# @suaveplan/crypto Changelog

## 0.0.0 — suaveplan rebuild

Complete rewrite with engine-interface architecture.

### Architecture

- **Engine interfaces** — `AeadEngine`, `SignEngine`, `AgreeEngine`, `SealedBoxEngine`, `AuthBoxEngine` as pure TypeScript interface types. Noble defaults ship in-package; WebCrypto and libsodium engines live in `@suaveplan/crypto-browser` and `@suaveplan/crypto-sodium`.
- **`ByteSource` rename** — `Rng = (n: number) => Uint8Array` renamed to `ByteSource` to avoid collision with `@suaveplan/types`'s `Rng = { nextUint32(): number; nextFloat(): number }`. `Rng` kept as a deprecated alias.
- **`@suaveplan/crypto-hash` dependency** — hashing (SHA-2, HMAC, HKDF, PBKDF2, Argon2id) split into `@suaveplan/crypto-hash`. `@noble/hashes` is no longer a direct dependency of `@suaveplan/crypto`.

### New features

- `XChaCha20-Poly1305` added as a third AEAD algorithm (`AEAD_XCHACHA_NONCE_LENGTH = 24`)
- `sealedBox.seal` / `sealedBox.open` — anonymous-sender encryption (X25519 + XChaCha20-Poly1305 + HKDF-SHA256)
- `authBox.seal` / `authBox.open` — authenticated box (X25519 + XChaCha20-Poly1305 + HKDF-SHA256)
- `defaultByteSource` exported as canonical name alongside deprecated `defaultRng`
- All public functions accept trailing `{ engine?: <EngineType> }` for engine substitution

### Directory restructure

| Old path | New path |
|---|---|
| `src/random/random-bytes.ts` | `src/primitives/random-bytes.ts` |
| `src/compare/constant-time-equal.ts` | `src/primitives/constant-time-equal.ts` |
| `src/zeroize/zeroize.ts` | `src/primitives/zeroize.ts` |
| `src/hash/` | Removed → `@suaveplan/crypto-hash` |
| `src/hmac/` | Removed → `@suaveplan/crypto-hash` |
| `src/kdf/` | Removed → `@suaveplan/crypto-hash` |

### Subpath exports updated

New: `./primitives/random-bytes`, `./primitives/constant-time-equal`, `./primitives/zeroize`, `./sealed-box`, `./auth-box`, `./engines`
Removed: `./random`, `./compare`, `./hash`, `./hmac`, `./kdf`

### Quality

- 100% statement / branch / function / line coverage
- `tests/no-disallowed.test.ts` guards now point to `src/primitives/random-bytes.ts`
- `tests/dep-graph.test.ts` asserts `@noble/hashes` is NOT a direct dep