[dependabot]

Bumps the production-minor group with 3 updates: @forgesworn/shamir-words, nsec-tree and spoken-token.

Updates @forgesworn/shamir-words from 1.1.0 to 1.2.0

Release notes

Sourced from @​forgesworn/shamir-words's releases.

v1.2.0

Promotes 1.2.0-alpha.1 to latest, with the changes below. The v3 typed envelope is still alpha: the paper-share and Heartwood hardware restore ceremony has not run. Use v3 with test secrets and keep another backup.

Changed

• engines.node is now >=20.19.0, the floor declared by @noble/hashes v2. It was >=18, which is below the floor of the @noble/hashes v2 dependency.

Documentation

• say that the v3 envelope needs 1.2.0 or later; 1.1.0 and earlier have only the v2 functions.
• name @forgesworn/shamir-core among the runtime dependencies.
• define the v3 types and payload kinds (with their wire codes), and document that payloadKind is required.
• document that reconstructSecret uses only the first threshold shares, and list which inputs throw ShamirValidationError (too few shares, duplicate IDs, threshold mismatch, inconsistent data lengths, and every v3 rejection).
• complete the llms.txt API surface (shareToWordsV3, wordsToShareV3, SHAMIR_WORDS_FORMAT_VERSION and the v3 types) and correct llms-full.txt where it disagreed with the source.

---

Reproducible build: byte-identical output verified across two independent CI runners.

Artefact integrity

file:      forgesworn-shamir-words-1.2.0.tgz
size:      24944 bytes
sha256:    25a46855b7972708df303521dfcc71759b2ef130d589df0276f5ea4a00fe2228
sha512-Mg15aWe+PiybAsnLrk7ydpP/gpPuuURyWOfdt7NPHpmYwscx0vhsLRX9jgdK8R4yRc+h8igC8Boqivwa21I2pA==

Verify against the registry tarball:

curl -sLO https://registry.npmjs.org/@forgesworn/shamir-words/-/shamir-words-1.2.0.tgz
shasum -a 256 shamir-words-1.2.0.tgz

shamir-words v1.2.0-alpha.1

Added

• add an opt-in v3 word envelope with a collision-free sentinel, FS magic, explicit format version, recovery payload kind, eight-byte original-secret fingerprint, and four-byte checksum. Safe split/reconstruct helpers reject shares mixed across independently randomised split operations.

... (truncated)

Changelog

Sourced from @​forgesworn/shamir-words's changelog.

1.2.0 (2026-10-19)

Promotes 1.2.0-alpha.1 to latest, with the changes below. The v3 typed envelope is still alpha: the paper-share and Heartwood hardware restore ceremony has not run. Use v3 with test secrets and keep another backup.

Changed

• engines.node is now >=20.19.0, the floor declared by @noble/hashes v2. It was >=18, which is below the floor of the @noble/hashes v2 dependency.

Documentation

• say that the v3 envelope needs 1.2.0 or later; 1.1.0 and earlier have only the v2 functions.
• name @forgesworn/shamir-core among the runtime dependencies.
• define the v3 types and payload kinds (with their wire codes), and document that payloadKind is required.
• document that reconstructSecret uses only the first threshold shares, and list which inputs throw ShamirValidationError (too few shares, duplicate IDs, threshold mismatch, inconsistent data lengths, and every v3 rejection).
• complete the llms.txt API surface (shareToWordsV3, wordsToShareV3, SHAMIR_WORDS_FORMAT_VERSION and the v3 types) and correct llms-full.txt where it disagreed with the source.

1.2.0-alpha.1 (2026-08-31)

Added

• add an opt-in v3 word envelope with a collision-free sentinel, FS magic, explicit format version, recovery payload kind, eight-byte original-secret fingerprint, and four-byte checksum. Safe split/reconstruct helpers reject shares mixed across independently randomised split operations. shareToWords and wordsToShare retain their historical v2 wire behaviour; splitSecretToWordsV3, reconstructWordsV3, shareToWordsV3, wordsToShareV3, and decodeWordsEnvelope provide the new and migration paths without invalidating existing paper shares.

Alpha status

• the v3 format passes automated unit and cross-repository recovery tests, but the complete ForgeSworn paper-share and Heartwood restore ceremony has not yet run on hardware. Keep historical v2 shares unchanged, use v3 with test secrets only, and retain an independent backup.

Commits

• 543806d chore(release): 1.2.0 (#39)
• f571b2b docs: align README, llms files and engines with the source (#38)
• b644920 chore(deps-dev): bump the dev-minor group with 2 updates (#37)
• d6fcf3f chore(deps-dev): bump the dev-minor group with 2 updates (#36)
• f740729 docs: refresh llms files against the current API
• c9c95d2 docs: consolidate agent instructions into AGENTS.md
• c9794cc chore: ship llms files in the npm package so agents reading node_modules see ...
• f0b8796 chore(deps-dev): bump the dev-minor group with 2 updates (#35)
• a2a4b15 chore(deps-dev): bump @​types/node in the dev-minor group (#34)
• 447a959 chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (#25)
• Additional commits viewable in compare view

Updates nsec-tree from 1.5.1 to 1.6.0

Release notes

Sourced from nsec-tree's releases.

v1.6.0

Promotes 1.6.0-alpha.1 to latest, with the changes below. The ForgeSworn Recovery Words v1 format is still alpha: the Heartwood hardware recovery ceremony has not run. Use test keys and keep an independent backup.

Added

• add deriveRendezvous(root, index?) and RENDEZVOUS_PURPOSE, a root-only rendezvous child exported from nsec-tree and nsec-tree/core.

Documentation

• align the README, llms files and AGENTS.md with the source, and correct the BIP-32 rationale.

---

Reproducible build: byte-identical output verified across two independent CI runners.

Artefact integrity

file:      nsec-tree-1.6.0.tgz
size:      40426 bytes
sha256:    fc61f825d084c9da678fbd6f53bf89fcfd6c143c5eaddeb4822c615ea3bbba0e
sha512-HLB7WDPIuVPrKxk3TKTtdUQyYvg8kUMRzm4CRPPBnxroGxTh/PFjzpDwILZuC62Wt8l4j02CzLdvd9k7GOVwmQ==

Verify against the registry tarball:

curl -sLO https://registry.npmjs.org/nsec-tree/-/nsec-tree-1.6.0.tgz
shasum -a 256 nsec-tree-1.6.0.tgz

nsec-tree v1.6.0-alpha.1

Added

• add ForgeSworn Recovery Words v1: a typed, versioned envelope around canonical BIP-39 payloads with explicit recovery semantics, checksum, public fingerprint verification, compact byte conversion, and a dedicated nsec-tree/recovery export.

Alpha status

• automated TypeScript/Rust vectors and cross-repository recovery tests pass; the complete write-down, wipe, and restore ceremony has not yet run on Heartwood hardware. Use test keys only and retain an independent backup.

---

... (truncated)

Changelog

Sourced from nsec-tree's changelog.

1.6.0 (2026-10-19)

Promotes 1.6.0-alpha.1 to latest, with the changes below. The ForgeSworn Recovery Words v1 format is still alpha: the Heartwood hardware recovery ceremony has not run. Use test keys and keep an independent backup.

Added

• add deriveRendezvous(root, index?) and RENDEZVOUS_PURPOSE, a root-only rendezvous child exported from nsec-tree and nsec-tree/core.

Documentation

• align the README, llms files and AGENTS.md with the source, and correct the BIP-32 rationale.

1.6.0-alpha.1 (2026-08-31)

Added

• add ForgeSworn Recovery Words v1: a typed, versioned envelope around canonical BIP-39 payloads with explicit recovery semantics, checksum, public fingerprint verification, compact byte conversion, and a dedicated nsec-tree/recovery export.

Alpha status

• automated TypeScript/Rust vectors and cross-repository recovery tests pass; the complete write-down, wipe, and restore ceremony has not yet run on Heartwood hardware. Use test keys only and retain an independent backup.

Commits

• e3959f6 chore(release): 1.6.0 (#53)
• fbb432c chore(deps-dev): bump vitest from 5.0.3 to 5.0.5 in the dev-minor group (#52)
• 74d3828 docs: align README, llms files and AGENTS.md with source (#51)
• 81f54c3 chore(deps-dev): bump vitest from 5.0.1 to 5.0.3 in the dev-minor group (#50)
• ba678c6 docs: correct BIP-32 rationale
• 0e592dc chore(deps-dev): bump tsx from 4.23.13 to 4.23.15 in the dev-minor group (#49)
• 70af0c2 docs: consolidate agent instructions into AGENTS.md
• f695f68 chore(deps-dev): bump vitest from 5.0.0 to 5.0.1 in the dev-minor group (#48)
• f1963f6 fix: keep profile name out of rendezvous strings
• 41707ff fix: keep profile name out of rendezvous strings
• Additional commits viewable in compare view

Updates spoken-token from 2.1.0 to 2.1.1

Release notes

Sourced from spoken-token's releases.

v2.1.1

Bug Fixes

• align README, llms files and AGENTS.md with the source (#48) (docs)

---

Reproducible build: byte-identical output verified across two independent CI runners.

Artefact integrity

file:      spoken-token-2.1.1.tgz
size:      48484 bytes
sha256:    e6a9dd16b5ceb66e73d5bb7d83d25fab6239e55b02be9a10b700681aad4830a9
sha512-T/jdmqQOM93rqmYeP5aBr6nlK0W8ThKVS0XCHSfD/1Y9Ej8nHQ9XNcd2R1Mz9mFiPk3HHzn4L9nnCwFjAPIXDQ==

Verify against the registry tarball:

curl -sLO https://registry.npmjs.org/spoken-token/-/spoken-token-2.1.1.tgz
shasum -a 256 spoken-token-2.1.1.tgz

Changelog

Sourced from spoken-token's changelog.

2.1.1 (2026-10-18)

Bug Fixes

• align README, llms files and AGENTS.md with the source (#48) (docs)

Commits

• 3324ff9 chore(release): 2.1.1
• 3d2616f fix(docs): align README, llms files and AGENTS.md with the source (#48)
• a5824d3 chore(deps-dev): bump source-map-js from 1.2.1 to 1.2.2 (#47)
• 88580e9 chore(deps-dev): bump the dev-minor group with 2 updates (#46)
• fbe6154 chore(deps-dev): bump brace-expansion from 5.0.7 to 5.0.12 (#45)
• 71d8001 chore(deps-dev): bump typescript-eslint (#43)
• 9b3a8e9 chore(deps-dev): bump the dev-minor group with 2 updates (#42)
• af3c37f docs: consolidate agent instructions into AGENTS.md
• 9b51d8a chore: ship llms files in the npm package so agents reading node_modules see ...
• a5e8227 chore(deps-dev): bump typescript-eslint in the dev-minor group (#40)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions