Repository navigation
stack-encrypt conformance: add TypeScript runner and public SDK mapping tests #1479
Description
Background
Stack Encrypt (packages/stack-encrypt) is the Rust engine that every CipherStash language SDK runs on. The Rust crate and the Go SDK must write and read the same bytes. The Go SDK runs the same engine as a WASI guest, compiled to WebAssembly. Python and TypeScript SDKs are coming.
The conformance corpus in conformance/stack-encrypt/ is a shared set of test cases that every language runs. It makes all SDKs agree on what each declaration and operation means.
The TypeScript SDK will be a new major version of @cipherstash/stack built on Stack Encrypt (#1065). Its runner must use the same corpus and frozen fixtures as Rust and Go.
Proposal
- Build on the SDK from
@cipherstash/stackruns a second encryption engine (protect-ffi) — new major built on stack-encrypt (umbrella) #1065. Use its real public API and backend. Do not assume it uses Go's WASI model. - Read the shared cases without copying their expected results. Declare the supported profiles and capabilities.
- Test how TypeScript values map to engine values: number ranges, bigint ranges,
undefined,null, bytes, and timestamps. Refuse a conversion that loses data. - If the SDK has a native backend and a WASM backend, run the cases on both, each with its own lifecycle evidence.
- Join fresh exchange (stack-encrypt conformance: expand fresh cross-language artifact exchange #1478) and CI. A missing required case or backend fails. It never counts as a skip.
The SDK must exist first. This issue is in milestone 4 so it is visible. Issue #1490 decides whether TypeScript blocks the Rust release.
Plans: the Stack Encrypt API plan and the conformance roadmap.
Activity