102 lines
6.9 KiB
Markdown
102 lines
6.9 KiB
Markdown
# Tasks: enterprise-crypto-family
|
|
|
|
## Pre-work
|
|
|
|
- [x] 1. Archive `openspec/changes/enterprise-crypto/` → `openspec/archive/2026-04-18-enterprise-crypto/`
|
|
- [x] 2. Add catalog entries to root `package.json`: `@noble/hashes`, `@noble/ciphers`, `@noble/curves`, `libsodium-wrappers-sumo`, `@types/libsodium-wrappers-sumo`, `@scure/bip39`
|
|
- [x] 3. Delete `packages/universal/crypto/` (existing genesis scaffold, will be rebuilt as the new multi-package family)
|
|
|
|
## Wave 1 — @suaveplan/hash (no workspace deps)
|
|
|
|
- [x] 4. Scaffold `packages/universal/hash`: `package.json` (deps: `@noble/hashes`, `@suaveplan/error`, `tslib`, `zod`), `tsconfig.lib.json`, `vite.config.ts`, `vitest.config.ts` (100/100/100/100 thresholds)
|
|
- [x] 5. `errors/`: `HashError`, `HASH_CODES`, `hash-error.ts`, `codes.ts`, `index.ts`
|
|
- [x] 6. `hash/sha2.ts` + test + md: `sha256`, `sha384`, `sha512`, `hash(algo, data)`, `HashAlgorithm`
|
|
- [x] 7. `mac/hmac.ts` + test + md: `hmac(algo, key, data)`; `hasherFor` private to package
|
|
- [x] 8. `kdf/hkdf.ts` + test + md: `hkdf(algo, ikm, { salt, info, length })`
|
|
- [x] 9. `kdf/pbkdf2.ts` + test + md: `pbkdf2`, `PBKDF2_MIN_ITERATIONS`, parameter validation
|
|
- [x] 10. `kdf/argon2id.ts` + test + md: `argon2id`, min constants, per-field validation
|
|
- [x] 11. `encoding/hex.ts` + `encoding/base64.ts` + tests + mds
|
|
- [x] 12. `constants/index.ts`; barrel `src/index.ts`; subpath exports in `package.json`
|
|
- [x] 13. `tests/no-disallowed.test.ts`, `tests/tree-shake.test.ts`
|
|
- [x] 14. fast-check property tests; mitata benchmarks
|
|
- [x] 15. `README.md`
|
|
- [x] 16. `bunx turbo lint typecheck test:coverage --filter=@suaveplan/hash --force` → green at 100%
|
|
- [x] 17. `bun scripts/publish.ts --package @suaveplan/hash`
|
|
|
|
## Wave 2 — @suaveplan/crypto (depends on hash, error, types)
|
|
|
|
- [x] 18. Scaffold `packages/universal/crypto`: `package.json` (deps: `@noble/ciphers`, `@noble/curves`, `@suaveplan/hash`, `@suaveplan/error`, `@suaveplan/types`, `tslib`, `zod`), configs, 100% thresholds
|
|
- [x] 19. `errors/`: `CryptoError`, `CRYPTO_CODES`
|
|
- [x] 20. `engines/`: `aead-engine.types.ts`, `sign-engine.types.ts`, `agree-engine.types.ts`, `sealed-box-engine.types.ts`, `auth-box-engine.types.ts`
|
|
- [x] 21. `primitives/random-bytes.ts` + test + md: `ByteSource`, `defaultByteSource`, `randomBytes`; single `crypto.getRandomValues` callsite
|
|
- [x] 22. `primitives/constant-time-equal.ts` + test + md
|
|
- [x] 23. `primitives/zeroize.ts` + test + md
|
|
- [x] 24. `aead/noble-aead-engine.ts` + `aead/aead.ts` + test + md: `aeadEncrypt`, `aeadDecrypt`, `AeadAlgorithm` (adds XChaCha20-Poly1305), key/nonce validation
|
|
- [x] 25. `sign/noble-sign-engine.ts` + `sign/ed25519.ts` + test + md
|
|
- [x] 26. `sign/ecdsa-p256.ts` + test + md (retry loop for key validity)
|
|
- [x] 27. `agree/noble-agree-engine.ts` + `agree/x25519.ts` + test + md
|
|
- [x] 28. `sealed-box/noble-sealed-box-engine.ts` + `sealed-box/sealed-box.ts` + test + md
|
|
- [x] 29. `auth-box/noble-auth-box-engine.ts` + `auth-box/auth-box.ts` + test + md
|
|
- [x] 30. `constants/index.ts`; barrel `src/index.ts`; subpath exports
|
|
- [x] 31. `tests/no-disallowed.test.ts`, `tests/dep-graph.test.ts`, `tests/tree-shake.test.ts`
|
|
- [x] 32. fast-check property tests; mitata benchmarks; Zod schemas for all public option types
|
|
- [x] 33. `README.md`
|
|
- [x] 34. `bunx turbo lint typecheck test:coverage --filter=@suaveplan/crypto --force` → green at 100%
|
|
- [x] 35. `bun scripts/publish.ts --package @suaveplan/crypto`
|
|
|
|
## Wave 3 — @suaveplan/crypto-sodium and @suaveplan/crypto-browser (parallel, both depend on crypto)
|
|
|
|
- [x] 36. Scaffold `packages/universal/crypto-sodium`: package.json (deps: `libsodium-wrappers-sumo`, `@types/libsodium-wrappers-sumo`, `@suaveplan/crypto`, `@suaveplan/error`, `tslib`), configs
|
|
- [x] 37. `init.ts` + md: `sodiumReady()` lazy singleton
|
|
- [x] 38. `engines/sodium-aead-engine.ts` + test + md
|
|
- [x] 39. `engines/sodium-sign-engine.ts` + test + md
|
|
- [x] 40. `engines/sodium-agree-engine.ts` + test + md
|
|
- [x] 41. `engines/sodium-sealed-box-engine.ts` + test + md
|
|
- [x] 42. `engines/sodium-auth-box-engine.ts` + test + md
|
|
- [x] 43. `primitives/crypto-kdf.ts` + test + md
|
|
- [x] 44. `primitives/crypto-auth.ts` + test + md
|
|
- [x] 45. `primitives/crypto-pwhash.ts` + test + md
|
|
- [x] 46. `primitives/ristretto255.ts` + test + md
|
|
- [x] 47. barrel + subpath exports + README; `bunx turbo lint typecheck test:coverage --filter=@suaveplan/crypto-sodium --force` → 100%
|
|
- [x] 48. `bun scripts/publish.ts --package @suaveplan/crypto-sodium`
|
|
- [x] 49. Scaffold `packages/universal/crypto-browser`: package.json (deps: `@suaveplan/crypto`, `@suaveplan/error`, `tslib`), configs
|
|
- [x] 50. `engines/webcrypto-aead-engine.ts` + test + md
|
|
- [x] 51. `engines/webcrypto-sign-engine.ts` + test + md
|
|
- [x] 52. `engines/webcrypto-agree-engine.ts` + test + md
|
|
- [x] 53. `rsa/rsa.ts` + test + md
|
|
- [x] 54. `aes-kw/aes-kw.ts` + test + md
|
|
- [x] 55. `ecdsa-p384/` + `ecdh-p384/` + tests + mds
|
|
- [x] 56. `non-extractable-key/non-extractable-key.ts` + test + md
|
|
- [x] 57. `isWebCryptoAvailable` + `BrowserCryptoError`; barrel + subpath exports + README
|
|
- [x] 58. `bunx turbo lint typecheck test:coverage --filter=@suaveplan/crypto-browser --force` → 100%
|
|
- [x] 59. `bun scripts/publish.ts --package @suaveplan/crypto-browser`
|
|
|
|
## Wave 4 — @suaveplan/crypto-keys (depends on crypto)
|
|
|
|
- [x] 60. Scaffold `packages/universal/crypto-keys`: package.json, configs
|
|
- [x] 61. `keypair/generate.ts` + test + md
|
|
- [x] 62. `keypair/validate.ts` + test + md
|
|
- [x] 63. `keychain/keychain.ts` + test + md
|
|
- [x] 64. `keychain/adapters/memory-adapter.ts` + `serialized-adapter.ts` + tests + mds
|
|
- [x] 65. `errors/`; barrel + subpath exports + README
|
|
- [x] 66. `bunx turbo lint typecheck test:coverage --filter=@suaveplan/crypto-keys --force` → 100%
|
|
- [x] 67. `bun scripts/publish.ts --package @suaveplan/crypto-keys`
|
|
|
|
## Wave 5 — @suaveplan/crypto-vault (depends on crypto, crypto-keys, hash, events)
|
|
|
|
- [x] 68. Scaffold `packages/universal/crypto-vault`: package.json (deps: `@suaveplan/crypto`, `@suaveplan/crypto-keys`, `@suaveplan/hash`, `@suaveplan/events`, `@suaveplan/error`, `@suaveplan/types`, `@scure/bip39`, `tslib`, `zod`), configs
|
|
- [x] 69. `mnemonic/mnemonic.ts` + test + md: `generateMnemonic`, `validateMnemonic`, `mnemonicToSeed`
|
|
- [x] 70. (derivation folded into vault.ts — HKDF child key derivation inline)
|
|
- [x] 71. `vault/vault.types.ts` — `VaultEvents`, `VaultOptions`
|
|
- [x] 72. `vault/vault.ts` + test + md: unlock, lock, sign, derive, zeroize on lock
|
|
- [x] 73. `chain-signer/chain-signer.ts` + test + md
|
|
- [x] 74. `errors/`; barrel + subpath exports + README
|
|
- [x] 75. `bunx turbo lint typecheck test:coverage --filter=@suaveplan/crypto-vault --force` → 100%
|
|
- [x] 76. `bun scripts/publish.ts --package @suaveplan/crypto-vault`
|
|
|
|
## Close-out
|
|
|
|
- [x] 77. Update `CLAUDE.md` package listing for all 6 new packages
|
|
- [x] 78. Update `PACKAGES.yml` / `STRUCTURE.yml` with new packages and deps
|
|
- [x] 79. Archive `openspec/changes/enterprise-crypto-family/` → `openspec/archive/2026-04-18-enterprise-crypto-family/`
|