feat(pq-key-fingerprint/ts): phase 2 - implement fingerprint core logic (ENG-1761)

[eacet]

Summary

Package(s)

Languages

• TypeScript
• Rust

Checklist

• Tests pass for all modified packages
• Linting/formatting passes (biome check, cargo fmt)
• Both language implementations are consistent (or noted as follow-up)
• Package README updated if public API changed
• No unnecessary dependencies added

Related Issues

[eacet]

@codex review

[eacet]

• test(pq-key-fingerprint/ts): phase 4 - comprehensive test coverage (ENG-1763) #25
• docs(pq-key-fingerprint/ts): phase 3 - add package documentation (ENG-1762) #24
• feat(pq-key-fingerprint/ts): phase 2 - implement fingerprint core logic (ENG-1761) #23 👈 (View in Graphite)
• feat(pq-key-fingerprint/ts): phase 1 - rebuild source API surface (ENG-1760) #22
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Greptile Summary

This PR implements the Phase 2 core fingerprint logic for the pq-key-fingerprint TypeScript package, adding five public entry points (fingerprintPublicKey, fingerprintPublicKeyBytes, fingerprintSPKI, fingerprintPEM, fingerprintJWK) that delegate to pq-key-encoder for key parsing/validation and then compute a configurable WebCrypto digest over the raw public-key bytes.

• New fingerprint.ts: Clean implementation with a shared withErrorBoundary wrapper that translates all upstream pq-key-encoder errors into FingerprintError subtypes. WebCrypto buffer-offset handling is correct. Minor: fingerprintKeyData accepts KeyData and redundantly re-runs ensurePublicKeyData on the fingerprintPublicKey path (where the caller already validated the input).
• New contract.test.ts: Tests the error-translation contract for all five entry points. The expectTranslatedError helper has a structural bug — if an API unexpectedly succeeds, the sentinel error is caught by its own catch block, producing a misleading assertion failure rather than the intended diagnostic message.
• index.ts: Barrel updated correctly to export all new public functions.

Confidence Score: 4/5

• Safe to merge with a minor test-helper fix recommended before relying on the contract tests as regression guards.
• Core fingerprint logic is sound — WebCrypto usage, error translation, and input normalisation are all correct. The only actionable issues are a redundant validation call (style) and a test helper structural bug that could mask regressions. Neither affects production behaviour.
• packages/pq-key-fingerprint/ts/tests/contract.test.ts — the expectTranslatedError helper should be fixed to correctly surface "API did not throw" failures.

Important Files Changed

Filename	Overview
packages/pq-key-fingerprint/ts/src/fingerprint.ts	New file implementing the five public fingerprint entry points. Core logic is sound — correct WebCrypto usage, proper buffer-offset handling, and clean error-boundary pattern. Minor design concern: fingerprintKeyData accepts KeyData and calls ensurePublicKeyData internally, causing a redundant double-validation on the fingerprintPublicKey code path.
packages/pq-key-fingerprint/ts/tests/contract.test.ts	New contract test file verifying error-translation behaviour. The expectTranslatedError helper has a structural bug: if the API unexpectedly succeeds, the sentinel Error is caught by the same catch block, causing a misleading assertion failure instead of the intended message.
packages/pq-key-fingerprint/ts/src/index.ts	Public API barrel updated to export the five new fingerprint functions from fingerprint.ts. Straightforward and correct.

Sequence Diagram

sequenceDiagram
    participant C as Caller
    participant FPK as fingerprintPublicKey
    participant N as normalizePublicKeyInput
    participant E as ensurePublicKeyData
    participant FKD as fingerprintKeyData
    participant D as digestBytes
    participant WC as WebCrypto (subtle)

    C->>FPK: fingerprintPublicKey(input, options)
    FPK->>N: normalizePublicKeyInput(input)
    N->>E: ensurePublicKeyData(keyData)
    Note over E: assertKeyData (1st call)
    E-->>N: PublicKeyData
    N-->>FPK: PublicKeyData
    FPK->>FKD: fingerprintKeyData(keyData, options)
    FKD->>E: ensurePublicKeyData(keyData)
    Note over E: assertKeyData (redundant 2nd call)
    E-->>FKD: PublicKeyData
    FKD->>D: digestBytes(bytes, digest)
    D->>WC: subtle.digest(alg, buffer)
    WC-->>D: ArrayBuffer
    D-->>FKD: Uint8Array
    FKD-->>FPK: encodeFingerprint(result, encoding)
    FPK-->>C: FingerprintResult (string | Uint8Array)

Loading

_{Last reviewed commit: 41f1935}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 41f19352b3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[eacet]

Merge activity

• Mar 10, 4:45 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Mar 10, 4:46 PM UTC: Graphite rebased this pull request as part of a merge.
• Mar 10, 4:47 PM UTC: @eacet merged this pull request with Graphite.