Consolidating frames code

[leeland-turnkey]

Consolidate Shared Code into shared/ Folder

Problem

There was significant code duplication between export-and-sign, import, and other frames. This led to:

• Maintenance overhead: Security patches and improvements needed to be applied in multiple places
• Inconsistent implementations: Subtle differences between frames could lead to bugs

Solution

Created a new shared/ folder containing common utilities used across all frames, following the recommendation to "unify the code between all frames by extracting shared code into reusable libraries."

Changes

Updated Frames to Use Shared Code

1. export-and-sign:

   • Updated turnkey-core.js to import from shared and keep frame-specific code (Ed25519, verifyEnclaveSignature using @turnkey/crypto)
   • Updated crypto-utils.js to re-export from shared
   • Updated webpack config to resolve @shared alias

2. import:

   • Updated turnkey-core.js to import from shared and keep frame-specific applySettings logic
   • Updated index.js and standalone.js to use shared HpkeEncrypt
   • Updated webpack config to resolve @shared alias

Added CI for Shared Folder

• Added shared to CI matrix for tests, linting, and formatting
• Shared code is now validated on every push/PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​babel/​preset-env@​7.28.5
	@​testing-library/​jest-dom@​6.9.1

View full report

[leeland-turnkey]

AI helped with this @andrewkmin

context: #112 (comment)

[andrewkmin]

Nonblocking, and not related to this PR but just some additional documentation suggestions: we could add to the verifyEnclaveSignature function signature in line ~44 or ~61:

// Read environment from meta tag (templated at deploy time), fall back to window variable (for testing)

-->

// Read environment from meta tag, fall back to window variable (for testing).
// Additional context: this iframe uses SRI (the browser verifies JS bundle hashes at load time).
// If we templated the environment variable directly in JS (like the shared module does), the
// `sed` replacement at deploy time would change the bundle content, invalidating the SRI hash
// and causing the browser to block the script. By reading from a meta tag, we can template
// the HTML without touching the JS bundle, preserving SRI integrity.