build: import the stack-* crates, node bindings and Go module

.cargo-crap.toml

@@ -0,0 +1,23 @@
+# Configuration for `cargo crap` — the CRAP (Change Risk Anti-Patterns) metric.
+#
+# CRAP rewards complex code that is well tested and penalises complex code that
+# is not:
+#
+#     CRAP = CC^2 * (1 - coverage)^3 + CC      (CC = cyclomatic complexity)
+#
+# A simple or fully covered function scores roughly its complexity; a complex,
+# untested one scores into the hundreds. It surfaces exactly the kind of risky,
+# under-tested logic where a subtle mistake can hide (see CIP-3233 / #2036).
+#
+# Run it via `mise run crap:stack-auth` (generates coverage first, then scores).
+# Config discovery walks up from the working directory, so this single root file
+# applies anywhere in the workspace.
+
+# CRAP score above which a function is flagged for refactoring or more tests.
+# 30 is the long-standing Crap4J default: a CC-10 function needs ~42% coverage,
+# a CC-15 function ~59%, to fall below it.
+threshold = 30
+
+# Functions with complexity but no coverage data are scored as 0% covered
+# (worst case) rather than silently skipped — uninstrumented code is risk too.
+missing = "pessimistic"

.cargo/config.toml

@@ -0,0 +1,7 @@
+# Wasm target needs the `wasm_js` getrandom backend (used by deps that pull
+# `getrandom >= 0.3`, e.g. `rand 0.9+` via `vitaminc-random`). Without this
+# rustflag, those crates fail to compile on wasm32-unknown-unknown — the
+# stack-auth-wasm build (`languages/typescript/packages/stack-auth-wasm`).
+# See: https://docs.rs/getrandom/latest/getrandom/#opt-in-backends
+[target.wasm32-unknown-unknown]
+rustflags = ['--cfg', 'getrandom_backend="wasm_js"']

.cargo/mutants.toml

@@ -0,0 +1,81 @@
+# Configuration for cargo-mutants — mutation testing for the stack crates.
+#
+# Mutation testing rewrites small pieces of logic (flip a `<` to `<=`, replace
+# a body with `Default::default()`, drop an `&&` arm) and reruns the tests: a
+# mutant that survives is a line the suite does not actually pin down. CRAP
+# (`crap:*`) says which complex code is uncovered; this says which covered
+# code is not asserted on — in a crypto crate, the comparisons, length checks
+# and context bindings a test can execute without ever checking.
+#
+# CI runs this `--in-diff` as a per-PR gate (.github/workflows/mutants.yml):
+# only the lines a PR changes are mutated, so the gate trips when a PR adds
+# logic its tests do not exercise. A full per-crate sweep is
+# `mise run mutants:<crate>` (stack-auth ~15 min, stack-encrypt ~60 min on a
+# laptop with four jobs); `mise run mutants` runs every crate that has one.
+# Both read the settings below, so they stay in sync.
+
+# Build and test with every feature on, so feature-gated code (stack-encrypt's
+# `dynamic` module, the `http` transports) is compiled and exercised. Without
+# this a mutant there would "survive" only because the feature was off.
+additional_cargo_args = ["--all-features"]
+
+# nextest, as everywhere else in the suite. The filterset drops two things
+# from the per-mutant test command that are slow and pin no mutant:
+# stack-encrypt's trybuild UI suite (`binary(ui)`: it compiles the derive's
+# compile-fail cases in a scratch project, ~60s, and exercises no mutable
+# line) and stack-auth's wall-clock stress tests (real servers, real sleeps,
+# flaky under a slowed build). A filter naming something a package does not
+# have matches nothing, so one filter serves every package.
+test_tool = "nextest"
+additional_cargo_test_args = ["-E", "not binary(ui) & not test(stress_tests)"]
+
+# Skip the derive crate: its logic runs inside `#[proc_macro_derive]` entry
+# points at compile time, not in the instrumented test binary, so every
+# mutant there survives spuriously. Its behaviour is pinned by stack-encrypt's
+# `tests/derive.rs` and the trybuild UI suite instead.
+exclude_globs = ["packages/stack-encrypt-derive/**"]
+
+# Mutants no test binary can kill, by name. Every other survivor is a test to
+# write, not a line to add here. Two kinds qualify:
+#
+# - Unreachable: code compiled out of the native `--all-features` test build
+#   (wasm32-only impls, the no-`http` fallback, the non-test reqwest client).
+#   A mutant there builds and "survives" because nothing it touches is run.
+# - Equivalent: the replacement is the value the code already returns
+#   (`Some(())` for a `()` credential, `Map::new()` for `Default::default()`,
+#   a builder's `new()` for its `Default`), so no test can tell them apart.
+#
+# The regexes match the name `--list` prints, `path:line:col: replace …`.
+# Anchor on the replacement text, so an entry cannot swallow a reachable
+# sibling with the same function name. The wasm32 `TokenStoreFn`,
+# `AutoStrategy::detect_inner` and `Pending::into_future` entries also anchor
+# on the line because their names are identical to the native impl's.
+# If those lines move, a full sweep reports them again and the line numbers
+# here need moving with them.
+exclude_re = [
+  # stack-auth — unreachable under the native test build.
+  'stack-auth/src/transport\.rs:\d+:\d+: replace <impl std::fmt::Display for NoTransport>::fmt ',
+  'stack-auth/src/transport\.rs:\d+:\d+: replace <impl DynTransport for T>::send_dyn -> std::pin::Pin<Box<dyn Future<Output = Result<HttpResponse, RequestError>>\+\x27a>> ',
+  # Production http_client variants are cfg-disabled here; the test variant
+  # builds an unconfigured Client, equivalent to Client::default().
+  'stack-auth/src/transport\.rs:\d+:\d+: replace http_client -> reqwest::Client with Default::default\(\)$',
+  'stack-auth/src/auto_strategy\.rs:150:9: replace AutoStrategy::detect_inner -> Result<Self, AuthError> with Ok\(Default::default\(\)\)$',
+  'stack-auth/src/token_store\.rs:(258|266):9: replace <impl TokenStore for TokenStoreFn<L, S>>::(load|save)',
+  # stack-auth — equivalent.
+  'stack-auth/src/(access_key|oidc)_refresher\.rs:\d+:\d+: replace <impl Refresher for \w+(<P>)?>::try_credential -> Option<Self::Credential> with Some\(Default::default\(\)\)$',
+  'stack-auth/src/error\.rs:\d+:\d+: replace AuthErrorKind::payload -> serde_json::Map<String, serde_json::Value> with Default::default\(\)$',
+  # stack-encrypt — unreachable under the native test build (the wasm32
+  # variant; the native one returns a `FallbackKeyProvider`).
+  'stack-encrypt/src/cipher\.rs:\d+:\d+: replace client_key_provider -> EnvKeyProvider with Default::default\(\)$',
+  'stack-encrypt/src/target/pending\.rs:443:9: replace <impl IntoFuture for Pending<.*>>::into_future -> Self::IntoFuture with Default::default\(\)$',
+  # stack-encrypt — equivalent.
+  'stack-encrypt/src/cipher\.rs:\d+:\d+: replace StackCipher<FromEnv>::builder -> StackCipherBuilder with Default::default\(\)$',
+  'stack-encrypt/src/sem/mod\.rs:\d+:\d+: replace <impl MatchConfig for DefaultMatch>::options -> MatchOptions with Default::default\(\)$',
+  # Both unit-context conversions explicitly return Self::default().
+  'stack-encrypt/src/target/context\.rs:\d+:\d+: replace <impl From<\(\)> for (DeclaredContext|ExpectedContext<T>)>::from -> Self with Default::default\(\)$',
+]
+
+# Headroom over the measured baseline before a slow-but-correct mutant is
+# misreported as a timeout.
+timeout_multiplier = 5.0
+minimum_test_timeout = 90

.config/nextest.toml

@@ -0,0 +1,4 @@
+# Workflows set NEXTEST_PROFILE=ci.
+[profile.ci]
+# Do not cancel the test run on the first failure.
+fail-fast = false

.github/CODEOWNERS

@@ -13,3 +13,12 @@
 /pnpm-lock.yaml                         @cipherstash/developers
 /.npmrc                                 @cipherstash/developers
 /skills/stash-supply-chain-security/    @cipherstash/developers
+
+# The stack-* crates, their node bindings and the Go module, imported from
+# cipherstash-suite. stack-auth, stack-profile and @cipherstash/auth publish to
+# crates.io and npm.
+/packages/stack-*/                      @cipherstash/developers
+/languages/golang/                      @cipherstash/developers
+/languages/typescript/packages/auth/    @cipherstash/developers
+/languages/typescript/packages/profile/ @cipherstash/developers
+/languages/typescript/packages/stack-auth-wasm/ @cipherstash/developers

.github/dependabot.yml

@@ -212,6 +212,74 @@ updates:
         update-types:
           - version-update:semver-major
 
+  # ── Cargo (the root workspace — the stack-* crates) ─────────────
+  # The root workspace (the six stack-* crates and the three node binding
+  # crates) and the five detached workspaces beside it: the three cargo-fuzz
+  # crates and the two Go WASI guests. Each has its own Cargo.lock, and each
+  # is its own workspace root, so each is listed.
+  - package-ecosystem: cargo
+    directories:
+      - /
+      - /packages/stack-auth/fuzz
+      - /packages/stack-kms/fuzz
+      - /packages/stack-encrypt/fuzz
+      - /languages/golang/stackencrypt/guest
+      - /languages/golang/stackauth/guest
+    # Monthly, matching the other two cargo entries.
+    schedule:
+      interval: monthly
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 3
+    labels:
+      - dependencies
+      - supply-chain
+    commit-message:
+      prefix: "chore"
+      include: scope
+    groups:
+      cargo-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    ignore:
+      # Released from cipherstash-suite and pinned with exact `=` requirements
+      # in the root Cargo.toml and the guests: stack-auth's API carries their
+      # types, so they move in lockstep with the suite, by hand.
+      - dependency-name: "cts-common"
+      - dependency-name: "zerokms-protocol"
+      - dependency-name: "recipher"
+      - dependency-name: "cllw-ore"
+      # vitaminc is pinned at 0.5.0 across the crates and the guests; the
+      # guests' `FfiValue: Decrypt` bound fails if two versions resolve.
+      - dependency-name: "vitaminc*"
+      # Major bumps are reviewed and applied manually, not by Dependabot.
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major
+
+  # ── Go (languages/golang) ──────────────────────────────────────
+  - package-ecosystem: gomod
+    directory: /languages/golang
+    schedule:
+      interval: monthly
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 3
+    labels:
+      - dependencies
+      - supply-chain
+    commit-message:
+      prefix: "chore"
+      include: scope
+    ignore:
+      # Major bumps are reviewed and applied manually, not by Dependabot.
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major
+
   # ── GitHub Actions ─────────────────────────────────────────────
   - package-ecosystem: github-actions
     directory: /

.github/workflows/tests.yml

@@ -136,6 +136,15 @@ jobs:
       - name: Build the protect-ffi binding
         uses: ./.github/actions/build-ffi-binding
 
+      # `pnpm run test` below also runs the @cipherstash/auth and
+      # @cipherstash/profile vitest suites, which load the napi module. Their
+      # `test` scripts do not build it, so cargo stays off the default `test`
+      # path; this step builds it, as the protect-ffi step above does for
+      # `index.node`. Each `build:debug` writes its typings to the committed
+      # `native.d.ts`, so the build leaves the tree clean.
+      - name: Build the auth and profile node bindings
+        run: pnpm --filter @cipherstash/auth --filter @cipherstash/profile run build:debug
+
       - name: Type tests (stack)
         run: pnpm exec turbo run test:types --filter @cipherstash/stack
 
@@ -285,6 +294,13 @@ jobs:
       - name: Lint — no references to deleted package directories
         run: pnpm run lint:package-paths
 
+      # TEMPORARY — delete with the script in the arming PR (PR E) of the
+      # stack-* crates import. The seven @cipherstash/auth packages live here
+      # but still publish from cipherstash/cipherstash-suite, so a changeset
+      # naming one would bump a frozen package and block every release.
+      - name: Lint — no @cipherstash/auth changeset before the publishing cutover
+        run: pnpm run lint:auth-changeset
+
       # `eql-bindings` emits EQL payloads; `@cipherstash/eql` carries the SQL
       # that stores them. Both live here now and release at one lockstep
       # version. A registry pin on either lets them drift apart — it compiles,

.gitignore

@@ -91,3 +91,22 @@ sql/cipherstash-*.sql
 .cipherstash/
 
 notes/
+
+# Rust crates imported from cipherstash-suite (packages/stack-*).
+# cargo-fuzz: crash artifacts, coverage data, and the corpus that grows during
+# a campaign. Ignore the generated corpus entries but keep the hand-written seed
+# corpora (committed as `valid-*`) tracked. The fuzz crates' Cargo.lock files
+# are tracked here, unlike in the suite, so `--locked` and Dependabot see them.
+packages/*/fuzz/artifacts/
+packages/*/fuzz/coverage/
+packages/*/fuzz/corpus/*/*
+!packages/*/fuzz/corpus/*/valid-*
+# cargo-mutants output (`mise run mutants:<crate>` writes it to the cwd).
+mutants.out/
+
+# The Go module's embedded WASI guests: build outputs of `mise run
+# wasm:guest:build` and `mise run wasm:auth-guest:build`.
+languages/golang/stackencrypt/wasm/*.wasm
+languages/golang/stackauth/wasm/*.wasm
+languages/golang/stackencrypt/wasm/*.sha256
+languages/golang/stackauth/wasm/*.sha256