fractal-pqc 0.7.0 → 0.7.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fractal-pqc",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Runnable reference for quantum-safe migration of a Bitcoin-style key: bind secp256k1/Taproot to ML-DSA-65 (FIPS-204), derive P2TR addresses, build+sign BIP-341 key-path spends (official-vector-verified), and broadcast on testnet. Real primitives, honest scope.",
   "type": "module",
   "license": "MIT",

package/src/mutations.mjs

@@ -47,7 +47,7 @@
  * is load-bearing, never that no sentence is missing.
  */
 
-import { mkdtempSync, cpSync, writeFileSync, readFileSync, rmSync } from "node:fs";
+import { mkdtempSync, cpSync, writeFileSync, readFileSync, rmSync, existsSync, symlinkSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -267,6 +267,36 @@ export const MUTATIONS = [
   },
 ];
 
+/**
+ * Make the dependencies reachable from the throwaway copy.
+ *
+ * This used to be `cpSync(join(PKG, "node_modules"), …)`, which worked in a development
+ * checkout and threw ENOENT for EVERY user who installed from npm — because npm HOISTS
+ * dependencies to the top-level `node_modules`, so the package directory has none of its
+ * own. `claims --mutate` is one of the three commands we ask auditors to run, and it had
+ * never once worked outside this repository. It was caught by installing the published
+ * tarball into an empty directory and running it, which is the only test that would have.
+ *
+ * We now walk up from the package looking for the `node_modules` that actually holds our
+ * dependencies, and link it. Linking rather than copying is also the honest choice: the
+ * mutation runs against the SAME dependency bytes the caller has installed, not a copy we
+ * made.
+ */
+function linkDependencies(work) {
+  let dir = PKG;
+  for (let i = 0; i < 8; i++) {
+    const candidate = join(dir, "node_modules");
+    if (existsSync(join(candidate, "@noble", "hashes"))) {
+      try { symlinkSync(candidate, join(work, "node_modules"), "dir"); return true; }
+      catch { try { cpSync(candidate, join(work, "node_modules"), { recursive: true, dereference: false }); return true; } catch { return false; } }
+    }
+    const up = dirname(dir);
+    if (up === dir) break;
+    dir = up;
+  }
+  return false;
+}
+
 /**
  * Apply every mutation to a throwaway copy and check the named claims die.
  * Returns a matrix an auditor can read without trusting us.
@@ -279,7 +309,9 @@ export function runMutations({ claimIds } = {}) {
       cpSync(join(PKG, dir), join(work, dir), { recursive: true });
     }
     cpSync(join(PKG, "package.json"), join(work, "package.json"));
-    cpSync(join(PKG, "node_modules"), join(work, "node_modules"), { recursive: true, dereference: false });
+    if (!linkDependencies(work)) {
+      throw new Error("could not locate the installed dependencies (@noble/*) to run mutations against");
+    }
 
     const ledger = () => {
       try {
@@ -368,7 +400,9 @@ export function runAttackAttribution() {
   try {
     for (const dir of ["src", "bin", "vectors"]) cpSync(join(PKG, dir), join(work, dir), { recursive: true });
     cpSync(join(PKG, "package.json"), join(work, "package.json"));
-    cpSync(join(PKG, "node_modules"), join(work, "node_modules"), { recursive: true, dereference: false });
+    if (!linkDependencies(work)) {
+      throw new Error("could not locate the installed dependencies (@noble/*) to run mutations against");
+    }
 
     const reg = join(work, "src", "claims-registry.mjs");
     const regSrc = readFileSync(reg, "utf8");