@forgedevv/core 0.3.0 → 0.3.1

package/CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to `@forge/core`. Versions follow semantic versioning. Consumers (the
 launchpad template, the signer, the web app) pin an exact version, never a range.
 
+## 0.3.1 — 2026-10-17
+
+### Fixed
+
+- Client sites failed to build with 0.3.0 (`node:crypto` in `jupiter-referral.js` and
+  `meteora-referral.js`, refused by the Next.js browser bundle). Both now hash with
+  `@noble/hashes` (new exact dependency 1.8.0, already used by `@solana/web3.js`); the
+  discriminators and derived addresses are unchanged. A test refuses any Node built-in
+  import in the package sources.
+
 ## 0.3.0 — 2026-10-17
 
 Changes after 0.2.0. Publish `@forgedevv/shared` 0.3.0 with it (new kill switch `revenue_paused` in `FlagKey`).

package/dist/jupiter-referral.js

@@ -37,7 +37,7 @@
  * project with the revenue wallet as partner, and the v2 collection accounts of the currencies
  * Jupiter collects in. Only the payer signs; the program facts are listed there.
  */
-import { createHash } from 'node:crypto';
+import { sha256 } from '@noble/hashes/sha2';
 import { ASSOCIATED_TOKEN_PROGRAM_ID, TOKEN_2022_PROGRAM_ID, TOKEN_PROGRAM_ID, createAssociatedTokenAccountIdempotentInstruction, getAssociatedTokenAddressSync, unpackAccount, } from '@solana/spl-token';
 import { PublicKey, SystemProgram, Transaction, TransactionInstruction, } from '@solana/web3.js';
 import { PaymentError, assertCluster } from './payments.js';
@@ -55,7 +55,7 @@ export const JUPITER_REFERRAL_PROGRAM_ID = new PublicKey('REFER4ZgmyYx9c6He5XfaT
  */
 export const JUPITER_ULTRA_REFERRAL_PROJECT = new PublicKey('DkiqsTrw1u1bYFumumC7sCG2S8K25qc2vemJFHyW2wJc');
 function anchorDiscriminator(name) {
-    return createHash('sha256').update(name).digest().subarray(0, 8);
+    return Buffer.from(sha256(new TextEncoder().encode(name))).subarray(0, 8);
 }
 export const JUPITER_REFERRAL_ACCOUNT_DISCRIMINATOR = anchorDiscriminator('account:ReferralAccount');
 export const JUPITER_PROJECT_DISCRIMINATOR = anchorDiscriminator('account:Project');

package/dist/meteora-referral.js

@@ -18,7 +18,7 @@
  * network call is the optional `readMeteoraReferralAccount`. Any cluster: a WSOL token account
  * exists on devnet too (the devnet proof of the revenue job uses one).
  */
-import { createHash } from 'node:crypto';
+import { sha256 } from '@noble/hashes/sha2';
 import { ACCOUNT_SIZE, NATIVE_MINT, TOKEN_PROGRAM_ID, getAssociatedTokenAddressSync, unpackAccount, } from '@solana/spl-token';
 import { PublicKey, SystemProgram, Transaction, TransactionInstruction, } from '@solana/web3.js';
 import { priorityFeeInstructions } from './priority-fee.js';
@@ -70,11 +70,7 @@ export function assertMeteoraReferralSeed(seed) {
  */
 export function deriveMeteoraReferralAccount(payer, seed = METEORA_REFERRAL_ACCOUNT_SEED) {
     assertMeteoraReferralSeed(seed);
-    const digest = createHash('sha256')
-        .update(payer.toBuffer())
-        .update(Buffer.from(seed, 'utf8'))
-        .update(TOKEN_PROGRAM_ID.toBuffer())
-        .digest();
+    const digest = sha256(Buffer.concat([payer.toBuffer(), Buffer.from(seed, 'utf8'), TOKEN_PROGRAM_ID.toBuffer()]));
     return new PublicKey(digest);
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgedevv/core",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "FORGE transaction core: Meteora Dynamic Bonding Curve configs, pools, swaps, claims and on-chain checks. Published on npm as @forgedevv/core.",
   "license": "UNLICENSED",
   "repository": {
@@ -47,9 +47,10 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@forge/shared": "npm:@forgedevv/shared@0.3.0",
+    "@forge/shared": "npm:@forgedevv/shared@0.3.1",
     "@meteora-ag/cp-amm-sdk": "1.5.1",
     "@meteora-ag/dynamic-bonding-curve-sdk": "1.5.13",
+    "@noble/hashes": "1.8.0",
     "@solana/spl-token": "0.4.15",
     "@solana/web3.js": "1.99.0",
     "bn.js": "5.2.5"