archetech / archon / 32594720021

95%

push

github

fix(deps): Declare @noble/curves at the root, where a test depends on it (#927)

tests/keymaster/nostr.test.ts verifies schnorr signatures with a copy of
@noble/curves that is deliberately NOT the one that signed them:
packages/cipher pins 1.9.7, this resolves the root's 2.x. Nostr signatures
have to be verifiable by other people's software, so an independent
implementation is the point -- it makes this an interop test rather than a
round trip through one library.

But the root copy was undeclared, arriving only because @libp2p/crypto
happens to hoist it. A dependency change could legally have collapsed both
sides onto one copy, and the test would have kept passing while proving
nothing. Same undeclared-but-relied-upon hazard #924's review caught with
@types/express.

Declaring it moved the resolved version 2.0.1 -> 2.3.0, since 2.0.1 was
only whatever @libp2p/crypto's range landed on. Verified rather than
assumed: the interop test and the 63 cipher tests pass on 2.3.0, as does
the full suite, which covers the helia and kubo paths that use the same
copy at runtime.

packages/cipher stays on 1.9.7 deliberately. Moving it to 2.x means two
breaking renames in the key-agreement path -- randomPrivateKey ->
randomSecretKey, and edwardsToMontgomeryPub -> utils.toMontgomery, no
longer a top-level export -- for no functional gain. See #925.

2252 tests pass, typecheck 0, lint clean.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

3806 of 4293 branches covered (88.66%)

Branch coverage included in aggregate %.

8465 of 8776 relevant lines covered (96.46%)

689.48 hits per line