@sebastienrousseau/crypto-testing 0.0.7

package/LICENSE

@@ -0,0 +1,8 @@
+This project is dual-licensed under either of:
+
+  * Apache License, Version 2.0 — see LICENSE-APACHE
+  * MIT license — see LICENSE-MIT
+
+at your option.
+
+SPDX-License-Identifier: Apache-2.0 OR MIT

package/README.md

@@ -0,0 +1,295 @@
+<!-- SPDX-License-Identifier: Apache-2.0 OR MIT -->
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/sebastienrousseau/crypto-service/main/assets/crypto-testing-logo.svg" alt="crypto-testing logo" width="360" />
+</p>
+
+<h1 align="center">@sebastienrousseau/crypto-testing</h1>
+
+<p align="center">
+  Deterministic keys, fast mocks, and test fixtures for crypto-lib — make your CI/CD pipeline fast and reproducible.
+</p>
+
+<p align="center">
+  <a href="https://github.com/sebastienrousseau/crypto-service/actions"><img src="https://img.shields.io/github/actions/workflow/status/sebastienrousseau/crypto-service/ci.yml?branch=main&style=for-the-badge&logo=github" alt="Build" /></a>
+  <a href="https://coveralls.io/github/sebastienrousseau/crypto-service?branch=main"><img src="https://img.shields.io/coveralls/github/sebastienrousseau/crypto-service?branch=main&style=for-the-badge" alt="Coverage" /></a>
+  <a href="https://www.npmjs.com/package/@sebastienrousseau/crypto-testing"><img src="https://img.shields.io/npm/v/@sebastienrousseau/crypto-testing.svg?style=for-the-badge&color=f14041&logo=npm" alt="Registry" /></a>
+  <a href="https://sebastienrousseau.github.io/crypto-service/"><img src="https://img.shields.io/badge/docs-TypeDoc-blue.svg?style=for-the-badge&labelColor=555555&logo=typescript" alt="Docs" /></a>
+  <a href="https://scorecard.dev/viewer/?uri=github.com/sebastienrousseau/crypto-service" title="ossf-scorecard"><img src="https://img.shields.io/badge/OpenSSF-Scorecard-blue?style=for-the-badge&logo=openssf" alt="OpenSSF Scorecard" /></a>
+  <a href="https://github.com/sebastienrousseau/crypto-service/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0%20OR%20MIT-blue.svg?style=for-the-badge" alt="License: Apache-2.0 OR MIT" /></a>
+  <a href="https://github.com/sebastienrousseau/crypto-service/blob/main/docs/POLICIES.md"><img src="https://img.shields.io/badge/Node.js-%3E%3D22-93450a.svg?style=for-the-badge&logo=node.js" alt="Node.js 22 or newer" /></a>
+</p>
+
+---
+
+## Contents
+
+**Getting started**
+
+- [Install](#install) — installation via pnpm, npm, or yarn
+- [Requirements](#requirements) — runtime floor and environment prerequisites
+- [Quick Start](#quick-start) — minimal working usage sample
+
+**The Crypto Service ecosystem**
+
+- [The Crypto Service ecosystem](#the-crypto-service-ecosystem) — full 14-package suite overview
+
+**Package reference**
+
+- [Reference & Usage](#overview) — features, configuration, and capabilities
+- [Examples](#examples) — runnable sample code
+
+**Operational**
+
+- [Development](#development) — build, lint, format, and test targets
+- [Security](#security) — vulnerability disclosure and cryptographic invariants
+- [Documentation](#documentation) — TypeDoc API docs and ecosystem guides
+- [Stability guarantees](#stability-guarantees) — SemVer axis and release policy
+- [License](#license)
+
+---
+
+## Install
+
+```bash
+pnpm add @sebastienrousseau/crypto-testing
+# or
+npm install @sebastienrousseau/crypto-testing
+# or
+yarn add @sebastienrousseau/crypto-testing
+```
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Requirements
+
+- **Node.js**: `^22.0.0` or `>=24.0.0` (active and maintenance LTS releases)
+- **Package Manager**: `pnpm >=9` (recommended) or `npm >=10`
+- **TypeScript**: `>=5.0` (when compiling with TypeScript)
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Quick Start
+
+```ts
+import {
+  TEST_KEYS,
+  TEST_VECTORS,
+  mockEncrypt,
+  mockDecrypt,
+  createTestKeyring,
+  expectValidHex,
+  expectSignVerifyRoundTrip,
+} from "@sebastienrousseau/crypto-testing";
+
+// Use deterministic keys instead of generating new ones every run
+const { publicKey, privateKey } = TEST_KEYS.ed25519;
+
+// Mock encrypt/decrypt for fast unit tests
+const ct = mockEncrypt(TEST_KEYS.aes256, "secret data");
+const pt = mockDecrypt(TEST_KEYS.aes256, ct);
+
+// Validate outputs
+expectValidHex(publicKey, 32);
+
+// Full sign/verify round-trip with real crypto-lib
+expectSignVerifyRoundTrip("ed25519");
+```
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## The Crypto Service ecosystem
+
+Crypto Service provides a complete cryptography stack across 14 specialized packages:
+
+| Package                                                                       | Role             | Description                                                                                                                            |
+| :---------------------------------------------------------------------------- | :--------------- | :------------------------------------------------------------------------------------------------------------------------------------- |
+| [`@sebastienrousseau/crypto-api`](../crypto-api)                              | API Schemas      | Shared TypeScript types and utilities for the Crypto Service Suite, defining the canonical API surface.                                |
+| [`@sebastienrousseau/crypto-cli`](../crypto-cli)                              | Terminal CLI     | An interactive command-line interface for cryptographic operations, supporting both legacy OpenPGP and modern post-quantum algorithms. |
+| [`@sebastienrousseau/crypto-edge`](../crypto-edge)                            | Edge Runtime     | Edge-runtime cryptographic operations using the Web Crypto API, optimized for Cloudflare Workers, Vercel Edge, and Deno.               |
+| [`@sebastienrousseau/crypto-kms`](../crypto-kms)                              | Cloud KMS        | Unified Key Management Service interface for AWS KMS, GCP Cloud KMS, Azure Key Vault, and HashiCorp Vault.                             |
+| [`@sebastienrousseau/crypto-lib`](../crypto-lib)                              | Core Library     | A modern cryptographic library for TypeScript, with post-quantum support, zero unsafe dependencies, and 100% test coverage.            |
+| [`@sebastienrousseau/crypto-middleware`](../crypto-middleware)                | Middleware       | Framework-agnostic cryptographic middleware for Express, Fastify, and Koa applications.                                                |
+| [`@sebastienrousseau/crypto-prisma`](../crypto-prisma)                        | ORM Adapter      | Transparent field-level encryption extension for Prisma Client, using XChaCha20-Poly1305.                                              |
+| [`@sebastienrousseau/crypto-react`](../crypto-react)                          | React Hooks      | React hooks and context provider for client-side cryptographic operations with zero boilerplate.                                       |
+| [`@sebastienrousseau/crypto-sdk`](../crypto-sdk)                              | Client SDK       | A zero-dependency, typed HTTP client for the Crypto Service REST API, with full post-quantum support.                                  |
+| [`@sebastienrousseau/crypto-server`](../crypto-server)                        | HTTP API         | A hardened Fastify REST API for cryptographic operations, with rate limiting, OpenAPI schemas, and post-quantum endpoints.             |
+| **[`@sebastienrousseau/crypto-testing`](../crypto-testing)** _(this package)_ | **Test Support** | **Deterministic keys, fast mocks, and test fixtures for crypto-lib**                                                                   |
+| [`@sebastienrousseau/crypto-typeorm`](../crypto-typeorm)                      | ORM Adapter      | TypeORM column-level encryption with a single decorator, powered by crypto-lib.                                                        |
+| [`@sebastienrousseau/crypto-vue`](../crypto-vue)                              | Vue Composables  | Vue 3 composables for client-side cryptography                                                                                         |
+| [`@sebastienrousseau/crypto-wasm`](../crypto-wasm)                            | Acceleration     | WebAssembly performance accelerator for crypto-lib                                                                                     |
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Overview
+
+crypto-testing is the test utility package for the Crypto Service
+Suite. It provides pre-generated deterministic keys, instant
+XOR-based mock functions for expensive crypto operations, one-call
+fixture generators, and assertion helpers for hex, Base64, key-pair,
+and round-trip validations. Use it to make your CI/CD pipeline fast
+and reproducible without sacrificing coverage.
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+## Features
+
+| Category       | What you get                                                                  |
+| :------------- | :---------------------------------------------------------------------------- |
+| **Keys**       | Pre-generated Ed25519, X25519, P-256, AES-256, and HMAC key pairs/keys        |
+| **Vectors**    | Known plaintext with expected SHA-256, SHA3-256, and BLAKE3 digests           |
+| **Mocks**      | Instant XOR-based fakes for encrypt, decrypt, sign, verify, password hashing  |
+| **Fixtures**   | One-call generators for keyrings, encrypted messages, signed messages, hashes |
+| **Assertions** | Hex, Base64, key-pair, encrypt/decrypt, and sign/verify round-trip helpers    |
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+## Deterministic Keys
+
+`TEST_KEYS` provides well-known key pairs that never change between
+runs:
+
+| Key       | Algorithm | Description                      |
+| :-------- | :-------- | :------------------------------- |
+| `ed25519` | Ed25519   | 32-byte signing key pair         |
+| `x25519`  | X25519    | 32-byte key-exchange pair        |
+| `p256`    | P-256     | ECDSA signing key pair           |
+| `aes256`  | AES-256   | 32-byte symmetric encryption key |
+| `hmacKey` | HMAC      | 32-byte HMAC key                 |
+
+`TEST_VECTORS` includes a known plaintext and its expected hashes.
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+## Mock Functions
+
+Replace expensive crypto operations with instant, deterministic
+fakes:
+
+| Function              | Replaces                 | Speed     |
+| :-------------------- | :----------------------- | :-------- |
+| `mockHashPassword`    | Argon2id (100+ ms)       | < 0.01 ms |
+| `mockGenerateKeyPair` | Real key generation      | < 0.01 ms |
+| `mockEncrypt`         | XChaCha20-Poly1305       | < 0.01 ms |
+| `mockDecrypt`         | XChaCha20-Poly1305       | < 0.01 ms |
+| `mockSign`            | Ed25519/ECDSA signatures | < 0.01 ms |
+| `mockVerify`          | Signature verification   | < 0.01 ms |
+
+All mock functions use XOR internally -- they are **not
+cryptographically secure** but are deterministic and round-trip
+correctly.
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+## Fixtures
+
+Fixture generators produce complete test data structures in one
+call:
+
+| Function                       | Returns                                                         |
+| :----------------------------- | :-------------------------------------------------------------- |
+| `createTestKeyring()`          | Keyring with signing, exchange, ECDSA, symmetric, and HMAC keys |
+| `createTestEncryptedMessage()` | Key + plaintext + mock ciphertext                               |
+| `createTestSignedMessage()`    | Key pair + message + mock signature                             |
+| `createTestPasswordHash()`     | Hash + salt + params + PHC string                               |
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+## Assertion Helpers
+
+One-liner assertions that throw descriptive errors on failure:
+
+| Helper                          | Checks                                 |
+| :------------------------------ | :------------------------------------- |
+| `expectValidHex(value, len?)`   | Valid hex string, optional byte length |
+| `expectValidBase64(value)`      | Valid Base64 string with round-trip    |
+| `expectKeyPair(kp)`             | Non-empty hex keys, pub != priv        |
+| `expectEncryptDecryptRoundTrip` | Real secretbox encrypt then decrypt    |
+| `expectSignVerifyRoundTrip`     | Real keygen, sign, and verify          |
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+## Examples
+
+All examples are self-contained TypeScript files in the `examples/`
+directory. Run any example with:
+
+```bash
+npx ts-node examples/<name>.ts
+```
+
+| Category   | Example                                 | Purpose                             |
+| :--------- | :-------------------------------------- | :---------------------------------- |
+| Keys       | [keys.ts](examples/keys.ts)             | Using deterministic test keys       |
+| Mocks      | [mocks.ts](examples/mocks.ts)           | Mocking crypto operations for speed |
+| Fixtures   | [fixtures.ts](examples/fixtures.ts)     | Using pre-built test fixtures       |
+| Assertions | [assertions.ts](examples/assertions.ts) | Assertion helpers in tests          |
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Development
+
+```bash
+pnpm --filter @sebastienrousseau/crypto-testing run build
+pnpm --filter @sebastienrousseau/crypto-testing run test
+pnpm --filter @sebastienrousseau/crypto-testing run lint
+pnpm --filter @sebastienrousseau/crypto-testing run format
+```
+
+All 18 packages in the Crypto Service workspace maintain a **100% coverage floor** across statements, branches, functions, and lines.
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Security
+
+Report vulnerabilities privately via [GitHub Security Advisories](https://github.com/sebastienrousseau/crypto-service/security/advisories) or according to [`SECURITY.md`](../../SECURITY.md). Never report security issues publicly.
+
+Cryptographic operations use the `@noble/*` libraries, Node.js `crypto` and OpenPGP.js. `@noble/post-quantum` has not been independently audited and does not guarantee constant-time execution, and no module in this suite is FIPS 140-3 validated. Key zeroization is limited: JavaScript strings and garbage-collected buffers cannot be reliably wiped. See [`SECURITY.md`](../../SECURITY.md).
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Documentation
+
+- [Full Suite Documentation](https://sebastienrousseau.github.io/crypto-service/)
+- [API Reference (TypeDoc)](https://sebastienrousseau.github.io/crypto-service/)
+- [Developer Guide](../../DEVELOPMENT.md)
+- [Security Policy](../../SECURITY.md)
+- [Architecture & Design](../../ARCHITECTURE.md)
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Stability guarantees
+
+Versions advance strictly one step at a time on the `0.0.x` line (`v0.0.1` → `v0.0.2` → `v0.0.3` ... → `v0.0.999` → `v0.1.0`). Work for every release iteration begins on a dedicated `feat/v<version>` branch.
+
+All 18 packages in the workspace move in lockstep. Public API signatures, cipher output formats, and serialization schemas are strictly versioned. Breaking changes to serialized formats or algorithm defaults are considered major breaking changes. Minimum toolchain upgrades (e.g. Node.js LTS floor) are governed by [POLICIES.md](../../docs/POLICIES.md).
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## License
+
+Dual-licensed under [Apache 2.0](https://www.apache.org/licenses/LICENSE-2.0) or [MIT](https://opensource.org/licenses/MIT), at your option.
+
+Copyright (c) 2022-2026 Sebastien Rousseau and The Crypto Service Suite contributors.
+
+<p align="right"><a href="#contents">Back to Top</a></p>

package/dist/fixtures.d.ts

@@ -0,0 +1,26 @@
+import { type MockKeyPair, type MockHashPasswordResult } from "./mock";
+export interface TestKeyring {
+    signing: MockKeyPair;
+    exchange: MockKeyPair;
+    ecdsa: MockKeyPair;
+    symmetric: string;
+    hmac: string;
+}
+export declare function createTestKeyring(): TestKeyring;
+export interface TestEncryptedMessage {
+    key: string;
+    plaintext: string;
+    ciphertext: string;
+    algorithm: "mock-xor";
+}
+export declare function createTestEncryptedMessage(plaintext?: string, key?: string): TestEncryptedMessage;
+export interface TestSignedMessage {
+    algorithm: string;
+    publicKey: string;
+    privateKey: string;
+    message: string;
+    signature: string;
+}
+export declare function createTestSignedMessage(algorithm?: string, message?: string): TestSignedMessage;
+export declare function createTestPasswordHash(password?: string): MockHashPasswordResult;
+//# sourceMappingURL=fixtures.d.ts.map

package/dist/fixtures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixtures.d.ts","sourceRoot":"","sources":["../src/fixtures.ts"],"names":[],"mappings":"AAYA,OAAO,EAKL,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC5B,MAAM,QAAQ,CAAC;AAiBhB,MAAM,WAAW,WAAW;IAE1B,OAAO,EAAE,WAAW,CAAC;IAErB,QAAQ,EAAE,WAAW,CAAC;IAEtB,KAAK,EAAE,WAAW,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;IAElB,IAAI,EAAE,MAAM,CAAC;CACd;AAcD,wBAAgB,iBAAiB,IAAI,WAAW,CAQ/C;AAiBD,MAAM,WAAW,oBAAoB;IAEnC,GAAG,EAAE,MAAM,CAAC;IAEZ,SAAS,EAAE,MAAM,CAAC;IAElB,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,UAAU,CAAC;CACvB;AAiBD,wBAAgB,0BAA0B,CACxC,SAAS,CAAC,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE,MAAM,GACX,oBAAoB,CAStB;AAiBD,MAAM,WAAW,iBAAiB;IAEhC,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,MAAM,CAAC;IAElB,UAAU,EAAE,MAAM,CAAC;IAEnB,OAAO,EAAE,MAAM,CAAC;IAEhB,SAAS,EAAE,MAAM,CAAC;CACnB;AAgBD,wBAAgB,uBAAuB,CACrC,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,GACf,iBAAiB,CAWnB;AAmBD,wBAAgB,sBAAsB,CACpC,QAAQ,CAAC,EAAE,MAAM,GAChB,sBAAsB,CAExB"}

package/dist/fixtures.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTestKeyring = createTestKeyring;
+exports.createTestEncryptedMessage = createTestEncryptedMessage;
+exports.createTestSignedMessage = createTestSignedMessage;
+exports.createTestPasswordHash = createTestPasswordHash;
+const keys_1 = require("./keys");
+const mock_1 = require("./mock");
+function createTestKeyring() {
+    return {
+        signing: (0, mock_1.mockGenerateKeyPair)("ed25519"),
+        exchange: (0, mock_1.mockGenerateKeyPair)("x25519"),
+        ecdsa: (0, mock_1.mockGenerateKeyPair)("p256"),
+        symmetric: keys_1.TEST_KEYS.aes256,
+        hmac: keys_1.TEST_KEYS.hmacKey,
+    };
+}
+function createTestEncryptedMessage(plaintext, key) {
+    const pt = plaintext ?? keys_1.TEST_VECTORS.plaintext;
+    const k = key ?? keys_1.TEST_KEYS.aes256;
+    return {
+        key: k,
+        plaintext: pt,
+        ciphertext: (0, mock_1.mockEncrypt)(k, pt),
+        algorithm: "mock-xor",
+    };
+}
+function createTestSignedMessage(algorithm, message) {
+    const alg = algorithm ?? "ed25519";
+    const msg = message ?? keys_1.TEST_VECTORS.plaintext;
+    const kp = (0, mock_1.mockGenerateKeyPair)(alg);
+    return {
+        algorithm: alg,
+        publicKey: kp.publicKey,
+        privateKey: kp.privateKey,
+        message: msg,
+        signature: (0, mock_1.mockSign)(kp.privateKey, msg),
+    };
+}
+function createTestPasswordHash(password) {
+    return (0, mock_1.mockHashPassword)(password ?? "test-password-123");
+}
+//# sourceMappingURL=fixtures.js.map

package/dist/helpers.d.ts

@@ -0,0 +1,12 @@
+import { type SignAlgorithm } from "@sebastienrousseau/crypto-lib";
+export declare function expectValidHex(value: string, length?: number): void;
+export declare function expectValidBase64(value: string): void;
+export interface MinimalKeyPair {
+    publicKey: string;
+    privateKey: string;
+    algorithm?: string;
+}
+export declare function expectKeyPair(kp: MinimalKeyPair): void;
+export declare function expectEncryptDecryptRoundTrip(key: string, plaintext: string): void;
+export declare function expectSignVerifyRoundTrip(algorithm: SignAlgorithm): void;
+//# sourceMappingURL=helpers.d.ts.map

package/dist/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../src/helpers.ts"],"names":[],"mappings":"AAUA,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAyB3E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAsBnE;AAsBD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAYrD;AAgBD,MAAM,WAAW,cAAc;IAE7B,SAAS,EAAE,MAAM,CAAC;IAElB,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAmBD,wBAAgB,aAAa,CAAC,EAAE,EAAE,cAAc,GAAG,IAAI,CAStD;AAqBD,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,GAChB,IAAI,CASN;AAsBD,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,aAAa,GAAG,IAAI,CAgCxE"}

package/dist/helpers.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.expectValidHex = expectValidHex;
+exports.expectValidBase64 = expectValidBase64;
+exports.expectKeyPair = expectKeyPair;
+exports.expectEncryptDecryptRoundTrip = expectEncryptDecryptRoundTrip;
+exports.expectSignVerifyRoundTrip = expectSignVerifyRoundTrip;
+const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
+const HEX_RE = /^[0-9a-fA-F]+$/;
+function expectValidHex(value, length) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new Error("Expected a non-empty hex string");
+    }
+    if (value.length % 2 !== 0) {
+        throw new Error(`Hex string has odd length (${value.length}); must be even`);
+    }
+    if (!HEX_RE.test(value)) {
+        throw new Error(`String is not valid hexadecimal: "${value.slice(0, 20)}..."`);
+    }
+    if (length !== undefined) {
+        const byteLen = value.length / 2;
+        if (byteLen !== length) {
+            throw new Error(`Expected ${length} bytes (${length * 2} hex chars), got ${byteLen} bytes (${value.length} hex chars)`);
+        }
+    }
+}
+const BASE64_RE = /^[A-Za-z0-9+/]*={0,2}$/;
+function expectValidBase64(value) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new Error("Expected a non-empty Base64 string");
+    }
+    if (!BASE64_RE.test(value)) {
+        throw new Error(`String is not valid Base64: "${value.slice(0, 20)}..."`);
+    }
+    const buf = Buffer.from(value, "base64");
+    if (buf.toString("base64") !== value) {
+        throw new Error("Base64 string does not survive round-trip decode/encode");
+    }
+}
+function expectKeyPair(kp) {
+    if (!kp || typeof kp !== "object") {
+        throw new Error("Expected a key pair object");
+    }
+    expectValidHex(kp.publicKey);
+    expectValidHex(kp.privateKey);
+    if (kp.publicKey === kp.privateKey) {
+        throw new Error("Public key and private key must not be identical");
+    }
+}
+function expectEncryptDecryptRoundTrip(key, plaintext) {
+    const sealed = crypto_lib_1.crypto.encrypt(key, plaintext);
+    const decrypted = crypto_lib_1.crypto.decrypt(key, sealed);
+    const result = Buffer.from(decrypted).toString("utf8");
+    if (result !== plaintext) {
+        throw new Error(`Round-trip failed: expected "${plaintext}", got "${result}"`);
+    }
+}
+function expectSignVerifyRoundTrip(algorithm) {
+    const keyAlgorithmMap = {
+        ed25519: "ed25519",
+        ed448: "ed448",
+        "ecdsa-p256": "p256",
+        "ecdsa-p384": "p384",
+        schnorr: "ed25519",
+        "ml-dsa-44": "ml-dsa-44",
+        "ml-dsa-65": "ml-dsa-65",
+        "ml-dsa-87": "ml-dsa-87",
+    };
+    const keyAlg = keyAlgorithmMap[algorithm];
+    if (!keyAlg) {
+        throw new Error(`No key algorithm mapping for sign algorithm "${algorithm}"`);
+    }
+    const kp = crypto_lib_1.crypto.generateKeyPair(keyAlg);
+    const message = "crypto-testing round-trip verification";
+    const signature = crypto_lib_1.crypto.sign(algorithm, kp.privateKey, message);
+    expectValidHex(signature);
+    const valid = crypto_lib_1.crypto.verify(algorithm, kp.publicKey, message, signature);
+    if (!valid) {
+        throw new Error(`Sign/verify round-trip failed for algorithm "${algorithm}"`);
+    }
+}
+//# sourceMappingURL=helpers.js.map

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { TEST_KEYS, TEST_VECTORS } from "./keys";
+export { mockHashPassword, mockGenerateKeyPair, mockEncrypt, mockDecrypt, mockSign, mockVerify, } from "./mock";
+export { createTestKeyring, createTestEncryptedMessage, createTestSignedMessage, createTestPasswordHash, } from "./fixtures";
+export { expectValidHex, expectValidBase64, expectKeyPair, expectEncryptDecryptRoundTrip, expectSignVerifyRoundTrip, } from "./helpers";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAGjD,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,QAAQ,EACR,UAAU,GACX,MAAM,QAAQ,CAAC;AAGhB,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.expectSignVerifyRoundTrip = exports.expectEncryptDecryptRoundTrip = exports.expectKeyPair = exports.expectValidBase64 = exports.expectValidHex = exports.createTestPasswordHash = exports.createTestSignedMessage = exports.createTestEncryptedMessage = exports.createTestKeyring = exports.mockVerify = exports.mockSign = exports.mockDecrypt = exports.mockEncrypt = exports.mockGenerateKeyPair = exports.mockHashPassword = exports.TEST_VECTORS = exports.TEST_KEYS = void 0;
+var keys_1 = require("./keys");
+Object.defineProperty(exports, "TEST_KEYS", { enumerable: true, get: function () { return keys_1.TEST_KEYS; } });
+Object.defineProperty(exports, "TEST_VECTORS", { enumerable: true, get: function () { return keys_1.TEST_VECTORS; } });
+var mock_1 = require("./mock");
+Object.defineProperty(exports, "mockHashPassword", { enumerable: true, get: function () { return mock_1.mockHashPassword; } });
+Object.defineProperty(exports, "mockGenerateKeyPair", { enumerable: true, get: function () { return mock_1.mockGenerateKeyPair; } });
+Object.defineProperty(exports, "mockEncrypt", { enumerable: true, get: function () { return mock_1.mockEncrypt; } });
+Object.defineProperty(exports, "mockDecrypt", { enumerable: true, get: function () { return mock_1.mockDecrypt; } });
+Object.defineProperty(exports, "mockSign", { enumerable: true, get: function () { return mock_1.mockSign; } });
+Object.defineProperty(exports, "mockVerify", { enumerable: true, get: function () { return mock_1.mockVerify; } });
+var fixtures_1 = require("./fixtures");
+Object.defineProperty(exports, "createTestKeyring", { enumerable: true, get: function () { return fixtures_1.createTestKeyring; } });
+Object.defineProperty(exports, "createTestEncryptedMessage", { enumerable: true, get: function () { return fixtures_1.createTestEncryptedMessage; } });
+Object.defineProperty(exports, "createTestSignedMessage", { enumerable: true, get: function () { return fixtures_1.createTestSignedMessage; } });
+Object.defineProperty(exports, "createTestPasswordHash", { enumerable: true, get: function () { return fixtures_1.createTestPasswordHash; } });
+var helpers_1 = require("./helpers");
+Object.defineProperty(exports, "expectValidHex", { enumerable: true, get: function () { return helpers_1.expectValidHex; } });
+Object.defineProperty(exports, "expectValidBase64", { enumerable: true, get: function () { return helpers_1.expectValidBase64; } });
+Object.defineProperty(exports, "expectKeyPair", { enumerable: true, get: function () { return helpers_1.expectKeyPair; } });
+Object.defineProperty(exports, "expectEncryptDecryptRoundTrip", { enumerable: true, get: function () { return helpers_1.expectEncryptDecryptRoundTrip; } });
+Object.defineProperty(exports, "expectSignVerifyRoundTrip", { enumerable: true, get: function () { return helpers_1.expectSignVerifyRoundTrip; } });
+//# sourceMappingURL=index.js.map

package/dist/keys.d.ts

@@ -0,0 +1,23 @@
+export declare const TEST_KEYS: {
+    readonly ed25519: {
+        readonly publicKey: "d75a980182b10ab7d54bfed3c964073a0ee172f3daa3f4a18446b7e8c38f1dd5";
+        readonly privateKey: "9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60";
+    };
+    readonly x25519: {
+        readonly publicKey: "8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e6a";
+        readonly privateKey: "77076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c2a";
+    };
+    readonly p256: {
+        readonly publicKey: "0437c1b9e44bcb3d97a78b8b5e71f5e3e5a4a0e7d6b8c2f1e0d9c8b7a6f5e4d3c2b1a09f8e7d6c5b4a3029f8e7d6c5b4a3029f8e7d6c5b4a3029f8e7d6c5b4a302";
+        readonly privateKey: "c9afa9d845ba75166b5c215767b1d6934e50c3db36e89b127b8a622b120f6721";
+    };
+    readonly aes256: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
+    readonly hmacKey: "cafebabecafebabecafebabecafebabecafebabecafebabecafebabecafebabe";
+};
+export declare const TEST_VECTORS: {
+    readonly plaintext: "The quick brown fox jumps over the lazy dog";
+    readonly sha256: "d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592";
+    readonly sha3_256: "a80f839cd4f83f6c3dafc87feae470045e4eb0d366397d5c6ce34ba1739f734d";
+    readonly blake3: "8e7e26d7e72a04d2ed173f90a72ec2a3bf3bb38890c9a2f95f3ab0e18a1e1a4a";
+};
+//# sourceMappingURL=keys.d.ts.map

package/dist/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;CAgCZ,CAAC;AAaX,eAAO,MAAM,YAAY;;;;;CASf,CAAC"}

package/dist/keys.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TEST_VECTORS = exports.TEST_KEYS = void 0;
+exports.TEST_KEYS = {
+    ed25519: {
+        publicKey: "d75a980182b10ab7d54bfed3c964073a0ee172f3daa3f4a18446b7e8c38f1dd5",
+        privateKey: "9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60",
+    },
+    x25519: {
+        publicKey: "8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e6a",
+        privateKey: "77076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c2a",
+    },
+    p256: {
+        publicKey: "0437c1b9e44bcb3d97a78b8b5e71f5e3e5a4a0e7d6b8c2f1e0d9c8b7a6f5e4d3c2b1a09f8e7d6c5b4a3029f8e7d6c5b4a3029f8e7d6c5b4a3029f8e7d6c5b4a302",
+        privateKey: "c9afa9d845ba75166b5c215767b1d6934e50c3db36e89b127b8a622b120f6721",
+    },
+    aes256: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+    hmacKey: "cafebabecafebabecafebabecafebabecafebabecafebabecafebabecafebabe",
+};
+exports.TEST_VECTORS = {
+    plaintext: "The quick brown fox jumps over the lazy dog",
+    sha256: "d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592",
+    sha3_256: "a80f839cd4f83f6c3dafc87feae470045e4eb0d366397d5c6ce34ba1739f734d",
+    blake3: "8e7e26d7e72a04d2ed173f90a72ec2a3bf3bb38890c9a2f95f3ab0e18a1e1a4a",
+};
+//# sourceMappingURL=keys.js.map

package/dist/mock.d.ts

@@ -0,0 +1,24 @@
+export interface MockHashPasswordResult {
+    hash: string;
+    salt: string;
+    params: {
+        t: number;
+        m: number;
+        p: number;
+    };
+    algorithm: "mock-argon2id";
+    phc: string;
+}
+export declare function mockHashPassword(password: string | Uint8Array): MockHashPasswordResult;
+export interface MockKeyPair {
+    publicKey: string;
+    privateKey: string;
+    algorithm: string;
+    kid: string;
+}
+export declare function mockGenerateKeyPair(algorithm?: string): MockKeyPair;
+export declare function mockEncrypt(key: string, plaintext: string | Uint8Array): string;
+export declare function mockDecrypt(key: string, ciphertext: string): Uint8Array;
+export declare function mockSign(privateKey: string, message: string | Uint8Array): string;
+export declare function mockVerify(_publicKey: string, message: string | Uint8Array, signature: string, privateKey: string): boolean;
+//# sourceMappingURL=mock.d.ts.map

package/dist/mock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock.d.ts","sourceRoot":"","sources":["../src/mock.ts"],"names":[],"mappings":"AAwDA,MAAM,WAAW,sBAAsB;IAErC,IAAI,EAAE,MAAM,CAAC;IAEb,IAAI,EAAE,MAAM,CAAC;IAEb,MAAM,EAAE;QAEN,CAAC,EAAE,MAAM,CAAC;QAEV,CAAC,EAAE,MAAM,CAAC;QAEV,CAAC,EAAE,MAAM,CAAC;KACX,CAAC;IAEF,SAAS,EAAE,eAAe,CAAC;IAE3B,GAAG,EAAE,MAAM,CAAC;CACb;AAkBD,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,GAAG,UAAU,GAC5B,sBAAsB,CAaxB;AAiBD,MAAM,WAAW,WAAW;IAE1B,SAAS,EAAE,MAAM,CAAC;IAElB,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;IAElB,GAAG,EAAE,MAAM,CAAC;CACb;AAiBD,wBAAgB,mBAAmB,CACjC,SAAS,GAAE,MAAkB,GAC5B,WAAW,CA+Bb;AAqBD,wBAAgB,WAAW,CACzB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,GAAG,UAAU,GAC7B,MAAM,CAIR;AAiBD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,CAIvE;AAuBD,wBAAgB,QAAQ,CACtB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GAAG,UAAU,GAC3B,MAAM,CAIR;AAsBD,wBAAgB,UAAU,CACxB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GAAG,UAAU,EAC5B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAGT"}

package/dist/mock.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mockHashPassword = mockHashPassword;
+exports.mockGenerateKeyPair = mockGenerateKeyPair;
+exports.mockEncrypt = mockEncrypt;
+exports.mockDecrypt = mockDecrypt;
+exports.mockSign = mockSign;
+exports.mockVerify = mockVerify;
+const keys_1 = require("./keys");
+function xorCipher(data, key) {
+    const out = new Uint8Array(data.length);
+    for (let i = 0; i < data.length; i++) {
+        out[i] = data[i] ^ key[i % key.length];
+    }
+    return out;
+}
+function toBytes(input) {
+    return input instanceof Uint8Array ? input : Buffer.from(input, "utf8");
+}
+function toHex(bytes) {
+    return Buffer.from(bytes).toString("hex");
+}
+function hexToBytes(hex) {
+    return Buffer.from(hex, "hex");
+}
+function mockHashPassword(password) {
+    const pw = toBytes(password);
+    const salt = hexToBytes("00".repeat(16));
+    const fakeHash = xorCipher(pw, salt);
+    const hashHex = toHex(fakeHash).padEnd(64, "0");
+    const saltHex = "00".repeat(16);
+    return {
+        hash: hashHex,
+        salt: saltHex,
+        params: { t: 1, m: 1024, p: 1 },
+        algorithm: "mock-argon2id",
+        phc: `$mock-argon2id$v=19$m=1024,t=1,p=1$${Buffer.from(salt).toString("base64")}$${Buffer.from(hexToBytes(hashHex)).toString("base64")}`,
+    };
+}
+function mockGenerateKeyPair(algorithm = "ed25519") {
+    switch (algorithm) {
+        case "ed25519":
+            return {
+                publicKey: keys_1.TEST_KEYS.ed25519.publicKey,
+                privateKey: keys_1.TEST_KEYS.ed25519.privateKey,
+                algorithm,
+                kid: "mock-ed25519-kid",
+            };
+        case "x25519":
+            return {
+                publicKey: keys_1.TEST_KEYS.x25519.publicKey,
+                privateKey: keys_1.TEST_KEYS.x25519.privateKey,
+                algorithm,
+                kid: "mock-x25519-kid",
+            };
+        case "p256":
+            return {
+                publicKey: keys_1.TEST_KEYS.p256.publicKey,
+                privateKey: keys_1.TEST_KEYS.p256.privateKey,
+                algorithm,
+                kid: "mock-p256-kid",
+            };
+        default:
+            return {
+                publicKey: "aa".repeat(32),
+                privateKey: "bb".repeat(32),
+                algorithm,
+                kid: `mock-${algorithm}-kid`,
+            };
+    }
+}
+function mockEncrypt(key, plaintext) {
+    const keyBytes = hexToBytes(key);
+    const ptBytes = toBytes(plaintext);
+    return toHex(xorCipher(ptBytes, keyBytes));
+}
+function mockDecrypt(key, ciphertext) {
+    const keyBytes = hexToBytes(key);
+    const ctBytes = hexToBytes(ciphertext);
+    return xorCipher(ctBytes, keyBytes);
+}
+function mockSign(privateKey, message) {
+    const keyBytes = hexToBytes(privateKey);
+    const msgBytes = toBytes(message);
+    return toHex(xorCipher(msgBytes, keyBytes));
+}
+function mockVerify(_publicKey, message, signature, privateKey) {
+    const expected = mockSign(privateKey, message);
+    return expected === signature;
+}
+//# sourceMappingURL=mock.js.map

package/package.json

@@ -0,0 +1,73 @@
+{
+  "name": "@sebastienrousseau/crypto-testing",
+  "version": "0.0.7",
+  "description": "Deterministic keys, fast mocks, and test fixtures for crypto-lib — make your CI/CD pipeline fast and reproducible.",
+  "author": "Sebastien Rousseau <sebastienrousseau@users.noreply.github.com>",
+  "license": "MIT OR Apache-2.0",
+  "homepage": "https://github.com/sebastienrousseau/crypto-service/tree/main/packages/crypto-testing",
+  "repository": {
+    "directory": "packages/crypto-testing",
+    "type": "git",
+    "url": "git@github.com:sebastienrousseau/crypto-service.git"
+  },
+  "bugs": {
+    "url": "https://github.com/sebastienrousseau/crypto-service/issues"
+  },
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "require": "./dist/index.js",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist/**/*.js",
+    "dist/**/*.d.ts",
+    "dist/**/*.d.ts.map"
+  ],
+  "dependencies": {
+    "@sebastienrousseau/crypto-lib": "0.0.7"
+  },
+  "devDependencies": {
+    "@sebastienrousseau/mocha-config": "^0.0.5",
+    "@types/chai": "^4.3.7",
+    "@types/chai-as-promised": "^8.0.2",
+    "@types/mocha": "^10.0.2",
+    "@types/node": "^26.4.1",
+    "c8": "^12.0.0",
+    "chai": "^4.5.0",
+    "chai-as-promised": "^7.1.2",
+    "mocha": "^10.8.2",
+    "rimraf": "^6.1.3",
+    "ts-node": "^10.9.2",
+    "typedoc": "^0.28.20",
+    "typescript": "~5.9.3"
+  },
+  "keywords": [
+    "crypto-testing",
+    "test-fixtures",
+    "deterministic-keys",
+    "mock-crypto",
+    "crypto-lib"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "private": false,
+  "scripts": {
+    "build": "tsc --build tsconfig.json",
+    "clean": "rimraf ./coverage ./dist ./docs",
+    "test": "c8 --check-coverage --lines 100 --branches 100 --functions 100 --reporter=lcov --reporter=text mocha --config=.mocharc.cjs",
+    "docs": "typedoc",
+    "lint": "eslint --ext .ts src __tests__",
+    "lint:fix": "eslint --cache --fix --ext .ts src __tests__",
+    "format": "prettier --write src/**/*.ts",
+    "format:check": "prettier --check \"src/**/*.ts\""
+  }
+}