Initial Commit
This commit is contained in:
@@ -0,0 +1,69 @@
|
||||
# restore-crypto-cleanup-duplicates — remove primitive duplicates from `@suaveplan/crypto`
|
||||
|
||||
**Packages:** `@suaveplan/crypto`, `@suaveplan/crypto-core`
|
||||
**Status:** PROPOSED
|
||||
**Type:** refactor (no behaviour change; no public surface change)
|
||||
**Carved from:** `restore-crypto-keychain-packer` umbrella (2026-05-03)
|
||||
|
||||
## Why
|
||||
|
||||
When the genesis crypto stack was sliced into `@suaveplan/crypto-core` (primitives) and `@suaveplan/crypto` (opinionated layer), the primitive implementations were duplicated rather than re-exported. Today `crypto/src/` holds 46 files of `aead/`, `agree/`, `auth-box/`, `sealed-box/`, `sign/`, `primitives/`, and `engines/` that are exact copies of the same modules in `crypto-core/src/`.
|
||||
|
||||
This blocks the import-allowlist conformance gate (slice 4): the gate's purpose is to mechanically prevent consumers from reaching past `@suaveplan/crypto` into the primitive layer. With duplicate implementations sitting inside `crypto/src/`, the gate would either flag self-imports or accept what it should reject. Cleanup must come first.
|
||||
|
||||
The fix is mechanical: delete the duplicate files, replace each previously-published export with a typed re-export from `@suaveplan/crypto-core`. The public surface of `@suaveplan/crypto` does not change — every symbol that was importable yesterday is importable today, just sourced from one place.
|
||||
|
||||
## What changes
|
||||
|
||||
### Removed (from `@suaveplan/crypto/src/`)
|
||||
|
||||
- `aead/` — 5 files (delete)
|
||||
- `agree/` — 6 files (delete)
|
||||
- `auth-box/` — 5 files (delete)
|
||||
- `sealed-box/` — 5 files (delete)
|
||||
- `sign/` — 9 files (delete)
|
||||
- `primitives/` — 10 files (delete)
|
||||
- `engines/` — 6 files (delete)
|
||||
|
||||
Total: 46 source files removed.
|
||||
|
||||
### Modified
|
||||
|
||||
- `@suaveplan/crypto/src/index.ts` — every primitive-surface symbol becomes a typed re-export from `@suaveplan/crypto-core` (e.g. `export { aead, ed25519, x25519, sealedBox, authBox, ... } from "@suaveplan/crypto-core"`).
|
||||
- `@suaveplan/crypto/package.json` — remove `@suaveplan/crypto-cipher`, `@suaveplan/crypto-curve`, `@suaveplan/crypto-hash`, `@suaveplan/crypto-utils` from direct deps if they are only used by the duplicated files (they will be transitively available via `crypto-core`). Keep them only if the opinionated modules (`keychain`, `derivation`, `bundles`, `domain-tags`, `authority`) genuinely import them directly.
|
||||
|
||||
### Preserved (inside `@suaveplan/crypto/src/`)
|
||||
|
||||
- `authority/` — 3 files
|
||||
- `bundles/` — 7 files
|
||||
- `derivation/` — 10 files
|
||||
- `domain-tags/` — 3 files
|
||||
- `keychain/` — 12 files
|
||||
- `errors/` — 6 files
|
||||
- `constants/` — N/A
|
||||
- `index.ts` (rewritten)
|
||||
|
||||
## Out of scope
|
||||
|
||||
- Folding `crypto-keys` and `crypto-vault` into `crypto` — slice 2.
|
||||
- Building the missing modules (`packer`, `chunked-packer`, `vault`, `revocation`, `audit-log`, `identity`, `wire-format`) — slice 3.
|
||||
- The import-allowlist conformance gate — slice 4 (this slice unblocks it).
|
||||
- `crypto-cli`, `slsa` migration — slice 4.
|
||||
|
||||
## Source mapping
|
||||
|
||||
| Requirement | Source | Notes |
|
||||
|---|---|---|
|
||||
| Remove duplicates; re-export from `crypto-core` | `restore-crypto-keychain-packer` umbrella, "Why" | Above-baseline genesis slice plan |
|
||||
| Public surface byte-identical after change | Genesis policy (CLAUDE.md §Workflow rule 5) | Preserve full public surface during rewrites |
|
||||
|
||||
## Verification approach
|
||||
|
||||
- `bunx turbo build --filter=@suaveplan/crypto` produces a `dist/index.d.ts` whose public symbol set is byte-identical to the pre-change snapshot (committed at `tests/before.dts.txt`); diff is zero lines.
|
||||
- `bunx turbo lint typecheck test --filter=@suaveplan/crypto` green.
|
||||
- `bunx turbo test:coverage --filter=@suaveplan/crypto` still 100/100/100/100 over the *retained* opinionated modules (the deleted modules' coverage now sits in `crypto-core`).
|
||||
- Every existing in-monorepo consumer of `@suaveplan/crypto` still compiles and tests green (`...@suaveplan/crypto` dependent sweep).
|
||||
|
||||
## Migration impact
|
||||
|
||||
None. Public surface unchanged. No consumer needs to update an import.
|
||||
@@ -0,0 +1,27 @@
|
||||
# Capability Spec Delta: crypto (restore-crypto-cleanup-duplicates)
|
||||
|
||||
**Package:** `@suaveplan/crypto`
|
||||
**Status:** PROPOSED
|
||||
|
||||
## ADDED Requirements
|
||||
|
||||
### Requirement: Primitive-surface symbols sourced from `@suaveplan/crypto-core`
|
||||
|
||||
`@suaveplan/crypto` SHALL NOT contain its own implementation of the cryptographic primitives (AEAD, key agreement, signing, sealed-box, auth-box, raw key generation). Every primitive symbol exposed in the package's public surface MUST be a typed re-export from `@suaveplan/crypto-core`. The opinionated modules (`keychain`, `derivation`, `bundles`, `domain-tags`, `authority`) MAY internally import from `@suaveplan/crypto-core` but MUST NOT re-implement primitive operations.
|
||||
|
||||
#### Scenario: no primitive impl files remain in `crypto/src/`
|
||||
|
||||
- **WHEN** the test scans `crypto/src/` for files under `aead/`, `agree/`, `auth-box/`, `sealed-box/`, `sign/`, `primitives/`, or `engines/`
|
||||
- **THEN** zero files are found
|
||||
|
||||
#### Scenario: every previously-public primitive symbol is still importable
|
||||
|
||||
- **WHEN** a consumer imports any of `aead`, `ed25519`, `x25519`, `sealedBox`, `authBox`, `randomBytes`, `zeroize`, `constantTimeEqual`, etc. from `@suaveplan/crypto`
|
||||
- **THEN** the symbol resolves and has the same type signature it had before this change
|
||||
|
||||
#### Scenario: barrel diff is byte-identical
|
||||
|
||||
- **WHEN** the post-change `dist/index.d.ts` is diffed against the pre-change snapshot at `tests/before.dts.txt`
|
||||
- **THEN** the diff is zero lines (the public type surface is unchanged)
|
||||
|
||||
**Verified by:** `tests/no-duplicates.test.ts::"no primitive impl files in crypto/src/"` AND `tests/dts-snapshot.test.ts::"public surface byte-identical"` AND existing primitive-surface usage in dependent packages (`bitpacker-crypto`, `slsa`, etc.) compiling green
|
||||
@@ -0,0 +1,40 @@
|
||||
# Tasks — restore-crypto-cleanup-duplicates
|
||||
|
||||
## 1. Snapshot
|
||||
|
||||
- [ ] 1.1 Build `@suaveplan/crypto` and capture public symbol set from `dist/index.d.ts` to `tests/before.dts.txt`
|
||||
|
||||
## 2. Rewrite the barrel
|
||||
|
||||
- [ ] 2.1 Rewrite `crypto/src/index.ts` so every primitive-surface symbol re-exports from `@suaveplan/crypto-core` (typed `export { ... } from "@suaveplan/crypto-core"`)
|
||||
- [ ] 2.2 Verify the symbol set still matches by re-running the dist diff
|
||||
|
||||
## 3. Delete duplicate modules
|
||||
|
||||
- [ ] 3.1 Delete `crypto/src/aead/` (5 files)
|
||||
- [ ] 3.2 Delete `crypto/src/agree/` (6 files)
|
||||
- [ ] 3.3 Delete `crypto/src/auth-box/` (5 files)
|
||||
- [ ] 3.4 Delete `crypto/src/sealed-box/` (5 files)
|
||||
- [ ] 3.5 Delete `crypto/src/sign/` (9 files)
|
||||
- [ ] 3.6 Delete `crypto/src/primitives/` (10 files)
|
||||
- [ ] 3.7 Delete `crypto/src/engines/` (6 files)
|
||||
- [ ] 3.8 Walk every internal import in the retained `crypto/src/` modules and re-point any reference that resolved into a deleted directory at `@suaveplan/crypto-core` (subpath imports as needed)
|
||||
|
||||
## 4. Trim `package.json`
|
||||
|
||||
- [ ] 4.1 Audit `crypto/package.json` deps: keep `crypto-core`, `bitpacker`, `error`, `types`, `tslib`, `zod`; remove any of `crypto-cipher`, `crypto-curve`, `crypto-hash`, `crypto-utils` that are no longer directly imported by retained modules
|
||||
- [ ] 4.2 Re-run typecheck to verify no transitive-dep gap
|
||||
|
||||
## 5. Verification gates
|
||||
|
||||
- [ ] 5.1 `bun run check` — Biome 0/0/0 across monorepo
|
||||
- [ ] 5.2 `bunx turbo lint typecheck test --filter=@suaveplan/crypto` green
|
||||
- [ ] 5.3 `bunx turbo test:coverage --filter=@suaveplan/crypto` 100/100/100/100 over retained modules
|
||||
- [ ] 5.4 `bunx turbo build --filter=@suaveplan/crypto` produces a `dist/index.d.ts` byte-identical to the pre-change snapshot
|
||||
- [ ] 5.5 `bunx turbo test --filter=...@suaveplan/crypto` (dependent sweep) green
|
||||
- [ ] 5.6 OpenSpec conformance script clean for `@suaveplan/crypto`
|
||||
|
||||
## 6. Archive
|
||||
|
||||
- [ ] 6.1 Fold spec delta into `openspec/specs/crypto/spec.md` (preserves the new "primitives sourced from crypto-core" requirement)
|
||||
- [ ] 6.2 Move `openspec/changes/restore-crypto-cleanup-duplicates/` → `openspec/archive/<yyyy-mm-dd>-restore-crypto-cleanup-duplicates/`
|
||||
Reference in New Issue
Block a user