Initial Commit

packages/security-stack/crypto/crypto-core/CHANGELOG.md

@@ -0,0 +1,41 @@
+# @suaveplan/crypto Changelog
+
+## 0.0.0 — suaveplan rebuild
+
+Complete rewrite with engine-interface architecture.
+
+### Architecture
+
+- **Engine interfaces** — `AeadEngine`, `SignEngine`, `AgreeEngine`, `SealedBoxEngine`, `AuthBoxEngine` as pure TypeScript interface types. Noble defaults ship in-package; WebCrypto and libsodium engines live in `@suaveplan/crypto-browser` and `@suaveplan/crypto-sodium`.
+- **`ByteSource` rename** — `Rng = (n: number) => Uint8Array` renamed to `ByteSource` to avoid collision with `@suaveplan/types`'s `Rng = { nextUint32(): number; nextFloat(): number }`. `Rng` kept as a deprecated alias.
+- **`@suaveplan/crypto-hash` dependency** — hashing (SHA-2, HMAC, HKDF, PBKDF2, Argon2id) split into `@suaveplan/crypto-hash`. `@noble/hashes` is no longer a direct dependency of `@suaveplan/crypto`.
+
+### New features
+
+- `XChaCha20-Poly1305` added as a third AEAD algorithm (`AEAD_XCHACHA_NONCE_LENGTH = 24`)
+- `sealedBox.seal` / `sealedBox.open` — anonymous-sender encryption (X25519 + XChaCha20-Poly1305 + HKDF-SHA256)
+- `authBox.seal` / `authBox.open` — authenticated box (X25519 + XChaCha20-Poly1305 + HKDF-SHA256)
+- `defaultByteSource` exported as canonical name alongside deprecated `defaultRng`
+- All public functions accept trailing `{ engine?: <EngineType> }` for engine substitution
+
+### Directory restructure
+
+| Old path | New path |
+|---|---|
+| `src/random/random-bytes.ts` | `src/primitives/random-bytes.ts` |
+| `src/compare/constant-time-equal.ts` | `src/primitives/constant-time-equal.ts` |
+| `src/zeroize/zeroize.ts` | `src/primitives/zeroize.ts` |
+| `src/hash/` | Removed → `@suaveplan/crypto-hash` |
+| `src/hmac/` | Removed → `@suaveplan/crypto-hash` |
+| `src/kdf/` | Removed → `@suaveplan/crypto-hash` |
+
+### Subpath exports updated
+
+New: `./primitives/random-bytes`, `./primitives/constant-time-equal`, `./primitives/zeroize`, `./sealed-box`, `./auth-box`, `./engines`
+Removed: `./random`, `./compare`, `./hash`, `./hmac`, `./kdf`
+
+### Quality
+
+- 100% statement / branch / function / line coverage
+- `tests/no-disallowed.test.ts` guards now point to `src/primitives/random-bytes.ts`
+- `tests/dep-graph.test.ts` asserts `@noble/hashes` is NOT a direct dep