@oxy.so/core 1.18.1 → 3.0.0

package/src/crypto/__tests__/keyManager.test.ts

@@ -1,329 +0,0 @@
-/**
- * Tests for KeyManager safety invariants.
- *
- * These tests pin down the no-clobber guarantees that protect users from
- * permanent account loss. Every scenario below corresponds to a real bug
- * that COULD silently destroy an account's only copy of the private key:
- *
- *   1. createIdentity() must refuse to overwrite an existing identity
- *      unless { overwrite: true } is passed.
- *   2. importKeyPair() must refuse to clobber a DIFFERENT existing identity.
- *   3. importKeyPair() with the SAME phrase should be idempotent.
- *   4. After createIdentity(), hasIdentity() must report true AND
- *      verifyIdentityIntegrity() must succeed AND a backup must exist.
- *   5. RecoveryPhraseService must be a function (same phrase always
- *      produces the same public key).
- *   6. RecoveryPhraseService round-trip: derive phrase → restore phrase
- *      must yield the exact same public key.
- *   7. restoreIdentityFromBackup() must refuse to overwrite a verifying
- *      primary, and must refuse to switch the user to a different
- *      identity when the backup public key doesn't match the (broken)
- *      primary public key.
- */
-
-import { setPlatformOS } from '../../utils/platform';
-
-// Mock expo-secure-store BEFORE importing KeyManager so the lazy import
-// inside keyManager picks up our in-memory implementation. The shared mock keys
-// entries by `(keychainService ?? 'default') + ' ' + key` so the v2 slot layout
-// (primary service `oxy_identity`, backup service `oxy_identity_backup`) is
-// modeled faithfully.
-jest.mock(
-  'expo-secure-store',
-  () => {
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const { createSecureStoreMock } = require('./identityMocks');
-    return createSecureStoreMock();
-  },
-  { virtual: true },
-);
-
-jest.mock(
-  'expo-crypto',
-  () => ({
-    __esModule: true,
-    getRandomBytes: (length: number) => {
-      // Deterministic-but-distinct random for tests
-      const out = new Uint8Array(length);
-      for (let i = 0; i < length; i++) {
-        out[i] = (Math.random() * 256) & 0xff;
-      }
-      return out;
-    },
-    digestStringAsync: async () => '0'.repeat(64),
-    CryptoDigestAlgorithm: { SHA256: 'SHA-256' },
-  }),
-  { virtual: true },
-);
-
-// Production code routes platform-specific module loads through
-// `@oxy.so/protocol`'s `platform/crypto`, which ships in two physical variants
-// on disk (`crypto.ts` / `crypto.native.ts`) selected by the consumer's
-// bundler. Jest runs on Node — it picks the default variant, which references
-// Node's built-in `crypto`, not `expo-*`. For the test suite to exercise the
-// RN code paths, we override only the platform loaders to delegate to the
-// virtual `expo-*` modules registered above, keeping every other protocol
-// export (canonical bytes, signing, the platform predicates) real. AsyncStorage
-// is a real in-memory map so the identity marker + advisory migration flag work.
-jest.mock('@oxy.so/protocol', () => {
-  const actual = jest.requireActual('@oxy.so/protocol');
-  // eslint-disable-next-line @typescript-eslint/no-require-imports
-  const { createAsyncStorageMock } = require('./identityMocks');
-  const asyncStorage = createAsyncStorageMock();
-  return {
-    __esModule: true,
-    ...actual,
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    loadExpoCrypto: async () => require('expo-crypto'),
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    loadSecureStore: async () => require('expo-secure-store'),
-    loadAsyncStorage: async () => ({ default: asyncStorage }),
-    loadSharedIdentityBridge: async () => null,
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    loadNodeCrypto: async () => require('crypto'),
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    getRandomBytesRN: (n: number) => require('expo-crypto').getRandomBytes(n),
-  };
-});
-
-// v2 slot key names + keychain services (must match keyManager.ts).
-const PRIMARY_SVC = 'oxy_identity';
-const BACKUP_SVC = 'oxy_identity_backup';
-const V2_PRIV = 'oxy_identity_private_key_v2';
-const V2_PUB = 'oxy_identity_public_key_v2';
-const V2_BPRIV = 'oxy_identity_backup_private_key_v2';
-const V2_BPUB = 'oxy_identity_backup_public_key_v2';
-const V2_BTS = 'oxy_identity_backup_timestamp_v2';
-
-interface SecureStoreTestHandle {
-  __resetStore__: () => void;
-  __getRaw__: (key: string, service?: string) => string | null;
-  __setRaw__: (key: string, value: string, service?: string) => void;
-  __deleteRaw__: (key: string, service?: string) => void;
-}
-
-describe('KeyManager safety invariants', () => {
-  let KeyManager: typeof import('../keyManager').KeyManager;
-  let IdentityAlreadyExistsError: typeof import('../keyManager').IdentityAlreadyExistsError;
-  let RecoveryPhraseService: typeof import('../recoveryPhrase').RecoveryPhraseService;
-
-  beforeAll(() => {
-    // KeyManager refuses to operate on 'web'; pretend we're on iOS for tests.
-    setPlatformOS('ios');
-    // navigator.product is checked by some helpers; set it for RN-detection.
-    (globalThis as any).navigator = { product: 'ReactNative' };
-  });
-
-  beforeEach(async () => {
-    jest.resetModules();
-    setPlatformOS('ios');
-    const secureStore = (await import('expo-secure-store' as string)) as unknown as {
-      __resetStore__: () => void;
-    };
-    secureStore.__resetStore__();
-
-    const km = await import('../keyManager');
-    KeyManager = km.KeyManager;
-    IdentityAlreadyExistsError = km.IdentityAlreadyExistsError;
-    resetCaches();
-
-    const rp = await import('../recoveryPhrase');
-    RecoveryPhraseService = rp.RecoveryPhraseService;
-  });
-
-  const resetCaches = () => {
-    const km = KeyManager as unknown as {
-      cachedPublicKey: unknown;
-      cachedHasIdentity: unknown;
-      cachedPublicKeyResolved: unknown;
-    };
-    km.cachedPublicKey = null;
-    km.cachedHasIdentity = null;
-    km.cachedPublicKeyResolved = false;
-  };
-
-  describe('createIdentity', () => {
-    it('persists a complete identity with backup on first call', async () => {
-      const publicKey = await KeyManager.createIdentity();
-      expect(publicKey).toMatch(/^[0-9a-f]+$/i);
-
-      expect(await KeyManager.hasIdentity()).toBe(true);
-      expect(await KeyManager.verifyIdentityIntegrity()).toBe(true);
-      // Backup was written to the isolated v2 backup slot as part of the atomic persist
-      const store = (await import('expo-secure-store' as string)) as unknown as SecureStoreTestHandle;
-      expect(store.__getRaw__(V2_BPRIV, BACKUP_SVC)).toBeTruthy();
-      expect(store.__getRaw__(V2_BPUB, BACKUP_SVC)).toBeTruthy();
-      expect(store.__getRaw__(V2_BTS, BACKUP_SVC)).toBeTruthy();
-    });
-
-    it('refuses to overwrite an existing identity without explicit consent', async () => {
-      const firstPublicKey = await KeyManager.createIdentity();
-      await expect(KeyManager.createIdentity()).rejects.toBeInstanceOf(IdentityAlreadyExistsError);
-      // Original identity is unchanged
-      expect(await KeyManager.getPublicKey()).toBe(firstPublicKey);
-    });
-
-    it('allows overwrite when explicitly requested', async () => {
-      const firstPublicKey = await KeyManager.createIdentity();
-      const secondPublicKey = await KeyManager.createIdentity({ overwrite: true });
-      expect(secondPublicKey).not.toBe(firstPublicKey);
-      expect(await KeyManager.getPublicKey()).toBe(secondPublicKey);
-    });
-  });
-
-  describe('importKeyPair', () => {
-    it('refuses to clobber a DIFFERENT existing identity', async () => {
-      await KeyManager.createIdentity();
-      // Generate a separate identity to attempt importing
-      const otherPrivate = (await KeyManager.generateKeyPair()).privateKey;
-      await expect(KeyManager.importKeyPair(otherPrivate)).rejects.toBeInstanceOf(
-        IdentityAlreadyExistsError,
-      );
-    });
-
-    it('is a no-op refresh when importing the SAME identity', async () => {
-      const firstPublic = await KeyManager.createIdentity();
-      const currentPrivate = await KeyManager.getPrivateKey();
-      if (!currentPrivate) throw new Error('expected private key');
-      const reimported = await KeyManager.importKeyPair(currentPrivate);
-      expect(reimported).toBe(firstPublic);
-      expect(await KeyManager.getPublicKey()).toBe(firstPublic);
-    });
-
-    it('rejects invalid private keys', async () => {
-      await expect(KeyManager.importKeyPair('not-hex')).rejects.toThrow(/Invalid private key/);
-    });
-  });
-
-  describe('hasIdentity', () => {
-    it('returns false when no identity is stored', async () => {
-      expect(await KeyManager.hasIdentity()).toBe(false);
-    });
-
-    it('returns false when only the private key was written (partial state)', async () => {
-      const store = (await import('expo-secure-store' as string)) as unknown as SecureStoreTestHandle;
-      // Simulate a half-written identity: private without public
-      store.__setRaw__(V2_PRIV, 'a'.repeat(64), PRIMARY_SVC);
-      // Invalidate cache so the next call re-reads
-      resetCaches();
-      expect(await KeyManager.hasIdentity()).toBe(false);
-    });
-
-    it('returns false when the stored public key does not derive from the private key', async () => {
-      await KeyManager.createIdentity();
-      const store = (await import('expo-secure-store' as string)) as unknown as SecureStoreTestHandle;
-      // Tamper with the stored public key
-      store.__setRaw__(V2_PUB, '04' + 'b'.repeat(128), PRIMARY_SVC);
-      resetCaches();
-      expect(await KeyManager.hasIdentity()).toBe(false);
-    });
-  });
-
-  describe('verifyIdentityIntegrity', () => {
-    it('returns true for a fresh identity', async () => {
-      await KeyManager.createIdentity();
-      expect(await KeyManager.verifyIdentityIntegrity()).toBe(true);
-    });
-
-    it('returns false when the stored keys do not match', async () => {
-      await KeyManager.createIdentity();
-      const store = (await import('expo-secure-store' as string)) as unknown as SecureStoreTestHandle;
-      store.__setRaw__(V2_PUB, '04' + 'c'.repeat(128), PRIMARY_SVC);
-      resetCaches();
-      expect(await KeyManager.verifyIdentityIntegrity()).toBe(false);
-    });
-  });
-
-  describe('restoreIdentityFromBackup', () => {
-    it('does NOT overwrite a verifying primary', async () => {
-      const firstPublic = await KeyManager.createIdentity();
-      const restored = await KeyManager.restoreIdentityFromBackup();
-      expect(restored).toBe(false);
-      // Primary unchanged
-      expect(await KeyManager.getPublicKey()).toBe(firstPublic);
-    });
-
-    it('refuses to restore if the backup public key does not match a still-present (broken) primary', async () => {
-      await KeyManager.createIdentity();
-      const store = (await import('expo-secure-store' as string)) as unknown as SecureStoreTestHandle;
-      // Corrupt the primary public key (so integrity fails), but leave the
-      // broken primary in place. The backup will not match.
-      store.__setRaw__(V2_PUB, '04' + 'd'.repeat(128), PRIMARY_SVC);
-      // Tamper with the backup too — write a backup from a completely
-      // different identity.
-      const otherPair = await KeyManager.generateKeyPair();
-      store.__setRaw__(V2_BPRIV, otherPair.privateKey, BACKUP_SVC);
-      store.__setRaw__(V2_BPUB, otherPair.publicKey, BACKUP_SVC);
-      resetCaches();
-
-      const restored = await KeyManager.restoreIdentityFromBackup();
-      expect(restored).toBe(false);
-      // The (corrupted) primary public key should be unchanged, not the
-      // attacker-backup public key.
-      expect(store.__getRaw__(V2_PUB, PRIMARY_SVC)).not.toBe(otherPair.publicKey);
-    });
-
-    it('restores a missing primary from a valid backup', async () => {
-      const original = await KeyManager.createIdentity();
-      const store = (await import('expo-secure-store' as string)) as unknown as SecureStoreTestHandle;
-      // Wipe primary only
-      store.__deleteRaw__(V2_PRIV, PRIMARY_SVC);
-      store.__deleteRaw__(V2_PUB, PRIMARY_SVC);
-      resetCaches();
-
-      const restored = await KeyManager.restoreIdentityFromBackup();
-      expect(restored).toBe(true);
-      expect(await KeyManager.getPublicKey()).toBe(original);
-      expect(await KeyManager.verifyIdentityIntegrity()).toBe(true);
-    });
-  });
-
-  describe('RecoveryPhraseService round-trip determinism', () => {
-    it('always derives the SAME public key from the same phrase', async () => {
-      const result = await RecoveryPhraseService.generateIdentityWithRecovery();
-      const phrase = result.phrase;
-      const firstPublicKey = result.publicKey;
-
-      // Restore on a "clean device" — wipe and re-import via phrase
-      const store = (await import('expo-secure-store' as string)) as unknown as {
-        __resetStore__: () => void;
-      };
-      store.__resetStore__();
-      (KeyManager as unknown as { cachedPublicKey: unknown; cachedHasIdentity: unknown }).cachedPublicKey = null;
-      (KeyManager as unknown as { cachedPublicKey: unknown; cachedHasIdentity: unknown }).cachedHasIdentity = null;
-
-      const restoredPublicKey = await RecoveryPhraseService.restoreFromPhrase(phrase);
-      expect(restoredPublicKey).toBe(firstPublicKey);
-    });
-
-    it('derivePublicKeyFromPhrase matches the result of restoreFromPhrase', async () => {
-      const { phrase, publicKey } = await RecoveryPhraseService.generateIdentityWithRecovery();
-      const derived = await RecoveryPhraseService.derivePublicKeyFromPhrase(phrase);
-      expect(derived).toBe(publicKey);
-    });
-
-    it('refuses to overwrite an existing different identity during restore', async () => {
-      const a = await RecoveryPhraseService.generateIdentityWithRecovery();
-      // Reset cache but keep the on-device identity
-      (KeyManager as unknown as { cachedPublicKey: unknown; cachedHasIdentity: unknown }).cachedPublicKey = null;
-      (KeyManager as unknown as { cachedPublicKey: unknown; cachedHasIdentity: unknown }).cachedHasIdentity = null;
-
-      // Manually generate a different phrase
-      const { generateMnemonic } = await import('@scure/bip39');
-      const { wordlist } = await import('@scure/bip39/wordlists/english');
-      const otherPhrase = generateMnemonic(wordlist, 128);
-      // Sanity check phrases are different
-      expect(otherPhrase).not.toBe(a.phrase);
-
-      await expect(RecoveryPhraseService.restoreFromPhrase(otherPhrase)).rejects.toBeInstanceOf(
-        IdentityAlreadyExistsError,
-      );
-    });
-
-    it('rejects invalid phrases', async () => {
-      await expect(
-        RecoveryPhraseService.restoreFromPhrase('not a real phrase at all'),
-      ).rejects.toThrow(/Invalid recovery phrase/);
-    });
-  });
-});

package/src/crypto/__tests__/polyfill.test.ts

@@ -1,109 +0,0 @@
-/**
- * Crypto polyfill — `getRandomValues` install + platform routing.
- *
- * Regression coverage for the latent Node crash: when a Node runtime ships
- * WITHOUT a global WebCrypto (Node 18 script entrypoints, some embedded hosts),
- * the installed `getRandomValues` shim must be backed by `node:crypto` and MUST
- * NOT fall through to `@oxy.so/protocol`'s RN-only `getRandomBytesRN` stub (which
- * throws `Tried to load 'expo-crypto...' outside React Native`).
- */
-
-// Controllable stand-ins for `@oxy.so/protocol`'s platform predicates. Names are
-// `mock`-prefixed so the (hoisted) `jest.mock` factory may reference them.
-const mockGetRandomBytesRN = jest.fn<Uint8Array, [number]>();
-const mockState = { isNodeJS: true };
-
-jest.mock('@oxy.so/protocol/random', () => ({
-  isNodeJS: () => mockState.isNodeJS,
-  getRandomBytesRN: (byteCount: number) => mockGetRandomBytesRN(byteCount),
-}));
-
-type CryptoLike = {
-  getRandomValues: <T extends ArrayBufferView>(array: T) => T;
-};
-
-const ORIGINAL_CRYPTO_DESCRIPTOR = Object.getOwnPropertyDescriptor(globalThis, 'crypto');
-
-/**
- * Re-run the polyfill module with NO host `globalThis.crypto`, returning the
- * `getRandomValues` shim it installs. Restores the real global afterwards so
- * the manipulation never leaks into other tests.
- */
-function installShimWithoutHostCrypto(): CryptoLike {
-  Object.defineProperty(globalThis, 'crypto', {
-    value: undefined,
-    configurable: true,
-    writable: true,
-  });
-  try {
-    jest.isolateModules(() => {
-      require('../polyfill');
-    });
-    const installed = (globalThis as { crypto?: CryptoLike }).crypto;
-    if (!installed || typeof installed.getRandomValues !== 'function') {
-      throw new Error('polyfill did not install a getRandomValues shim');
-    }
-    return installed;
-  } finally {
-    Object.defineProperty(
-      globalThis,
-      'crypto',
-      ORIGINAL_CRYPTO_DESCRIPTOR ?? { value: undefined, configurable: true, writable: true },
-    );
-  }
-}
-
-beforeEach(() => {
-  mockGetRandomBytesRN.mockReset();
-  mockState.isNodeJS = true;
-});
-
-describe('crypto polyfill getRandomValues', () => {
-  it('on Node without global WebCrypto, fills from node:crypto and never calls the RN stub', () => {
-    mockState.isNodeJS = true;
-    // If the shim ever fell through to the RN path on Node, this would throw —
-    // exactly the latent crash we are guarding against.
-    mockGetRandomBytesRN.mockImplementation(() => {
-      throw new Error('RN getRandomBytesRN must not be called on Node');
-    });
-
-    const shim = installShimWithoutHostCrypto();
-    const array = new Uint8Array(16);
-
-    expect(() => shim.getRandomValues(array)).not.toThrow();
-    // Backed by a real CSPRNG: all-zero output is cryptographically impossible.
-    expect(array.some((byte) => byte !== 0)).toBe(true);
-    expect(mockGetRandomBytesRN).not.toHaveBeenCalled();
-  });
-
-  it('on Node, routes a non-integer view (DataView) through randomFillSync', () => {
-    mockState.isNodeJS = true;
-    mockGetRandomBytesRN.mockImplementation(() => {
-      throw new Error('RN getRandomBytesRN must not be called on Node');
-    });
-
-    const shim = installShimWithoutHostCrypto();
-    const view = new DataView(new ArrayBuffer(16));
-
-    expect(() => shim.getRandomValues(view)).not.toThrow();
-    let anyNonZero = false;
-    for (let i = 0; i < view.byteLength; i += 1) {
-      if (view.getUint8(i) !== 0) anyNonZero = true;
-    }
-    expect(anyNonZero).toBe(true);
-    expect(mockGetRandomBytesRN).not.toHaveBeenCalled();
-  });
-
-  it('on React Native, delegates to expo-crypto via getRandomBytesRN (path unchanged)', () => {
-    mockState.isNodeJS = false;
-    const rnBytes = Uint8Array.from([1, 2, 3, 4, 5, 6, 7, 8]);
-    mockGetRandomBytesRN.mockReturnValue(rnBytes);
-
-    const shim = installShimWithoutHostCrypto();
-    const array = new Uint8Array(8);
-    const result = shim.getRandomValues(array);
-
-    expect(mockGetRandomBytesRN).toHaveBeenCalledWith(8);
-    expect(Array.from(result)).toEqual([1, 2, 3, 4, 5, 6, 7, 8]);
-  });
-});

package/src/crypto/__tests__/polyfillOrder.test.ts

@@ -1,114 +0,0 @@
-/**
- * The crypto polyfill must be installed before ANY `@noble/*` module evaluates.
- *
- * `@noble/hashes` 1.x's `crypto.js` captures `globalThis.crypto` once, at module
- * evaluation, and `randomBytes` uses that captured binding forever. Hermes has
- * no `globalThis.crypto` at startup, so if noble is evaluated before
- * `./polyfill` installs the shim, every random draw throws
- * `crypto.getRandomValues must be defined` — which is exactly how identity
- * creation broke on Android: the polyfill imported `@oxy.so/protocol`'s root
- * entry, whose envelope signer reaches `@noble/curves` → `@noble/hashes`, and
- * imports are evaluated before the polyfill body.
- *
- * Node's resolver picks noble's `cryptoNode.js` (the `node` export condition),
- * which never captures the global, so a plain Node run cannot see the bug. The
- * suites below substitute the REAL `crypto.js` that Metro resolves for React
- * Native, remove `globalThis.crypto`, and load core in a fresh module registry.
- */
-
-import { readFileSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
-
-type RandomBytes = (length?: number) => Uint8Array;
-
-const ORIGINAL_CRYPTO_DESCRIPTOR = Object.getOwnPropertyDescriptor(globalThis, 'crypto');
-
-/** noble's browser / React Native `crypto.js`: the variant that captures the global. */
-const NOBLE_CAPTURING_CRYPTO = join(dirname(require.resolve('@noble/hashes/utils')), 'crypto.js');
-
-/** Remove `globalThis.crypto` the way a Hermes host starts: no property at all. */
-function removeHostCrypto(): void {
-  if (!Reflect.deleteProperty(globalThis, 'crypto') || 'crypto' in globalThis) {
-    Object.defineProperty(globalThis, 'crypto', {
-      value: undefined,
-      configurable: true,
-      writable: true,
-    });
-  }
-}
-
-function restoreHostCrypto(): void {
-  Reflect.deleteProperty(globalThis, 'crypto');
-  if (ORIGINAL_CRYPTO_DESCRIPTOR) {
-    Object.defineProperty(globalThis, 'crypto', ORIGINAL_CRYPTO_DESCRIPTOR);
-  }
-}
-
-/**
- * Run `body` in a fresh module registry that resolves `@noble/hashes/crypto` as
- * a React Native bundle does, with no host `globalThis.crypto`.
- */
-function withReactNativeNobleAndNoHostCrypto(body: () => void): void {
-  removeHostCrypto();
-  try {
-    jest.isolateModules(() => {
-      jest.doMock('@noble/hashes/crypto', () => jest.requireActual(NOBLE_CAPTURING_CRYPTO));
-      body();
-    });
-  } finally {
-    restoreHostCrypto();
-  }
-}
-
-describe('crypto polyfill evaluation order', () => {
-  it('reproduces the capture: noble evaluated before the polyfill has no randomness', () => {
-    // Guards the harness itself — if this ever stops throwing, the substitution
-    // no longer models the capturing variant and the suites below prove nothing.
-    withReactNativeNobleAndNoHostCrypto(() => {
-      const { randomBytes } = require('@noble/hashes/utils') as { randomBytes: RandomBytes };
-      require('../polyfill');
-      expect(() => randomBytes(32)).toThrow('crypto.getRandomValues must be defined');
-    });
-  });
-
-  it('importing @oxy.so/core installs the shim before noble captures the global', () => {
-    withReactNativeNobleAndNoHostCrypto(() => {
-      require('../../index');
-      const { randomBytes } = require('@noble/hashes/utils') as { randomBytes: RandomBytes };
-
-      const bytes = randomBytes(32);
-      expect(bytes).toHaveLength(32);
-      expect(bytes.some((byte) => byte !== 0)).toBe(true);
-    });
-  });
-
-  it('generates an identity (key pair + recovery mnemonic) through core', () => {
-    withReactNativeNobleAndNoHostCrypto(() => {
-      const core = require('../../index') as typeof import('../../index');
-      const { generateMnemonic } = require('@scure/bip39') as typeof import('@scure/bip39');
-      const { wordlist } = require('@scure/bip39/wordlists/english') as {
-        wordlist: string[];
-      };
-
-      // The two random draws `RecoveryPhraseService.generateIdentityWithRecovery`
-      // and `KeyManager.generateKeyPairSync` make — the ones Commons failed on.
-      expect(generateMnemonic(wordlist, 128).split(' ')).toHaveLength(12);
-      const keyPair = core.KeyManager.generateKeyPairSync();
-      expect(keyPair.privateKey).toMatch(/^[0-9a-f]{64}$/);
-    });
-  });
-
-  it('the polyfill imports nothing that can reach a crypto library', () => {
-    const source = readFileSync(resolve(__dirname, '..', 'polyfill.ts'), 'utf8');
-    const specifiers = [...source.matchAll(/^import\s+[^'"]*?['"]([^'"]+)['"]/gm)].map(
-      (match) => match[1],
-    );
-    expect(specifiers.sort()).toEqual(['@oxy.so/protocol/random', 'buffer']);
-  });
-
-  it('the core entry imports the polyfill before anything else', () => {
-    const source = readFileSync(resolve(__dirname, '..', '..', 'index.ts'), 'utf8');
-    const firstModuleReference = source.match(/^(?:import|export)\s[^;]*?['"]([^'"]+)['"]/m);
-    expect(firstModuleReference?.[1]).toBe('./crypto/polyfill');
-  });
-});

package/src/crypto/__tests__/recoveryPhrase.test.ts

@@ -1,61 +0,0 @@
-/**
- * RecoveryPhraseService — pure, non-persisting derivation helpers (b3 rotation).
- *
- * `derivePendingIdentity()` and `derivePrivateKeyFromPhrase()` must produce
- * valid, self-consistent key material WITHOUT touching secure storage — the
- * whole point of a "pending" identity is that nothing is committed until an
- * external step (a server-confirmed key rotation) succeeds.
- */
-
-import { RecoveryPhraseService } from '../recoveryPhrase';
-import { KeyManager } from '../keyManager';
-
-describe('RecoveryPhraseService.derivePendingIdentity (non-persisting)', () => {
-  afterEach(() => {
-    jest.restoreAllMocks();
-  });
-
-  it('produces a valid 12-word phrase whose privateKey derives the returned publicKey', async () => {
-    const pending = await RecoveryPhraseService.derivePendingIdentity();
-
-    expect(RecoveryPhraseService.validatePhrase(pending.phrase)).toBe(true);
-    expect(pending.words).toHaveLength(12);
-    expect(pending.words.join(' ')).toBe(pending.phrase);
-
-    // The private key is a canonical 64-hex-char secp256k1 scalar…
-    expect(pending.privateKey).toMatch(/^[0-9a-f]{64}$/);
-    // …and it deterministically derives the returned public key.
-    expect(KeyManager.derivePublicKey(pending.privateKey)).toBe(pending.publicKey);
-  });
-
-  it('does NOT persist anything to secure storage (never imports a key pair)', async () => {
-    const importSpy = jest.spyOn(KeyManager, 'importKeyPair');
-    const createSpy = jest.spyOn(KeyManager, 'createIdentity');
-
-    await RecoveryPhraseService.derivePendingIdentity();
-
-    expect(importSpy).not.toHaveBeenCalled();
-    expect(createSpy).not.toHaveBeenCalled();
-  });
-
-  it('yields a distinct identity on each call', async () => {
-    const a = await RecoveryPhraseService.derivePendingIdentity();
-    const b = await RecoveryPhraseService.derivePendingIdentity();
-    expect(a.phrase).not.toBe(b.phrase);
-    expect(a.publicKey).not.toBe(b.publicKey);
-  });
-
-  it('derivePrivateKeyFromPhrase round-trips: same phrase → same private/public key', async () => {
-    const pending = await RecoveryPhraseService.derivePendingIdentity();
-
-    const rederivedPrivate = await RecoveryPhraseService.derivePrivateKeyFromPhrase(pending.phrase);
-    expect(rederivedPrivate).toBe(pending.privateKey);
-    expect(KeyManager.derivePublicKey(rederivedPrivate)).toBe(pending.publicKey);
-  });
-
-  it('derivePrivateKeyFromPhrase rejects an invalid mnemonic', async () => {
-    await expect(
-      RecoveryPhraseService.derivePrivateKeyFromPhrase('not a real recovery phrase at all'),
-    ).rejects.toThrow(/Invalid recovery phrase/);
-  });
-});

package/src/crypto/__tests__/registrationPow.test.ts

@@ -1,61 +0,0 @@
-/**
- * The client half of registration proof-of-work: `solveRegistrationPow` must
- * find a nonce that an INDEPENDENT hasher (not the one it used to search)
- * agrees clears the shared difficulty — otherwise the client and the server
- * (`packages/api`, which hashes with Node's `crypto`, not `@noble/hashes`)
- * could silently disagree about what "solved" means.
- */
-
-import crypto from 'crypto';
-import {
-  meetsRegistrationPowDifficulty,
-  registrationPowMessage,
-  REGISTRATION_POW_DIFFICULTY_BITS,
-} from '@oxy.so/protocol';
-import { solveRegistrationPow } from '../registrationPow';
-
-function nodeDigestOf(publicKey: string, timestamp: number, nonce: string): string {
-  return crypto
-    .createHash('sha256')
-    .update(registrationPowMessage(publicKey, timestamp, nonce))
-    .digest('hex');
-}
-
-describe('solveRegistrationPow', () => {
-  it('finds a nonce that Node crypto (not @noble/hashes) also agrees clears the difficulty', async () => {
-    const publicKey = 'test-public-key';
-    const timestamp = 1_700_000_000_000;
-
-    const nonce = await solveRegistrationPow(publicKey, timestamp);
-    const digest = nodeDigestOf(publicKey, timestamp, nonce);
-
-    expect(meetsRegistrationPowDifficulty(digest, REGISTRATION_POW_DIFFICULTY_BITS)).toBe(true);
-  });
-
-  it('is deterministic: the same publicKey/timestamp always yields the same nonce', async () => {
-    const publicKey = 'deterministic-key';
-    const timestamp = 1_700_000_000_001;
-
-    const first = await solveRegistrationPow(publicKey, timestamp);
-    const second = await solveRegistrationPow(publicKey, timestamp);
-
-    expect(second).toBe(first);
-  });
-
-  it('binds the nonce to publicKey and timestamp, not just to itself', async () => {
-    const timestamp = 1_700_000_000_002;
-    const nonce = await solveRegistrationPow('bound-key', timestamp);
-
-    // The nonce solves its OWN message under the shared difficulty check...
-    expect(
-      meetsRegistrationPowDifficulty(nodeDigestOf('bound-key', timestamp, nonce), REGISTRATION_POW_DIFFICULTY_BITS)
-    ).toBe(true);
-    // ...but the message it was solved for is bound to that exact publicKey —
-    // reusing the nonce string under an unrelated one hashes to something
-    // unrelated, i.e. `registrationPowMessage` actually mixes `publicKey` in
-    // rather than the digest depending on `nonce` alone.
-    expect(registrationPowMessage('bound-key', timestamp, nonce)).not.toBe(
-      registrationPowMessage('a-different-key', timestamp, nonce)
-    );
-  });
-});