite: long enough that it is not a PIN, short
- * enough that it does not push the owner toward writing it down or reusing one.
+ * The default is {@link DEFAULT_MIN_PASSWORD_BYTES} = 6 — the owner, 2026-09-24:
+ * *"make the minimum password length 6 characters"* (it was 9). It is a SIGN-IN
+ * floor: every door that uses it rate-limits guesses, so a short password costs
+ * an attacker attempts, not seconds. A secret that can be guessed OFFLINE (vault's
+ * passphrase, which derives its encryption key) raises it at its own call site.
  * Argon2id — what every caller hashes with — is what actually carries the cost
  * of a guess here; these apps have exactly ONE principal and no enumerable user
  * list, so the marginal value of characters 10–14 is small and the friction is
@@ -25,7 +27,7 @@
  * {@link resolveMinPasswordBytes} takes an optional override and **refuses to
  * go below the default**. An app that genuinely runs at higher stakes says so
  * at its own call site, in one visible argument, with a comment saying why.
- * No app overrides it today — the retired orch companion app did (14, as the single
+ * `vault` does (9, since 2026-09-24 — its passphrase is an encryption key). The retired orch companion app did (14, as the single
  * internet-facing door into the host that runs `claude` in every repo) until
  * the owner dropped it to the shared floor on 2026-07-26.
  *
@@ -38,12 +40,12 @@
  * they read, so a multi-byte character counts as more than one, which is the
  * conservative direction).
  */
-export declare const DEFAULT_MIN_PASSWORD_BYTES = 9;
+export declare const DEFAULT_MIN_PASSWORD_BYTES = 6;
 /**
  * The floor this app enforces: the default, or a higher one it asks for.
  *
  * Throws on an override below the default rather than silently clamping. A
- * caller passing 6 believes it is enforcing 6; being handed 9 without a word is
+ * caller passing 4 believes it is enforcing 4; being handed 6 without a word is
  * how a security floor becomes folklore.
  */
 export declare function resolveMinPasswordBytes(override?: number): number;

package/dist/core/passwordPolicy.js

@@ -1,15 +1,17 @@
 /**
  * The one place a satellite's owner-password floor is decided.
  *
- * ── Why this is shared, and why the default is 9 ────────────────────────────
+ * ── Why this is shared, and why the default is 6 ────────────────────────────
  * Three apps had independently written a `MIN_PASSWORD_BYTES` constant into
  * their own `scripts/owner.ts`, and they had already drifted (9, 14, 14) with
  * a paragraph in each explaining itself against the others. A floor is a
  * POLICY, and a policy copied three times is three policies.
  *
- * The default is {@link DEFAULT_MIN_PASSWORD_BYTES} = 9, which is the floor the
- * owner wants for an ordinary satellite: long enough that it is not a PIN, short
- * enough that it does not push the owner toward writing it down or reusing one.
+ * The default is {@link DEFAULT_MIN_PASSWORD_BYTES} = 6 — the owner, 2026-09-24:
+ * *"make the minimum password length 6 characters"* (it was 9). It is a SIGN-IN
+ * floor: every door that uses it rate-limits guesses, so a short password costs
+ * an attacker attempts, not seconds. A secret that can be guessed OFFLINE (vault's
+ * passphrase, which derives its encryption key) raises it at its own call site.
  * Argon2id — what every caller hashes with — is what actually carries the cost
  * of a guess here; these apps have exactly ONE principal and no enumerable user
  * list, so the marginal value of characters 10–14 is small and the friction is
@@ -25,7 +27,7 @@
  * {@link resolveMinPasswordBytes} takes an optional override and **refuses to
  * go below the default**. An app that genuinely runs at higher stakes says so
  * at its own call site, in one visible argument, with a comment saying why.
- * No app overrides it today — the retired orch companion app did (14, as the single
+ * `vault` does (9, since 2026-09-24 — its passphrase is an encryption key). The retired orch companion app did (14, as the single
  * internet-facing door into the host that runs `claude` in every repo) until
  * the owner dropped it to the shared floor on 2026-07-26.
  *
@@ -38,12 +40,12 @@
  * they read, so a multi-byte character counts as more than one, which is the
  * conservative direction).
  */
-export const DEFAULT_MIN_PASSWORD_BYTES = 9;
+export const DEFAULT_MIN_PASSWORD_BYTES = 6;
 /**
  * The floor this app enforces: the default, or a higher one it asks for.
  *
  * Throws on an override below the default rather than silently clamping. A
- * caller passing 6 believes it is enforcing 6; being handed 9 without a word is
+ * caller passing 4 believes it is enforcing 4; being handed 6 without a word is
  * how a security floor becomes folklore.
  */
 export function resolveMinPasswordBytes(override) {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-core",
-	"version": "2.6.0",
+	"version": "2.7.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "Framework-agnostic core of the cursedbelt split — isomorphic domain logic. cwip below it, cursedbelt-server and cursedbelt (react) above it.",

package/src/core/passwordPolicy.spec.ts

@@ -7,13 +7,13 @@ import { DEFAULT_MIN_PASSWORD_BYTES, resolveMinPasswordBytes } from './passwordP
 describe('resolveMinPasswordBytes', () => {
   it('is the shared default when an app asks for nothing', () => {
     expect(resolveMinPasswordBytes()).toBe(DEFAULT_MIN_PASSWORD_BYTES);
-    expect(DEFAULT_MIN_PASSWORD_BYTES).toBe(9);
+    expect(DEFAULT_MIN_PASSWORD_BYTES).toBe(6);
   });
   it('lets an app raise it, visibly, at its own call site', () => {
     expect(resolveMinPasswordBytes(14)).toBe(14);
   });
   it('🔴 refuses to go BELOW the default, and refuses a non-integer', () => {
-    expect(() => resolveMinPasswordBytes(8)).toThrow(/may only be RAISED/);
-    expect(() => resolveMinPasswordBytes(9.5)).toThrow(/must be an integer/);
+    expect(() => resolveMinPasswordBytes(5)).toThrow(/may only be RAISED/);
+    expect(() => resolveMinPasswordBytes(6.5)).toThrow(/must be an integer/);
   });
 });

package/src/core/passwordPolicy.ts

@@ -1,15 +1,17 @@
 /**
  * The one place a satellite's owner-password floor is decided.
  *
- * ── Why this is shared, and why the default is 9 ────────────────────────────
+ * ── Why this is shared, and why the default is 6 ────────────────────────────
  * Three apps had independently written a `MIN_PASSWORD_BYTES` constant into
  * their own `scripts/owner.ts`, and they had already drifted (9, 14, 14) with
  * a paragraph in each explaining itself against the others. A floor is a
  * POLICY, and a policy copied three times is three policies.
  *
- * The default is {@link DEFAULT_MIN_PASSWORD_BYTES} = 9, which is the floor the
- * owner wants for an ordinary satellite: long enough that it is not a PIN, short
- * enough that it does not push the owner toward writing it down or reusing one.
+ * The default is {@link DEFAULT_MIN_PASSWORD_BYTES} = 6 — the owner, 2026-09-24:
+ * *"make the minimum password length 6 characters"* (it was 9). It is a SIGN-IN
+ * floor: every door that uses it rate-limits guesses, so a short password costs
+ * an attacker attempts, not seconds. A secret that can be guessed OFFLINE (vault's
+ * passphrase, which derives its encryption key) raises it at its own call site.
  * Argon2id — what every caller hashes with — is what actually carries the cost
  * of a guess here; these apps have exactly ONE principal and no enumerable user
  * list, so the marginal value of characters 10–14 is small and the friction is
@@ -25,7 +27,7 @@
  * {@link resolveMinPasswordBytes} takes an optional override and **refuses to
  * go below the default**. An app that genuinely runs at higher stakes says so
  * at its own call site, in one visible argument, with a comment saying why.
- * No app overrides it today — the retired orch companion app did (14, as the single
+ * `vault` does (9, since 2026-09-24 — its passphrase is an encryption key). The retired orch companion app did (14, as the single
  * internet-facing door into the host that runs `claude` in every repo) until
  * the owner dropped it to the shared floor on 2026-07-26.
  *
@@ -39,13 +41,13 @@
  * they read, so a multi-byte character counts as more than one, which is the
  * conservative direction).
  */
-export const DEFAULT_MIN_PASSWORD_BYTES = 9;
+export const DEFAULT_MIN_PASSWORD_BYTES = 6;
 
 /**
  * The floor this app enforces: the default, or a higher one it asks for.
  *
  * Throws on an override below the default rather than silently clamping. A
- * caller passing 6 believes it is enforcing 6; being handed 9 without a word is
+ * caller passing 4 believes it is enforcing 4; being handed 6 without a word is
  * how a security floor becomes folklore.
  */
 export function resolveMinPasswordBytes(override?: number): number {