fix(core): stop bundling vitest into public entry points (#17)

* fix(core): stop bundling vitest into public entry points

`src/index.ts` re-exported the generic test helpers via
`export * as tests from "./tests/index.js"`. A re-exported namespace cannot be
tree-shaken, so the helpers and their top-level `import { expect } from "vitest"`
were bundled into every public entry (dist/index.js, dist/index.cjs,
dist/index.iife.js). Because vitest is only a devDependency, importing
`@frosts/core` — or any `@frosts/<curve>` that depends on it — crashed at module
load with ERR_MODULE_NOT_FOUND for consumers without vitest installed.

The test helpers are now published under a dedicated `@frosts/core/tests`
subpath instead of the main entry. The build uses code splitting so the subpath
shares the same core runtime chunks as the main entry, preserving the
`instanceof` checks in the helpers (avoiding a dual-package hazard). IIFE, which
cannot be split, is built separately for the public entry only.

Consumers of the generic test functions update their imports:

  -import { tests } from "@frosts/core";
  +import * as tests from "@frosts/core/tests";

Verified: public entries and shared chunks contain no vitest import; importing
`@frosts/core` and `@frosts/ed25519` succeeds in a sandbox without vitest; full
test suite and typecheck pass across all packages.

Fixes the published 0.2.2-alpha.1 / 0.2.2-alpha.3 crash reported on GitHub.

* chore(deps): update all dependencies to their latest versions

Bump dev tooling and runtime dependencies across the workspace:
- typescript 5.9 -> 6.0
- eslint 9 -> 10, @eslint/js 9 -> 10
- @types/node 25 -> 26
- tsdown 0.20 -> 0.22, typedoc 0.28.5 -> 0.28.19, vitest 4.0 -> 4.1
- @typescript-eslint/* 8.53 -> 8.61, eslint-config-turbo 2.7 -> 2.9
- @noble/curves & @noble/hashes 2.0 -> 2.2
- prettier, turbo and @changesets/cli to latest

Adjustments required by the upgrades:
- tsconfig: add the DOM lib (TextEncoder / Web Crypto globals are no longer
  provided as Node globals by @types/node 26); widen core's rootDir so
  TypeScript 6 accepts the interop test's cross-package source imports (TS6059).
- tsdown: migrate the deprecated `external` option to `deps.neverBundle`, and
  disable the ineffective-dynamic-import check in core (intentional pattern
  under code splitting).
- source: cast getRandomValues buffers to Uint8Array<ArrayBuffer> for the
  stricter lib.dom signature, attach `cause` to a re-thrown error, and drop
  type assertions now flagged as unnecessary by TS 6's improved inference.

format, lint, typecheck, build and tests all pass with no warnings.

* chore: release v0.2.2-alpha.4 and drop changesets

- Bump all packages and the workspace root to 0.2.2-alpha.4 via
  scripts/bump-version.ts.
- Add a CHANGELOG.md to every published package documenting alpha.4 (the
  @frosts/core vitest-at-import fix and the dependency refresh), and include
  CHANGELOG.md in each package's published `files`.
- Remove changesets, which the project does not use for versioning (versions
  are managed by scripts/bump-version.ts): delete the .changeset directory and
  the @changesets/cli devDependency, and replace the `changeset publish` step
  in the release workflow with a direct `npm publish --provenance` over the
  public packages.
- Update the README version and TypeScript badges (0.2.2-alpha.4, TS 6.0).

* ci(links): ignore bot-blocked npm and IACR links in markdown link check

The npm package pages (npmjs.com) and IACR ePrint archive (eprint.iacr.org)
return HTTP 403 to the link checker's automated requests even though the links
are valid. Add a markdown-link-check config that ignores those two hosts and
wire it into the Link Checker workflow via `config-file`.

Author: leonardocustodio

.changeset/README.md

@@ -0,0 +1,10 @@
+{
+  "ignorePatterns": [
+    {
+      "pattern": "^https?://(www\\.)?npmjs\\.com/"
+    },
+    {
+      "pattern": "^https?://eprint\\.iacr\\.org/"
+    }
+  ]
+}

.changeset/config.json

@@ -17,3 +17,4 @@ jobs:
         uses: gaurav-nelson/github-action-markdown-link-check@v1
         with:
           use-quiet-mode: "yes"
+          config-file: ".github/markdown-link-check-config.json"

.changeset/pre.json

@@ -59,10 +59,16 @@ jobs:
         run: bun run scripts/replace-workspace-protocols.ts
 
       - name: Publish to NPM
-        run: bun changeset publish --provenance
+        run: |
+          for PKG in packages/*; do
+            if [ -f "$PKG/package.json" ]; then
+              echo "Publishing $PKG ..."
+              (cd "$PKG" && npm publish --provenance --access public --tag alpha)
+            fi
+          done
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
   tag:
     name: Add NPM Tag (${{ matrix.tag }})

.github/markdown-link-check-config.json

@@ -1,7 +1,7 @@
 # frosTS - FROST for TypeScript
 
-[![Version](https://img.shields.io/badge/version-0.2.2--alpha.3-green)](https://github.com/leonardocustodio/bcts/releases)
-[![TypeScript](https://img.shields.io/badge/TypeScript-5.9-blue)](https://www.typescriptlang.org/)
+[![Version](https://img.shields.io/badge/version-0.2.2--alpha.4-green)](https://github.com/leonardocustodio/bcts/releases)
+[![TypeScript](https://img.shields.io/badge/TypeScript-6.0-blue)](https://www.typescriptlang.org/)
 [![Monorepo](https://img.shields.io/badge/Monorepo-Turborepo-blueviolet)](https://turbo.build/)
 [![Package Manager](https://img.shields.io/badge/Package%20Manager-Bun-FFD700)](https://bun.sh/)
 [![RFC 9591](https://img.shields.io/badge/RFC-9591-informational)](https://datatracker.ietf.org/doc/rfc9591/)

.github/workflows/links.yml

@@ -1,6 +1,6 @@
 {
   "name": "frosts",
-  "version": "0.2.2-alpha.3",
+  "version": "0.2.2-alpha.4",
   "private": true,
   "description": "TypeScript implementation of FROST (Flexible Round-Optimized Schnorr Threshold) signatures for threshold cryptography",
   "author": "Leonardo Custodio <leonardo.custodio@parity.io> (https://github.com/leonardocustodio)",
@@ -41,10 +41,9 @@
     "bump-version": "bun run scripts/bump-version.ts"
   },
   "devDependencies": {
-    "@changesets/cli": "^2.29.8",
-    "prettier": "^3.8.1",
-    "turbo": "^2.7.6",
-    "typescript": "^5.9.3"
+    "prettier": "^3.8.4",
+    "turbo": "^2.9.18",
+    "typescript": "^6.0.3"
   },
   "packageManager": "bun@1.3.6",
   "workspaces": [

.github/workflows/release.yml

@@ -0,0 +1,14 @@
+# @frosts/core
+
+## 0.2.2-alpha.4
+
+### Patch Changes
+
+- Fixed `@frosts/core` crashing at import time for consumers that do not have `vitest` installed. The generic, parameterized test helpers — and their top-level `vitest` import — are no longer bundled into the public entry points (`dist/index.js`, `dist/index.cjs`, `dist/index.iife.js`). They are now published under the dedicated `@frosts/core/tests` subpath instead. Consumers of the helpers should update their imports:
+
+  ```diff
+  -import { tests } from "@frosts/core";
+  +import * as tests from "@frosts/core/tests";
+  ```
+
+- Updated all dependencies to their latest versions (TypeScript 6, ESLint 10, tsdown 0.22, Vitest 4.1, typedoc 0.28.19, @types/node 26).

README.md

@@ -1,6 +1,6 @@
 {
   "name": "@frosts/core",
-  "version": "0.2.2-alpha.3",
+  "version": "0.2.2-alpha.4",
   "type": "module",
   "description": "Core types and traits for FROST (Flexible Round-Optimized Schnorr Threshold) signatures",
   "license": "MIT",
@@ -24,12 +24,20 @@
       "import": "./dist/index.js",
       "require": "./dist/index.cjs",
       "default": "./dist/index.js"
-    }
+    },
+    "./tests": {
+      "types": "./dist/tests/index.d.ts",
+      "import": "./dist/tests/index.js",
+      "require": "./dist/tests/index.cjs",
+      "default": "./dist/tests/index.js"
+    },
+    "./package.json": "./package.json"
   },
   "files": [
     "dist",
     "src",
-    "README.md"
+    "README.md",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "build": "tsdown",
@@ -56,16 +64,16 @@
   },
   "dependencies": {},
   "devDependencies": {
-    "@eslint/js": "^9.39.2",
+    "@eslint/js": "^10.0.1",
     "@frosts/eslint": "workspace:*",
     "@frosts/tsconfig": "workspace:*",
-    "@types/node": "^25.0.10",
-    "eslint": "^9.39.2",
-    "fast-check": "^4.5.3",
-    "prettier": "^3.8.1",
-    "tsdown": "^0.20.1",
-    "typedoc": "^0.28.5",
-    "typescript": "^5.9.3",
-    "vitest": "^4.0.18"
+    "@types/node": "^26.0.0",
+    "eslint": "^10.5.0",
+    "fast-check": "^4.8.0",
+    "prettier": "^3.8.4",
+    "tsdown": "^0.22.3",
+    "typedoc": "^0.28.19",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.9"
   }
 }