Initial Commit

packages/security-stack/crypto/crypto-core/tests/dep-graph.test.ts

@@ -0,0 +1,45 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, it } from "@suaveplan/testing/runner";
+
+describe("dep-graph", () => {
+    it("runtime deps are locked to the approved set", {
+        timeout: 5000,
+    }, () => {
+        const pkg = JSON.parse(
+            readFileSync(join(__dirname, "..", "package.json"), "utf8")
+        ) as { dependencies?: Record<string, string> };
+        const runtime = Object.keys(pkg.dependencies ?? {}).sort();
+        expect(runtime).toEqual([
+            "@suaveplan/crypto-cipher",
+            "@suaveplan/crypto-curve",
+            "@suaveplan/crypto-hash",
+            "@suaveplan/crypto-utils",
+            "@suaveplan/error",
+            "@suaveplan/types",
+            "tslib",
+            "zod",
+        ]);
+    });
+
+    it("no peerDependencies", { timeout: 5000 }, () => {
+        const pkg = JSON.parse(
+            readFileSync(join(__dirname, "..", "package.json"), "utf8")
+        ) as { peerDependencies?: Record<string, string> };
+        expect(pkg.peerDependencies).toBeUndefined();
+    });
+
+    it("does not depend on any @noble/* package directly", {
+        timeout: 5000,
+    }, () => {
+        // Every @noble/* import must go through one of the @suaveplan/crypto-*
+        // selector packages. check-crypto-selects enforces the impl routing.
+        const pkg = JSON.parse(
+            readFileSync(join(__dirname, "..", "package.json"), "utf8")
+        ) as { dependencies?: Record<string, string> };
+        const nobleDeps = Object.keys(pkg.dependencies ?? {}).filter((d) =>
+            d.startsWith("@noble/")
+        );
+        expect(nobleDeps).toEqual([]);
+    });
+});

packages/security-stack/crypto/crypto-core/tests/no-disallowed.test.ts

@@ -0,0 +1,63 @@
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, it } from "@suaveplan/testing/runner";
+
+const SRC = join(__dirname, "..", "src");
+const APPROVED_RANDOM = join(
+    SRC,
+    "primitives",
+    "random-bytes",
+    "random-bytes.ts"
+);
+
+const BANNED_GLOBAL: ReadonlyArray<RegExp> = [
+    /\bnode:fs\b/,
+    /\bnode:path\b/,
+    /\bnode:url\b/,
+    /\bprocess\./,
+    /\bBuffer\b/,
+    /\bdocument\.[a-z]/,
+    /\bwindow\.[a-z]/,
+];
+
+const BANNED_OUTSIDE_APPROVED: ReadonlyArray<RegExp> = [
+    /\bMath\.random\b/,
+    /\bDate\.now\b/,
+    /\bcrypto\.getRandomValues\b/,
+];
+
+function* walk(dir: string): Generator<string> {
+    for (const entry of readdirSync(dir)) {
+        const full = join(dir, entry);
+        const st = statSync(full);
+        if (st.isDirectory()) yield* walk(full);
+        else if (full.endsWith(".ts") && !full.endsWith(".test.ts")) yield full;
+    }
+}
+
+describe("no-disallowed", () => {
+    it("src/ avoids Node + browser built-ins", { timeout: 5000 }, () => {
+        const hits: string[] = [];
+        for (const file of walk(SRC)) {
+            const content = readFileSync(file, "utf8");
+            for (const pattern of BANNED_GLOBAL) {
+                if (pattern.test(content)) hits.push(`${file} ${pattern}`);
+            }
+        }
+        expect(hits).toEqual([]);
+    });
+
+    it("random sources live only in the approved file", {
+        timeout: 5000,
+    }, () => {
+        const hits: string[] = [];
+        for (const file of walk(SRC)) {
+            if (file === APPROVED_RANDOM) continue;
+            const content = readFileSync(file, "utf8");
+            for (const pattern of BANNED_OUTSIDE_APPROVED) {
+                if (pattern.test(content)) hits.push(`${file} ${pattern}`);
+            }
+        }
+        expect(hits).toEqual([]);
+    });
+});

packages/security-stack/crypto/crypto-core/tests/setup/polyfills.ts

@@ -0,0 +1,7 @@
+import { webcrypto } from "node:crypto";
+
+type WritableGlobal = { crypto?: Crypto };
+const g = globalThis as WritableGlobal;
+if (g.crypto === undefined) {
+    g.crypto = webcrypto as unknown as Crypto;
+}

packages/security-stack/crypto/crypto-core/tests/tree-shake.test.ts

@@ -0,0 +1,19 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, it } from "@suaveplan/testing/runner";
+
+describe("tree-shake", () => {
+    it("sideEffects is false", { timeout: 5000 }, () => {
+        const pkg = JSON.parse(
+            readFileSync(join(__dirname, "..", "package.json"), "utf8")
+        ) as { sideEffects?: boolean };
+        expect(pkg.sideEffects).toBe(false);
+    });
+
+    it("exposes per-primitive subpath exports", { timeout: 5000 }, () => {
+        const pkg = JSON.parse(
+            readFileSync(join(__dirname, "..", "package.json"), "utf8")
+        ) as { exports?: Record<string, unknown> };
+        expect(Object.keys(pkg.exports ?? {}).length).toBeGreaterThanOrEqual(8);
+    });
+});