cursedbelt-server 4.30.0 → 4.31.0

package/dist/server/master-lock/accountsPage.d.ts

@@ -11,9 +11,9 @@ export declare const MASTER_LOCK_ACCOUNTS_PAGE_PATHS: {
     readonly style: "/__lock/accounts.css";
     readonly script: "/__lock/accounts.js";
 };
-/** The shortest password worth calling one. Matched by every `minlength` below and by the
- *  lock page's enrollment form, so a rotation cannot quietly weaken what enrollment demands. */
-export declare const MASTER_LOCK_MIN_PASSWORD_LENGTH = 10;
+/** The shortest password worth calling one — defined beside the lock page's enrollment form
+ *  (`lockPage.ts`) and re-exported, so a rotation cannot quietly differ from what enrollment demands. */
+export { MASTER_LOCK_MIN_PASSWORD_LENGTH } from "./lockPage.js";
 /**
  * The document.
  *

package/dist/server/master-lock/accountsPage.js

@@ -33,7 +33,7 @@
  * only be watching one of them.
  */
 import { MASTER_LOCK_PATHS, MASTER_LOCK_PREFIX } from "cursedbelt-core/master-lock";
-import { MASTER_LOCK_DERIVE_SOURCE, MASTER_LOCK_REVEAL_SOURCE, withRevealToggles } from "./lockPage.js";
+import { MASTER_LOCK_DERIVE_SOURCE, MASTER_LOCK_MIN_PASSWORD_LENGTH, MASTER_LOCK_REVEAL_SOURCE, withRevealToggles } from "./lockPage.js";
 /**
  * The page's own two assets.
  *
@@ -47,9 +47,9 @@ export const MASTER_LOCK_ACCOUNTS_PAGE_PATHS = {
     script: `${MASTER_LOCK_PREFIX}/accounts.js`,
 };
 const escapeHtml = (value) => value.replace(/[&<>"']/g, (ch) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[ch] ?? ch);
-/** The shortest password worth calling one. Matched by every `minlength` below and by the
- *  lock page's enrollment form, so a rotation cannot quietly weaken what enrollment demands. */
-export const MASTER_LOCK_MIN_PASSWORD_LENGTH = 10;
+/** The shortest password worth calling one — defined beside the lock page's enrollment form
+ *  (`lockPage.ts`) and re-exported, so a rotation cannot quietly differ from what enrollment demands. */
+export { MASTER_LOCK_MIN_PASSWORD_LENGTH } from "./lockPage.js";
 /**
  * The document.
  *

package/dist/server/master-lock/lockPage.d.ts

@@ -1,3 +1,9 @@
+/**
+ * The shortest master password the wall accepts — every `minlength` on both pages and both
+ * scripts' own checks read this one number, so a rotation cannot quietly differ from enrollment.
+ * 10 until 2026-09-24; the owner: *"make the minimum password length 6 characters"*.
+ */
+export declare const MASTER_LOCK_MIN_PASSWORD_LENGTH = 6;
 /** Everything the page needs to know about the app it is standing in front of. */
 export interface LockPageOptions {
     /** What to call this app — "Collections", "binary-server inspector". */
@@ -21,18 +27,7 @@ export interface LockPageOptions {
  */
 export declare function lockPageHtml(options: LockPageOptions): string;
 /** The stylesheet. Follows the viewer's theme and commits to nothing else. */
-export declare const LOCK_STYLE = ":root{color-scheme:light dark;\n  --ml-bg:#f4f5f7;--ml-card:#ffffff;--ml-text:#14171c;--ml-muted:#69707c;--ml-border:#d9dde3;\n  --ml-accent:#1f6feb;--ml-accent-text:#ffffff;--ml-danger:#b42318;\n  --ml-shadow:0 18px 48px rgba(16,18,22,.14)}\n@media (prefers-color-scheme:dark){:root{\n  --ml-bg:#0d0f13;--ml-card:#171a20;--ml-text:#e7eaef;--ml-muted:#8b93a1;--ml-border:#2b3039;\n  --ml-accent:#4f8cf7;--ml-accent-text:#0b0d11;--ml-danger:#f97066;\n  --ml-shadow:0 18px 48px rgba(0,0,0,.55)}}\n*{box-sizing:border-box}\nbody{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;padding:24px;\n  background:var(--ml-bg);color:var(--ml-text);\n  font:15px/1.55 ui-sans-serif,system-ui,-apple-system,\"Segoe UI\",sans-serif}\n.card{width:100%;max-width:23rem;background:var(--ml-card);border:1px solid var(--ml-border);\n  border-radius:16px;padding:28px 26px 24px;box-shadow:var(--ml-shadow);text-align:center}\n.glyph{font-size:30px;line-height:1;margin-bottom:10px}\nh1{margin:0 0 6px;font-size:18px;font-weight:650;letter-spacing:-.01em}\n.note{margin:0 0 20px;font-size:13px;color:var(--ml-muted)}\n.field{display:block;text-align:left;margin-bottom:14px}\n.field span{display:block;font-size:12px;font-weight:600;color:var(--ml-muted);margin-bottom:6px}\ninput{width:100%;height:40px;padding:0 12px;border:1px solid var(--ml-border);border-radius:9px;\n  background:var(--ml-bg);color:inherit;font:inherit}\ninput:focus{outline:2px solid var(--ml-accent);outline-offset:1px;border-color:transparent}\nbutton{width:100%;height:40px;border:0;border-radius:9px;background:var(--ml-accent);\n  color:var(--ml-accent-text);font:inherit;font-weight:600;cursor:pointer}\nbutton[disabled]{opacity:.6;cursor:progress}\n.status{margin:14px 0 0;min-height:1.2em;font-size:12.5px;color:var(--ml-muted)}\n.status[data-tone=\"error\"]{color:var(--ml-danger)}\n.field span em{font-style:normal;font-weight:500;text-transform:none;opacity:.7}\nbutton.quiet{margin-top:10px;height:32px;background:none;color:var(--ml-muted);font-weight:500;\n  font-size:12.5px;text-decoration:underline;text-underline-offset:3px}\nbutton.quiet:hover{color:var(--ml-text)}\nbutton.quiet[disabled]{opacity:.5}\n.hints{margin:10px 0 0;padding:12px 14px;text-align:left;border:1px solid var(--ml-border);\n  border-radius:10px;background:var(--ml-bg);font-size:12.5px}\n.hints dt{font-weight:650;color:var(--ml-text)}\n.hints dd{margin:2px 0 10px;color:var(--ml-muted);overflow-wrap:anywhere}\n.hints dd:last-child{margin-bottom:0}\n.secret{position:relative;display:block}\n.secret input{padding-right:68px}\n.secret .reveal{position:absolute;right:5px;top:50%;transform:translateY(-50%);width:auto;height:30px;\n  min-width:56px;padding:0 10px;border-radius:7px;background:none;color:var(--ml-muted);\n  font-size:12.5px;font-weight:600}\n.secret .reveal:hover{color:var(--ml-text);background:var(--ml-card)}\n.secret .reveal:focus-visible{outline:2px solid var(--ml-accent);outline-offset:1px}\n";
-/**
- * 🔴 Every password field on the wall gets a Show/Hide control (task 077-438's library share) — a
- * master password is long, typed once and never recoverable, and a typo in "choose" is a lock-out.
- *
- * Markup: {@link withRevealToggles} wraps each `type="password"` input in `.secret` with a
- * `<button type="button" data-reveal>` after it — the inputs keep every attribute, `autocomplete`
- * included, so a password manager still sees a password field. Behaviour:
- * {@link MASTER_LOCK_REVEAL_SOURCE}, interpolated into BOTH same-origin scripts, because the wall's
- * CSP is `script-src 'self'` and allows no inline script (`MASTER_LOCK_CSP`, pinned by
- * `beaconNeverReachesTheWall.spec.ts`). Nothing about the CSP changes for this.
- */
+export declare const LOCK_STYLE = ":root{color-scheme:light dark;\n  --ml-bg:#f4f5f7;--ml-card:#ffffff;--ml-text:#14171c;--ml-muted:#69707c;--ml-border:#d9dde3;\n  --ml-accent:#1f6feb;--ml-accent-text:#ffffff;--ml-danger:#b42318;\n  --ml-shadow:0 18px 48px rgba(16,18,22,.14)}\n@media (prefers-color-scheme:dark){:root{\n  --ml-bg:#0d0f13;--ml-card:#171a20;--ml-text:#e7eaef;--ml-muted:#8b93a1;--ml-border:#2b3039;\n  --ml-accent:#4f8cf7;--ml-accent-text:#0b0d11;--ml-danger:#f97066;\n  --ml-shadow:0 18px 48px rgba(0,0,0,.55)}}\n*{box-sizing:border-box}\nbody{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;padding:24px;\n  background:var(--ml-bg);color:var(--ml-text);\n  font:15px/1.55 ui-sans-serif,system-ui,-apple-system,\"Segoe UI\",sans-serif}\n.card{width:100%;max-width:23rem;background:var(--ml-card);border:1px solid var(--ml-border);\n  border-radius:16px;padding:28px 26px 24px;box-shadow:var(--ml-shadow);text-align:center}\n.glyph{font-size:30px;line-height:1;margin-bottom:10px}\nh1{margin:0 0 6px;font-size:18px;font-weight:650;letter-spacing:-.01em}\n.note{margin:0 0 20px;font-size:13px;color:var(--ml-muted)}\n.field{display:block;text-align:left;margin-bottom:14px}\n.field span{display:block;font-size:12px;font-weight:600;color:var(--ml-muted);margin-bottom:6px}\ninput{width:100%;height:40px;padding:0 12px;border:1px solid var(--ml-border);border-radius:9px;\n  background:var(--ml-bg);color:inherit;font:inherit}\ninput:focus{outline:2px solid var(--ml-accent);outline-offset:1px;border-color:transparent}\nbutton{width:100%;height:40px;border:0;border-radius:9px;background:var(--ml-accent);\n  color:var(--ml-accent-text);font:inherit;font-weight:600;cursor:pointer}\nbutton[disabled]{opacity:.6;cursor:progress}\n.status{margin:14px 0 0;min-height:1.2em;font-size:12.5px;color:var(--ml-muted)}\n.status[data-tone=\"error\"]{color:var(--ml-danger)}\n.field span em{font-style:normal;font-weight:500;text-transform:none;opacity:.7}\nbutton.quiet{margin-top:10px;height:32px;background:none;color:var(--ml-muted);font-weight:500;\n  font-size:12.5px;text-decoration:underline;text-underline-offset:3px}\nbutton.quiet:hover{color:var(--ml-text)}\nbutton.quiet[disabled]{opacity:.5}\n.hints{margin:10px 0 0;padding:12px 14px;text-align:left;border:1px solid var(--ml-border);\n  border-radius:10px;background:var(--ml-bg);font-size:12.5px}\n.hints dt{font-weight:650;color:var(--ml-text)}\n.hints dd{margin:2px 0 10px;color:var(--ml-muted);overflow-wrap:anywhere}\n.hints dd:last-child{margin-bottom:0}\n.secret{position:relative;display:block}\n.secret input{padding-right:48px}\n.secret .reveal{position:absolute;right:5px;top:50%;transform:translateY(-50%);width:36px;height:32px;\n  display:grid;place-items:center;padding:0;border-radius:7px;background:none;color:var(--ml-muted)}\n.secret .reveal svg{width:18px;height:18px}\n.secret .reveal .eye-off,.secret .reveal[aria-pressed=\"true\"] .eye{display:none}\n.secret .reveal[aria-pressed=\"true\"] .eye-off{display:block}\n.secret .reveal:hover{color:var(--ml-text);background:var(--ml-card)}\n.secret .reveal:focus-visible{outline:2px solid var(--ml-accent);outline-offset:1px}\n";
 export declare function withRevealToggles(html: string): string;
 /**
  * The toggle's behaviour, as browser source. It flips the input BEFORE it to `text` and back,
@@ -40,7 +35,7 @@ export declare function withRevealToggles(html: string): string;
  * `password` when its form submits — so a manager saving the credential sees a password field.
  * Publishes itself on `globalThis`, the seam `lockPage.spec.ts` drives it through.
  */
-export declare const MASTER_LOCK_REVEAL_SOURCE = "function wireMasterLockReveal(doc) {\n  const buttons = doc.querySelectorAll(\"[data-reveal]\");\n  for (const button of buttons) {\n    const input = button.previousElementSibling;\n    if (!input || input.tagName !== \"INPUT\") continue;\n    const show = (on) => {\n      input.type = on ? \"text\" : \"password\";\n      button.setAttribute(\"aria-pressed\", on ? \"true\" : \"false\");\n      button.setAttribute(\"aria-label\", on ? \"Hide password\" : \"Show password\");\n      button.textContent = on ? \"Hide\" : \"Show\";\n    };\n    button.addEventListener(\"click\", () => {\n      show(input.type === \"password\");\n      input.focus();\n    });\n    input.form?.addEventListener(\"submit\", () => show(false), true);\n  }\n  return buttons.length;\n}\nglobalThis.wireMasterLockReveal = wireMasterLockReveal;";
+export declare const MASTER_LOCK_REVEAL_SOURCE = "function wireMasterLockReveal(doc) {\n  const buttons = doc.querySelectorAll(\"[data-reveal]\");\n  for (const button of buttons) {\n    const input = button.previousElementSibling;\n    if (!input || input.tagName !== \"INPUT\") continue;\n    const show = (on) => {\n      input.type = on ? \"text\" : \"password\";\n      button.setAttribute(\"aria-pressed\", on ? \"true\" : \"false\");\n      button.setAttribute(\"aria-label\", on ? \"Hide password\" : \"Show password\");\n    };\n    button.addEventListener(\"click\", () => {\n      show(input.type === \"password\");\n      input.focus();\n    });\n    input.form?.addEventListener(\"submit\", () => show(false), true);\n  }\n  return buttons.length;\n}\nglobalThis.wireMasterLockReveal = wireMasterLockReveal;";
 /**
  * 🔴 The ONE browser copy of `deriveMasterLockVerifier`, shared by every page this feature
  * serves. Pinned by `lockPage.spec.ts`, which evaluates it and compares against the

package/dist/server/master-lock/lockPage.js

@@ -26,6 +26,12 @@
  * scripts interpolate this string, and the spec asserts that they do.
  */
 import { MASTER_LOCK_PATHS } from "cursedbelt-core/master-lock";
+/**
+ * The shortest master password the wall accepts — every `minlength` on both pages and both
+ * scripts' own checks read this one number, so a rotation cannot quietly differ from enrollment.
+ * 10 until 2026-09-24; the owner: *"make the minimum password length 6 characters"*.
+ */
+export const MASTER_LOCK_MIN_PASSWORD_LENGTH = 6;
 const escapeHtml = (value) => value.replace(/[&<>"']/g, (ch) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[ch] ?? ch);
 /**
  * The document. Deliberately says the app's NAME and nothing else about it — whoever is
@@ -61,14 +67,14 @@ export function lockPageHtml(options) {
       <span>${enroll ? "New master password" : "Master password"}</span>
       <input id="ml-input" type="password" name="master-password"
              autocomplete="${enroll ? "new-password" : "current-password"}"
-             autofocus required spellcheck="false" enterkeyhint="${enroll ? "next" : "go"}"${enroll ? ' minlength="10"' : ""}>
+             autofocus required spellcheck="false" enterkeyhint="${enroll ? "next" : "go"}"${enroll ? ` minlength="${MASTER_LOCK_MIN_PASSWORD_LENGTH}"` : ""}>
     </label>${enroll
         ? `
     <label class="field">
       <span>Confirm master password</span>
       <input id="ml-confirm" type="password" name="confirm-master-password"
              autocomplete="new-password" required spellcheck="false" enterkeyhint="go"
-             minlength="10">
+             minlength="${MASTER_LOCK_MIN_PASSWORD_LENGTH}">
     </label>
     <label class="field">
       <span>Hint <em>optional</em></span>
@@ -129,15 +135,17 @@ button.quiet[disabled]{opacity:.5}
 .hints dd{margin:2px 0 10px;color:var(--ml-muted);overflow-wrap:anywhere}
 .hints dd:last-child{margin-bottom:0}
 .secret{position:relative;display:block}
-.secret input{padding-right:68px}
-.secret .reveal{position:absolute;right:5px;top:50%;transform:translateY(-50%);width:auto;height:30px;
-  min-width:56px;padding:0 10px;border-radius:7px;background:none;color:var(--ml-muted);
-  font-size:12.5px;font-weight:600}
+.secret input{padding-right:48px}
+.secret .reveal{position:absolute;right:5px;top:50%;transform:translateY(-50%);width:36px;height:32px;
+  display:grid;place-items:center;padding:0;border-radius:7px;background:none;color:var(--ml-muted)}
+.secret .reveal svg{width:18px;height:18px}
+.secret .reveal .eye-off,.secret .reveal[aria-pressed="true"] .eye{display:none}
+.secret .reveal[aria-pressed="true"] .eye-off{display:block}
 .secret .reveal:hover{color:var(--ml-text);background:var(--ml-card)}
 .secret .reveal:focus-visible{outline:2px solid var(--ml-accent);outline-offset:1px}
 `;
 /**
- * 🔴 Every password field on the wall gets a Show/Hide control (task 077-438's library share) — a
+ * 🔴 Every password field on the wall gets an eye (show/hide) control (task 077-438's library share) — a
  * master password is long, typed once and never recoverable, and a typo in "choose" is a lock-out.
  *
  * Markup: {@link withRevealToggles} wraps each `type="password"` input in `.secret` with a
@@ -147,8 +155,16 @@ button.quiet[disabled]{opacity:.5}
  * CSP is `script-src 'self'` and allows no inline script (`MASTER_LOCK_CSP`, pinned by
  * `beaconNeverReachesTheWall.spec.ts`). Nothing about the CSP changes for this.
  */
+/*
+ * An eye, and an eye struck through — the owner, 2026-09-24: *"use an eye icon instead of words
+ * like 'Show'"*. Both are in the button; the stylesheet shows one by `aria-pressed`, so the
+ * script only flips state and the accessible name, never markup. Same glyphs as cursedbelt's
+ * React `SecretInput`, drawn inline because this page ships no icon font and no framework.
+ */
+const EYE = '<svg class="eye" aria-hidden="true" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M2 12s3.5-7 10-7 10 7 10 7-3.5 7-10 7S2 12 2 12z"/><circle cx="12" cy="12" r="3"/></svg>';
+const EYE_OFF = '<svg class="eye-off" aria-hidden="true" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M9.9 4.2A10.4 10.4 0 0 1 12 4c6.5 0 10 8 10 8a17.6 17.6 0 0 1-2.3 3.3"/><path d="M6.6 6.6C3.9 8.4 2 12 2 12s3.5 7 10 7c1.8 0 3.4-.5 4.8-1.3"/><path d="M9.9 9.9a3 3 0 0 0 4.2 4.2"/><path d="M2 2l20 20"/></svg>';
 export function withRevealToggles(html) {
-    return html.replace(/(<input\b[^>]*\btype="password"[^>]*>)/g, '<span class="secret">$1<button type="button" class="reveal" data-reveal aria-label="Show password" aria-pressed="false">Show</button></span>');
+    return html.replace(/(<input\b[^>]*\btype="password"[^>]*>)/g, `<span class="secret">$1<button type="button" class="reveal" data-reveal aria-label="Show password" aria-pressed="false">${EYE}${EYE_OFF}</button></span>`);
 }
 /**
  * The toggle's behaviour, as browser source. It flips the input BEFORE it to `text` and back,
@@ -165,7 +181,6 @@ export const MASTER_LOCK_REVEAL_SOURCE = `function wireMasterLockReveal(doc) {
       input.type = on ? "text" : "password";
       button.setAttribute("aria-pressed", on ? "true" : "false");
       button.setAttribute("aria-label", on ? "Hide password" : "Show password");
-      button.textContent = on ? "Hide" : "Show";
     };
     button.addEventListener("click", () => {
       show(input.type === "password");
@@ -252,7 +267,7 @@ const enrolling = document.body.dataset.mode === "enroll";
 
 /** The shortest password worth calling one. Matched by the input's own minlength, and
  *  checked here too because a pasted value can beat the constraint on some engines. */
-const MIN_LENGTH = 10;
+const MIN_LENGTH = ${MASTER_LOCK_MIN_PASSWORD_LENGTH};
 
 let kdf = null;
 let busy = false;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.30.0",
+	"version": "4.31.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split — storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",
@@ -340,7 +340,7 @@
 	"dependencies": {
 		"argon2id": "1.0.1",
 		"cursedbelt-core": "^2.1.1",
-		"cursedops": "^0.8.1",
+		"cursedops": ">=0.8.1 <0.10.0",
 		"cwip": "^4.6.0",
 		"jose": "^6.2.3"
 	},

package/src/server/master-lock/accountsPage.ts

@@ -33,7 +33,7 @@
  * only be watching one of them.
  */
 import { MASTER_LOCK_PATHS, MASTER_LOCK_PREFIX } from "cursedbelt-core/master-lock";
-import { MASTER_LOCK_DERIVE_SOURCE, MASTER_LOCK_REVEAL_SOURCE, type LockPageOptions, withRevealToggles } from "./lockPage.js";
+import { MASTER_LOCK_DERIVE_SOURCE, MASTER_LOCK_MIN_PASSWORD_LENGTH, MASTER_LOCK_REVEAL_SOURCE, type LockPageOptions, withRevealToggles } from "./lockPage.js";
 
 /**
  * The page's own two assets.
@@ -54,9 +54,9 @@ const escapeHtml = (value: string): string =>
 		(ch) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[ch] ?? ch,
 	);
 
-/** The shortest password worth calling one. Matched by every `minlength` below and by the
- *  lock page's enrollment form, so a rotation cannot quietly weaken what enrollment demands. */
-export const MASTER_LOCK_MIN_PASSWORD_LENGTH = 10;
+/** The shortest password worth calling one — defined beside the lock page's enrollment form
+ *  (`lockPage.ts`) and re-exported, so a rotation cannot quietly differ from what enrollment demands. */
+export { MASTER_LOCK_MIN_PASSWORD_LENGTH } from "./lockPage.js";
 
 /**
  * The document.

package/src/server/master-lock/lockPage.spec.ts

@@ -19,6 +19,7 @@ import {
 	LOCK_SCRIPT,
 	LOCK_STYLE,
 	MASTER_LOCK_DERIVE_SOURCE,
+	MASTER_LOCK_MIN_PASSWORD_LENGTH,
 	MASTER_LOCK_REVEAL_SOURCE,
 	lockPageHtml,
 	withRevealToggles,
@@ -107,7 +108,7 @@ describe("🔴 every password field on the wall can be shown and hidden (task 07
 	};
 
 	for (const [name, html] of Object.entries(pages)) {
-		test(`${name}: one Show control per password input, each input keeping its autocomplete`, () => {
+		test(`${name}: one eye control per password input, each input keeping its autocomplete`, () => {
 			const inputs = [...html.matchAll(/<input\b[^>]*\btype="password"[^>]*>/g)].map((m) => m[0]);
 			expect(inputs.length).toBeGreaterThan(0);
 			expect((html.match(/data-reveal/g) ?? []).length).toBe(inputs.length);
@@ -117,6 +118,20 @@ describe("🔴 every password field on the wall can be shown and hidden (task 07
 		});
 	}
 
+	test("🔴 the control is an EYE, not a word, and every minimum is 6 (owner, 2026-09-24)", () => {
+		for (const html of Object.values(pages)) {
+			for (const button of html.match(/<button[^>]*data-reveal[^>]*>[\s\S]*?<\/button>/g) ?? []) {
+				expect(button).toContain('class="eye"');
+				expect(button).toContain('class="eye-off"');
+				// No visible word: strip the markup and nothing readable is left.
+				expect(button.replace(/<[^>]+>/g, "").trim()).toBe("");
+			}
+			for (const m of html.matchAll(/minlength="(\d+)"/g)) expect(m[1]).toBe("6");
+		}
+		expect(MASTER_LOCK_MIN_PASSWORD_LENGTH).toBe(6);
+		expect(LOCK_SCRIPT).toContain("const MIN_LENGTH = 6;");
+	});
+
 	test("both served scripts carry the ONE reveal source and call it", () => {
 		for (const script of [LOCK_SCRIPT, MASTER_LOCK_ACCOUNTS_SCRIPT]) {
 			expect(script).toContain(MASTER_LOCK_REVEAL_SOURCE);

package/src/server/master-lock/lockPage.ts

@@ -27,6 +27,13 @@
  */
 import { MASTER_LOCK_PATHS } from "cursedbelt-core/master-lock";
 
+/**
+ * The shortest master password the wall accepts — every `minlength` on both pages and both
+ * scripts' own checks read this one number, so a rotation cannot quietly differ from enrollment.
+ * 10 until 2026-09-24; the owner: *"make the minimum password length 6 characters"*.
+ */
+export const MASTER_LOCK_MIN_PASSWORD_LENGTH = 6;
+
 /** Everything the page needs to know about the app it is standing in front of. */
 export interface LockPageOptions {
 	/** What to call this app — "Collections", "binary-server inspector". */
@@ -88,7 +95,7 @@ export function lockPageHtml(options: LockPageOptions): string {
       <input id="ml-input" type="password" name="master-password"
              autocomplete="${enroll ? "new-password" : "current-password"}"
              autofocus required spellcheck="false" enterkeyhint="${enroll ? "next" : "go"}"${
-               enroll ? ' minlength="10"' : ""
+               enroll ? ` minlength="${MASTER_LOCK_MIN_PASSWORD_LENGTH}"` : ""
              }>
     </label>${
       enroll
@@ -97,7 +104,7 @@ export function lockPageHtml(options: LockPageOptions): string {
       <span>Confirm master password</span>
       <input id="ml-confirm" type="password" name="confirm-master-password"
              autocomplete="new-password" required spellcheck="false" enterkeyhint="go"
-             minlength="10">
+             minlength="${MASTER_LOCK_MIN_PASSWORD_LENGTH}">
     </label>
     <label class="field">
       <span>Hint <em>optional</em></span>
@@ -162,16 +169,18 @@ button.quiet[disabled]{opacity:.5}
 .hints dd{margin:2px 0 10px;color:var(--ml-muted);overflow-wrap:anywhere}
 .hints dd:last-child{margin-bottom:0}
 .secret{position:relative;display:block}
-.secret input{padding-right:68px}
-.secret .reveal{position:absolute;right:5px;top:50%;transform:translateY(-50%);width:auto;height:30px;
-  min-width:56px;padding:0 10px;border-radius:7px;background:none;color:var(--ml-muted);
-  font-size:12.5px;font-weight:600}
+.secret input{padding-right:48px}
+.secret .reveal{position:absolute;right:5px;top:50%;transform:translateY(-50%);width:36px;height:32px;
+  display:grid;place-items:center;padding:0;border-radius:7px;background:none;color:var(--ml-muted)}
+.secret .reveal svg{width:18px;height:18px}
+.secret .reveal .eye-off,.secret .reveal[aria-pressed="true"] .eye{display:none}
+.secret .reveal[aria-pressed="true"] .eye-off{display:block}
 .secret .reveal:hover{color:var(--ml-text);background:var(--ml-card)}
 .secret .reveal:focus-visible{outline:2px solid var(--ml-accent);outline-offset:1px}
 `;
 
 /**
- * 🔴 Every password field on the wall gets a Show/Hide control (task 077-438's library share) — a
+ * 🔴 Every password field on the wall gets an eye (show/hide) control (task 077-438's library share) — a
  * master password is long, typed once and never recoverable, and a typo in "choose" is a lock-out.
  *
  * Markup: {@link withRevealToggles} wraps each `type="password"` input in `.secret` with a
@@ -181,10 +190,21 @@ button.quiet[disabled]{opacity:.5}
  * CSP is `script-src 'self'` and allows no inline script (`MASTER_LOCK_CSP`, pinned by
  * `beaconNeverReachesTheWall.spec.ts`). Nothing about the CSP changes for this.
  */
+/*
+ * An eye, and an eye struck through — the owner, 2026-09-24: *"use an eye icon instead of words
+ * like 'Show'"*. Both are in the button; the stylesheet shows one by `aria-pressed`, so the
+ * script only flips state and the accessible name, never markup. Same glyphs as cursedbelt's
+ * React `SecretInput`, drawn inline because this page ships no icon font and no framework.
+ */
+const EYE =
+	'<svg class="eye" aria-hidden="true" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M2 12s3.5-7 10-7 10 7 10 7-3.5 7-10 7S2 12 2 12z"/><circle cx="12" cy="12" r="3"/></svg>';
+const EYE_OFF =
+	'<svg class="eye-off" aria-hidden="true" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M9.9 4.2A10.4 10.4 0 0 1 12 4c6.5 0 10 8 10 8a17.6 17.6 0 0 1-2.3 3.3"/><path d="M6.6 6.6C3.9 8.4 2 12 2 12s3.5 7 10 7c1.8 0 3.4-.5 4.8-1.3"/><path d="M9.9 9.9a3 3 0 0 0 4.2 4.2"/><path d="M2 2l20 20"/></svg>';
+
 export function withRevealToggles(html: string): string {
 	return html.replace(
 		/(<input\b[^>]*\btype="password"[^>]*>)/g,
-		'<span class="secret">$1<button type="button" class="reveal" data-reveal aria-label="Show password" aria-pressed="false">Show</button></span>',
+		`<span class="secret">$1<button type="button" class="reveal" data-reveal aria-label="Show password" aria-pressed="false">${EYE}${EYE_OFF}</button></span>`,
 	);
 }
 
@@ -203,7 +223,6 @@ export const MASTER_LOCK_REVEAL_SOURCE = `function wireMasterLockReveal(doc) {
       input.type = on ? "text" : "password";
       button.setAttribute("aria-pressed", on ? "true" : "false");
       button.setAttribute("aria-label", on ? "Hide password" : "Show password");
-      button.textContent = on ? "Hide" : "Show";
     };
     button.addEventListener("click", () => {
       show(input.type === "password");
@@ -292,7 +311,7 @@ const enrolling = document.body.dataset.mode === "enroll";
 
 /** The shortest password worth calling one. Matched by the input's own minlength, and
  *  checked here too because a pasted value can beat the constraint on some engines. */
-const MIN_LENGTH = 10;
+const MIN_LENGTH = ${MASTER_LOCK_MIN_PASSWORD_LENGTH};
 
 let kdf = null;
 let busy = false;