mirror of
https://github.com/PR0M3TH3AN/bitlogin.git
synced 2026-10-27 08:31:21 +00:00
thePR0M3TH3ANandClaude Fable 5
6eb1d7d640
A Dependabot PR failed the build by bundling @noble/hashes 1.8->2.2, @noble/curves 1.9->2.2, @scure/base 1.2->2.2, @scure/bip39 1.6->2.2, TypeScript 5->7, Vite 6->8 and Vitest 3->4 into a single change. Production was never affected -- only that preview -- and the cause is real rather than flaky: noble v2 exports only ".js"-suffixed subpaths, while this code imports the extensionless "@noble/hashes/sha2" that 1.8 provides. Failing to compile was the LUCKY outcome. The tests could not have caught the dangerous version of this. Account capsules live on public relays, and the login name plus password derive the locator, signing scalar and capsule key deterministically -- so those outputs are a compatibility contract with every account that already exists. The crypto suite only checked self-consistency (same input, same output within one run), which stays green even if HKDF, base64url framing, BIP-39 seeding or JCS ordering all change. A grouped major that compiled would have shipped and locked every existing user out, with no server-side record to migrate them from. So this adds knownAnswer.test.ts, pinning the actual outputs of HKDF-Extract, HKDF-Expand, ScalarExpand (scalar, counter and resulting public key), BIP-39 phrase and seed, base64url, and JCS ordering. The vectors are captured from the shipping implementation, and the header says plainly what a failure means: not "update the expected value", but "this upgrade is account-breaking". dependabot.yml now groups only minor and patch updates. Majors are still proposed, individually, so each can be judged on its own. Majors of the derivation chain itself (@noble/*, @scure/*, hash-wasm, canonicalize) are ignored entirely -- that is deliberate work with the vectors green, not an automated PR waiting to be merged on a quiet afternoon. 172/172 tests, typecheck clean. Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01CMr9Yt8SYmZcfgrg3CV2G1