@oxy.so/core 7.13.1 → 7.14.0

package/dist/cjs/crypto/aead.js

@@ -27,7 +27,7 @@ exports.decryptAead = decryptAead;
 // Loading the polyfill guarantees `globalThis.crypto.getRandomValues` exists on
 // every platform (native crypto on web/Node; expo-crypto-backed shim on RN).
 require("./polyfill");
-const chacha_1 = require("@noble/ciphers/chacha");
+const chacha_js_1 = require("@noble/ciphers/chacha.js");
 /** Key length for XChaCha20-Poly1305, in bytes (256-bit). */
 exports.AEAD_KEY_LENGTH = 32;
 /** Nonce length for XChaCha20-Poly1305, in bytes (192-bit). */
@@ -55,7 +55,7 @@ function randomNonce() {
 function encryptAead(key, plaintext, aad) {
     assertKey(key);
     const nonce = randomNonce();
-    const ciphertext = (0, chacha_1.xchacha20poly1305)(key, nonce, aad).encrypt(plaintext);
+    const ciphertext = (0, chacha_js_1.xchacha20poly1305)(key, nonce, aad).encrypt(plaintext);
     return { nonce, ciphertext };
 }
 /**
@@ -75,5 +75,5 @@ function decryptAead(key, nonce, ciphertext, aad) {
     if (nonce.length !== exports.AEAD_NONCE_LENGTH) {
         throw new Error(`AEAD nonce must be ${exports.AEAD_NONCE_LENGTH} bytes, got ${nonce.length}`);
     }
-    return (0, chacha_1.xchacha20poly1305)(key, nonce, aad).decrypt(ciphertext);
+    return (0, chacha_js_1.xchacha20poly1305)(key, nonce, aad).decrypt(ciphertext);
 }

package/dist/cjs/crypto/contentHash.js

@@ -9,14 +9,14 @@ exports.createContentHasher = createContentHasher;
  * directly: `@noble/hashes` must load after this entry's polyfill, and through
  * the ONE lazy root, so it never lands in an app's startup JavaScript.
  */
-const sha256_1 = require("@noble/hashes/sha256");
-const utils_1 = require("@noble/hashes/utils");
+const sha2_js_1 = require("@noble/hashes/sha2.js");
+const utils_js_1 = require("@noble/hashes/utils.js");
 function createContentHasher() {
-    const hash = sha256_1.sha256.create();
+    const hash = sha2_js_1.sha256.create();
     return {
         update: (chunk) => {
             hash.update(chunk);
         },
-        digestHex: () => (0, utils_1.bytesToHex)(hash.digest()),
+        digestHex: () => (0, utils_js_1.bytesToHex)(hash.digest()),
     };
 }

package/dist/cjs/crypto/identityDerivations.js

@@ -17,8 +17,8 @@ exports.deriveScopedSeedFromKey = deriveScopedSeedFromKey;
 exports.deriveSocialReceiveKey = deriveSocialReceiveKey;
 exports.signSocialReceiveDigest = signSocialReceiveDigest;
 exports.authChallengeDigest = authChallengeDigest;
-const hmac_1 = require("@noble/hashes/hmac");
-const sha2_1 = require("@noble/hashes/sha2");
+const hmac_js_1 = require("@noble/hashes/hmac.js");
+const sha2_js_1 = require("@noble/hashes/sha2.js");
 const secp256k1_1 = require("@oxy.so/protocol/secp256k1");
 const kdf_1 = require("./kdf");
 /**
@@ -73,11 +73,11 @@ function deriveSocialReceiveKey(privateKeyHex, index) {
     }
     const privateKey = (0, secp256k1_1.normalizeSecp256k1PrivateKey)(privateKeyHex);
     const parentPublic = hexToBytes((0, secp256k1_1.deriveSecp256k1PublicKey)(privateKey, true));
-    const chainCode = (0, hmac_1.hmac)(sha2_1.sha256, utf8(exports.SOCIAL_RECEIVE_CHAIN_CODE_KEY), parentPublic);
+    const chainCode = (0, hmac_js_1.hmac)(sha2_js_1.sha256, utf8(exports.SOCIAL_RECEIVE_CHAIN_CODE_KEY), parentPublic);
     const data = new Uint8Array(37);
     data.set(parentPublic, 0);
     new DataView(data.buffer).setUint32(33, index, false);
-    const i = (0, hmac_1.hmac)(sha2_1.sha512, chainCode, data);
+    const i = (0, hmac_js_1.hmac)(sha2_js_1.sha512, chainCode, data);
     const childPrivate = (0, secp256k1_1.tweakAddSecp256k1PrivateKey)(privateKey, bytesToHex(i.slice(0, 32)));
     return { privateKey: childPrivate, publicKey: (0, secp256k1_1.deriveSecp256k1PublicKey)(childPrivate, true) };
 }
@@ -101,5 +101,5 @@ function signSocialReceiveDigest(privateKeyHex, index, digestHex) {
  * format is the one `POST /auth/verify` checks, unchanged.
  */
 function authChallengeDigest(publicKey, challenge, timestamp) {
-    return bytesToHex((0, sha2_1.sha256)(utf8(`auth:${publicKey}:${challenge}:${timestamp}`)));
+    return bytesToHex((0, sha2_js_1.sha256)(utf8(`auth:${publicKey}:${challenge}:${timestamp}`)));
 }

package/dist/cjs/crypto/identityLink.js

@@ -8,11 +8,11 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.deriveIdentityLinkCode = deriveIdentityLinkCode;
-const sha256_1 = require("@noble/hashes/sha256");
-const utils_1 = require("@noble/hashes/utils");
+const sha2_js_1 = require("@noble/hashes/sha2.js");
+const utils_js_1 = require("@noble/hashes/utils.js");
 const DOMAIN = 'oxy-identity-link-code/v1';
 function deriveIdentityLinkCode(linkId, publicKey) {
-    const digest = (0, sha256_1.sha256)((0, utils_1.utf8ToBytes)(`${DOMAIN}|${linkId}|${publicKey.trim().toLowerCase()}`));
+    const digest = (0, sha2_js_1.sha256)((0, utils_js_1.utf8ToBytes)(`${DOMAIN}|${linkId}|${publicKey.trim().toLowerCase()}`));
     const value = ((digest[0] << 24) | (digest[1] << 16) | (digest[2] << 8) | digest[3]) >>> 0;
     return String(value % 1000000).padStart(6, '0');
 }

package/dist/cjs/crypto/identityProof.js

@@ -10,13 +10,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.digestIdentityPayload = digestIdentityPayload;
 exports.signIdentityProof = signIdentityProof;
 require("./polyfill");
-const sha256_1 = require("@noble/hashes/sha256");
-const utils_1 = require("@noble/hashes/utils");
+const sha2_js_1 = require("@noble/hashes/sha2.js");
+const utils_js_1 = require("@noble/hashes/utils.js");
 const sign_1 = require("@oxy.so/protocol/sign");
 const client_1 = require("@oxy.so/contracts/client");
 /** SHA-256 hex of the canonical JSON of `payload` — the `payloadDigest` claim. */
 function digestIdentityPayload(payload) {
-    return (0, utils_1.bytesToHex)((0, sha256_1.sha256)((0, utils_1.utf8ToBytes)((0, client_1.canonicalJson)(payload))));
+    return (0, utils_js_1.bytesToHex)((0, sha2_js_1.sha256)((0, utils_js_1.utf8ToBytes)((0, client_1.canonicalJson)(payload))));
 }
 /** Sign `claims` with the root, producing the proof as it travels. */
 async function signIdentityProof(identity, claims) {

package/dist/cjs/crypto/index.js

@@ -13,8 +13,8 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.verifySignature = exports.signMessage = exports.loadCommonsIdentityBridge = exports.canonicalize = exports.createContentHasher = exports.solveRegistrationPow = exports.deriveIdentityLinkCode = exports.signIdentityProof = exports.digestIdentityPayload = exports.authChallengeDigest = exports.signSocialReceiveDigest = exports.deriveSocialReceiveKey = exports.deriveScopedSeedFromKey = exports.MAX_SOCIAL_RECEIVE_INDEX = exports.SOCIAL_RECEIVE_CHAIN_CODE_KEY = exports.SCOPED_SEED_KDF_SALT = exports.deriveSharedSecret = exports.AEAD_NONCE_LENGTH = exports.AEAD_KEY_LENGTH = exports.decryptAead = exports.encryptAead = exports.hkdfSha256 = exports.BACKUP_KDF_ENCRYPTION_INFO = exports.RecoveryPhraseService = exports.SignatureService = exports.updateIdentityMarker = exports.readIdentityMarker = exports.IdentityUnavailableError = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = void 0;
-// MUST stay the first import: `@noble/hashes` captures `globalThis.crypto` when
-// it is evaluated, so the shim has to exist before anything below reaches it.
+// MUST stay the first import: the shim has to exist before any module below
+// evaluates or draws randomness (see `./polyfill`).
 require("./polyfill");
 var keyManager_1 = require("./keyManager");
 Object.defineProperty(exports, "KeyManager", { enumerable: true, get: function () { return keyManager_1.KeyManager; } });

package/dist/cjs/crypto/kdf.js

@@ -12,8 +12,8 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.hkdfSha256 = hkdfSha256;
-const hkdf_1 = require("@noble/hashes/hkdf");
-const sha256_1 = require("@noble/hashes/sha256");
+const hkdf_js_1 = require("@noble/hashes/hkdf.js");
+const sha2_js_1 = require("@noble/hashes/sha2.js");
 /**
  * Derive `length` bytes of keying material from `ikm` using HKDF-SHA256
  * (RFC 5869 — extract-then-expand).
@@ -35,5 +35,5 @@ function hkdfSha256(ikm, salt, info, length) {
     if (length > 255 * 32) {
         throw new Error('hkdfSha256: length must not exceed 8160 bytes (255 * 32)');
     }
-    return (0, hkdf_1.hkdf)(sha256_1.sha256, ikm, salt, info, length);
+    return (0, hkdf_js_1.hkdf)(sha2_js_1.sha256, ikm, salt, info, length);
 }

package/dist/cjs/crypto/polyfill.js

@@ -18,20 +18,20 @@
  * global WebCrypto, and a `require('node:crypto')` here made web bundlers ship
  * Node's crypto, stream and buffer polyfills (~600 KB) to every browser.
  *
- * # Evaluation order — this module must import NOTHING that can capture the global
+ * # Evaluation order — this module must import NOTHING that reaches a crypto library
  *
- * `@noble/hashes` 1.x reads `globalThis.crypto` exactly once, when its
- * `crypto.js` is evaluated, and `randomBytes` uses that captured binding for
- * the lifetime of the app. ES imports are evaluated before the importing
- * module's body, so every module this file imports runs BEFORE the shim below
- * is installed. This file used to import `@oxy.so/protocol`'s root entry,
- * which reaches `@noble/curves` → `@noble/hashes` through the envelope signer:
- * on Hermes (no `globalThis.crypto` at startup) noble captured `undefined`
- * before the shim existed, and every identity creation on Android failed with
- * `crypto.getRandomValues must be defined`. Its imports are therefore limited
- * to `buffer` and `@oxy.so/protocol/random`, both free of crypto libraries,
- * and `index.ts` imports this file first. `__tests__/polyfillOrder.test.ts`
- * guards both halves.
+ * ES imports are evaluated before the importing module's body, so every module
+ * this file imports runs BEFORE the shim below is installed. This file used to
+ * import `@oxy.so/protocol`'s root entry, which reaches `@noble/curves` →
+ * `@noble/hashes` through the envelope signer, and `@noble/hashes` 1.x read
+ * `globalThis.crypto` once, at evaluation: on Hermes (no `globalThis.crypto` at
+ * startup) it captured `undefined` before the shim existed, and every identity
+ * creation on Android failed with `crypto.getRandomValues must be defined`.
+ * Noble 2.x reads the global on every call, so that capture is gone, but the
+ * shim still has to exist before any module body that reads it runs. Its
+ * imports are therefore limited to `buffer` and `@oxy.so/protocol/random`,
+ * both free of crypto libraries, and `index.ts` imports this file first.
+ * `__tests__/polyfillOrder.test.ts` guards both halves.
  *
  */
 Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/crypto/recoveryPhrase.js

@@ -16,7 +16,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RecoveryPhraseService = exports.BACKUP_MATERIAL_LENGTH = exports.BACKUP_KDF_LOOKUP_INFO = exports.BACKUP_KDF_ENCRYPTION_INFO = exports.BACKUP_KDF_SALT = void 0;
 const bip39_1 = require("@scure/bip39");
-const english_1 = require("@scure/bip39/wordlists/english");
+const english_js_1 = require("@scure/bip39/wordlists/english.js");
 const keyManager_1 = require("./keyManager");
 const kdf_1 = require("./kdf");
 /**
@@ -59,7 +59,7 @@ class RecoveryPhraseService {
      */
     static async generateIdentityWithRecovery(options) {
         // Generate 128-bit entropy for 12-word mnemonic
-        const mnemonic = (0, bip39_1.generateMnemonic)(english_1.wordlist, 128);
+        const mnemonic = (0, bip39_1.generateMnemonic)(english_js_1.wordlist, 128);
         // Derive private key from mnemonic
         // Using the seed directly as the private key (simplified approach)
         const seed = await (0, bip39_1.mnemonicToSeed)(mnemonic);
@@ -83,7 +83,7 @@ class RecoveryPhraseService {
      */
     static async generateIdentityWithRecovery24(options) {
         // Generate 256-bit entropy for 24-word mnemonic
-        const mnemonic = (0, bip39_1.generateMnemonic)(english_1.wordlist, 256);
+        const mnemonic = (0, bip39_1.generateMnemonic)(english_js_1.wordlist, 256);
         const seed = await (0, bip39_1.mnemonicToSeed)(mnemonic);
         const privateKeyHex = toHex(seed.subarray(0, 32));
         const publicKey = await keyManager_1.KeyManager.importKeyPair(privateKeyHex, {
@@ -109,7 +109,7 @@ class RecoveryPhraseService {
      * committed anywhere — if it is lost the account becomes unrecoverable.
      */
     static async derivePendingIdentity() {
-        const mnemonic = (0, bip39_1.generateMnemonic)(english_1.wordlist, 128);
+        const mnemonic = (0, bip39_1.generateMnemonic)(english_js_1.wordlist, 128);
         const seed = await (0, bip39_1.mnemonicToSeed)(mnemonic);
         const privateKey = toHex(seed.subarray(0, 32));
         const publicKey = keyManager_1.KeyManager.derivePublicKey(privateKey);
@@ -130,7 +130,7 @@ class RecoveryPhraseService {
      */
     static async derivePrivateKeyFromPhrase(phrase) {
         const normalizedPhrase = phrase.trim().toLowerCase();
-        if (!(0, bip39_1.validateMnemonic)(normalizedPhrase, english_1.wordlist)) {
+        if (!(0, bip39_1.validateMnemonic)(normalizedPhrase, english_js_1.wordlist)) {
             throw new Error('Invalid recovery phrase');
         }
         const seed = await (0, bip39_1.mnemonicToSeed)(normalizedPhrase);
@@ -155,7 +155,7 @@ class RecoveryPhraseService {
      */
     static async deriveBackupMaterial(phrase) {
         const normalizedPhrase = phrase.trim().toLowerCase();
-        if (!(0, bip39_1.validateMnemonic)(normalizedPhrase, english_1.wordlist)) {
+        if (!(0, bip39_1.validateMnemonic)(normalizedPhrase, english_js_1.wordlist)) {
             throw new Error('Invalid recovery phrase. Please check the words and try again.');
         }
         const seed = await (0, bip39_1.mnemonicToSeed)(normalizedPhrase);
@@ -175,7 +175,7 @@ class RecoveryPhraseService {
     static async restoreFromPhrase(phrase, options) {
         // Normalize and validate the phrase
         const normalizedPhrase = phrase.trim().toLowerCase();
-        if (!(0, bip39_1.validateMnemonic)(normalizedPhrase, english_1.wordlist)) {
+        if (!(0, bip39_1.validateMnemonic)(normalizedPhrase, english_js_1.wordlist)) {
             throw new Error('Invalid recovery phrase. Please check the words and try again.');
         }
         // Derive the same private key from the mnemonic
@@ -192,26 +192,26 @@ class RecoveryPhraseService {
      */
     static validatePhrase(phrase) {
         const normalizedPhrase = phrase.trim().toLowerCase();
-        return (0, bip39_1.validateMnemonic)(normalizedPhrase, english_1.wordlist);
+        return (0, bip39_1.validateMnemonic)(normalizedPhrase, english_js_1.wordlist);
     }
     /**
      * Get the word list for autocomplete/validation
      */
     static getWordList() {
-        return english_1.wordlist;
+        return english_js_1.wordlist;
     }
     /**
      * Check if a word is valid in the BIP39 word list
      */
     static isValidWord(word) {
-        return english_1.wordlist.includes(word.toLowerCase());
+        return english_js_1.wordlist.includes(word.toLowerCase());
     }
     /**
      * Get suggestions for a partial word
      */
     static getSuggestions(partial, limit = 5) {
         const lowerPartial = partial.toLowerCase();
-        return english_1.wordlist.filter((word) => word.startsWith(lowerPartial)).slice(0, limit);
+        return english_js_1.wordlist.filter((word) => word.startsWith(lowerPartial)).slice(0, limit);
     }
     /**
      * Derive the public key from a phrase without storing
@@ -219,7 +219,7 @@ class RecoveryPhraseService {
      */
     static async derivePublicKeyFromPhrase(phrase) {
         const normalizedPhrase = phrase.trim().toLowerCase();
-        if (!(0, bip39_1.validateMnemonic)(normalizedPhrase, english_1.wordlist)) {
+        if (!(0, bip39_1.validateMnemonic)(normalizedPhrase, english_js_1.wordlist)) {
             throw new Error('Invalid recovery phrase');
         }
         const seed = await (0, bip39_1.mnemonicToSeed)(normalizedPhrase);

package/dist/cjs/crypto/registrationPow.js

@@ -10,8 +10,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.solveRegistrationPow = solveRegistrationPow;
 require("./polyfill");
-const sha256_1 = require("@noble/hashes/sha256");
-const utils_1 = require("@noble/hashes/utils");
+const sha2_js_1 = require("@noble/hashes/sha2.js");
+const utils_js_1 = require("@noble/hashes/utils.js");
 const protocol_1 = require("@oxy.so/protocol");
 /**
  * How many attempts the grind loop runs before yielding to the event loop.
@@ -31,7 +31,7 @@ function yieldToEventLoop() {
  * Grind a nonce for `publicKey`/`timestamp` that clears
  * {@link REGISTRATION_POW_DIFFICULTY_BITS}, returned as a decimal counter.
  *
- * Hashes with `@noble/hashes/sha256` — pure JS, synchronous, identical output
+ * Hashes with `@noble/hashes/sha2.js`'s `sha256` — pure JS, synchronous, identical output
  * on web/Node/React Native with no native module and no per-attempt bridge
  * crossing (see the difficulty constant's own doc for why that distinction is
  * the whole point). Nonces are sequential (0, 1, 2, …) rather than random: the
@@ -42,7 +42,7 @@ function yieldToEventLoop() {
 async function solveRegistrationPow(publicKey, timestamp) {
     for (let nonce = 0;; nonce += 1) {
         const candidate = String(nonce);
-        const digest = (0, utils_1.bytesToHex)((0, sha256_1.sha256)((0, utils_1.utf8ToBytes)((0, protocol_1.registrationPowMessage)(publicKey, timestamp, candidate))));
+        const digest = (0, utils_js_1.bytesToHex)((0, sha2_js_1.sha256)((0, utils_js_1.utf8ToBytes)((0, protocol_1.registrationPowMessage)(publicKey, timestamp, candidate))));
         if ((0, protocol_1.meetsRegistrationPowDifficulty)(digest, protocol_1.REGISTRATION_POW_DIFFICULTY_BITS)) {
             return candidate;
         }

package/dist/cjs/index.js

@@ -28,8 +28,8 @@ exports.packageInfo = exports.consumeOAuthReturnPath = exports.persistOAuthRetur
 // The crypto shim MUST stay the first import. The root itself ships no crypto
 // library (`__tests__/rootEntryGraph.test.ts`), but `@oxy.so/protocol`'s root
 // entry (reached by the OAuth/PKCE and device helpers) does, and Metro does not
-// tree-shake: on Hermes, `@noble/hashes` would capture an absent
-// `globalThis.crypto` at evaluation. See the note in `./crypto/polyfill`.
+// tree-shake: on Hermes, the shim has to exist before any of it evaluates. See
+// the note in `./crypto/polyfill`.
 require("./crypto/polyfill");
 // ---------------------------------------------------------------------------
 // API client

package/dist/esm/crypto/aead.js

@@ -22,7 +22,7 @@
 // Loading the polyfill guarantees `globalThis.crypto.getRandomValues` exists on
 // every platform (native crypto on web/Node; expo-crypto-backed shim on RN).
 import './polyfill.js';
-import { xchacha20poly1305 } from '@noble/ciphers/chacha';
+import { xchacha20poly1305 } from '@noble/ciphers/chacha.js';
 /** Key length for XChaCha20-Poly1305, in bytes (256-bit). */
 export const AEAD_KEY_LENGTH = 32;
 /** Nonce length for XChaCha20-Poly1305, in bytes (192-bit). */

package/dist/esm/crypto/contentHash.js

@@ -6,8 +6,8 @@
  * directly: `@noble/hashes` must load after this entry's polyfill, and through
  * the ONE lazy root, so it never lands in an app's startup JavaScript.
  */
-import { sha256 } from '@noble/hashes/sha256';
-import { bytesToHex } from '@noble/hashes/utils';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { bytesToHex } from '@noble/hashes/utils.js';
 export function createContentHasher() {
     const hash = sha256.create();
     return {

package/dist/esm/crypto/identityDerivations.js

@@ -10,8 +10,8 @@
  *
  * ESM/CJS safe: static `import` only, no `require()`.
  */
-import { hmac } from '@noble/hashes/hmac';
-import { sha256, sha512 } from '@noble/hashes/sha2';
+import { hmac } from '@noble/hashes/hmac.js';
+import { sha256, sha512 } from '@noble/hashes/sha2.js';
 import { deriveSecp256k1PublicKey, normalizeSecp256k1PrivateKey, signSecp256k1Digest, tweakAddSecp256k1PrivateKey, } from '@oxy.so/protocol/secp256k1';
 import { hkdfSha256 } from './kdf.js';
 /**

package/dist/esm/crypto/identityLink.js

@@ -5,8 +5,8 @@
  * Commons from its own; the person checks they match before the link is
  * confirmed, so a photographed QR cannot slip another key in.
  */
-import { sha256 } from '@noble/hashes/sha256';
-import { utf8ToBytes } from '@noble/hashes/utils';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { utf8ToBytes } from '@noble/hashes/utils.js';
 const DOMAIN = 'oxy-identity-link-code/v1';
 export function deriveIdentityLinkCode(linkId, publicKey) {
     const digest = sha256(utf8ToBytes(`${DOMAIN}|${linkId}|${publicKey.trim().toLowerCase()}`));

package/dist/esm/crypto/identityProof.js

@@ -6,8 +6,8 @@
  * its own JSON.
  */
 import './polyfill.js';
-import { sha256 } from '@noble/hashes/sha256';
-import { bytesToHex, utf8ToBytes } from '@noble/hashes/utils';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { bytesToHex, utf8ToBytes } from '@noble/hashes/utils.js';
 import { signMessage } from '@oxy.so/protocol/sign';
 import { buildIdentityProofMessage, canonicalJson, IDENTITY_PROOF_VERSION, } from '@oxy.so/contracts/client';
 /** SHA-256 hex of the canonical JSON of `payload` — the `payloadDigest` claim. */

package/dist/esm/crypto/index.js

@@ -10,8 +10,8 @@
  * internal barrel) made Metro hoist the shared stack into the always-loaded
  * common chunk, which is the cost the lazy loading exists to avoid.
  */
-// MUST stay the first import: `@noble/hashes` captures `globalThis.crypto` when
-// it is evaluated, so the shim has to exist before anything below reaches it.
+// MUST stay the first import: the shim has to exist before any module below
+// evaluates or draws randomness (see `./polyfill`).
 import './polyfill.js';
 export { KeyManager, IdentityAlreadyExistsError, IdentityPersistError, IdentityUnavailableError, } from './keyManager.js';
 export { readIdentityMarker, updateIdentityMarker } from './identityMarker.js';

package/dist/esm/crypto/kdf.js

@@ -9,8 +9,8 @@
  *
  * ESM/CJS safe: static `import` only, no `require()`.
  */
-import { hkdf } from '@noble/hashes/hkdf';
-import { sha256 } from '@noble/hashes/sha256';
+import { hkdf } from '@noble/hashes/hkdf.js';
+import { sha256 } from '@noble/hashes/sha2.js';
 /**
  * Derive `length` bytes of keying material from `ikm` using HKDF-SHA256
  * (RFC 5869 — extract-then-expand).

package/dist/esm/crypto/polyfill.js

@@ -17,20 +17,20 @@
  * global WebCrypto, and a `require('node:crypto')` here made web bundlers ship
  * Node's crypto, stream and buffer polyfills (~600 KB) to every browser.
  *
- * # Evaluation order — this module must import NOTHING that can capture the global
+ * # Evaluation order — this module must import NOTHING that reaches a crypto library
  *
- * `@noble/hashes` 1.x reads `globalThis.crypto` exactly once, when its
- * `crypto.js` is evaluated, and `randomBytes` uses that captured binding for
- * the lifetime of the app. ES imports are evaluated before the importing
- * module's body, so every module this file imports runs BEFORE the shim below
- * is installed. This file used to import `@oxy.so/protocol`'s root entry,
- * which reaches `@noble/curves` → `@noble/hashes` through the envelope signer:
- * on Hermes (no `globalThis.crypto` at startup) noble captured `undefined`
- * before the shim existed, and every identity creation on Android failed with
- * `crypto.getRandomValues must be defined`. Its imports are therefore limited
- * to `buffer` and `@oxy.so/protocol/random`, both free of crypto libraries,
- * and `index.ts` imports this file first. `__tests__/polyfillOrder.test.ts`
- * guards both halves.
+ * ES imports are evaluated before the importing module's body, so every module
+ * this file imports runs BEFORE the shim below is installed. This file used to
+ * import `@oxy.so/protocol`'s root entry, which reaches `@noble/curves` →
+ * `@noble/hashes` through the envelope signer, and `@noble/hashes` 1.x read
+ * `globalThis.crypto` once, at evaluation: on Hermes (no `globalThis.crypto` at
+ * startup) it captured `undefined` before the shim existed, and every identity
+ * creation on Android failed with `crypto.getRandomValues must be defined`.
+ * Noble 2.x reads the global on every call, so that capture is gone, but the
+ * shim still has to exist before any module body that reads it runs. Its
+ * imports are therefore limited to `buffer` and `@oxy.so/protocol/random`,
+ * both free of crypto libraries, and `index.ts` imports this file first.
+ * `__tests__/polyfillOrder.test.ts` guards both halves.
  *
  */
 import _cjs_buffer from 'buffer';

package/dist/esm/crypto/recoveryPhrase.js

@@ -13,7 +13,7 @@
  * app. Adding another language means one more subpath import, ideally lazy.
  */
 import { generateMnemonic, mnemonicToSeed, validateMnemonic } from '@scure/bip39';
-import { wordlist } from '@scure/bip39/wordlists/english';
+import { wordlist } from '@scure/bip39/wordlists/english.js';
 import { KeyManager } from './keyManager.js';
 import { hkdfSha256 } from './kdf.js';
 /**

package/dist/esm/crypto/registrationPow.js

@@ -7,8 +7,8 @@
  * `auth/registrationPow.ts` — this file is only the solve loop.
  */
 import './polyfill.js';
-import { sha256 } from '@noble/hashes/sha256';
-import { bytesToHex, utf8ToBytes } from '@noble/hashes/utils';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { bytesToHex, utf8ToBytes } from '@noble/hashes/utils.js';
 import { meetsRegistrationPowDifficulty, registrationPowMessage, REGISTRATION_POW_DIFFICULTY_BITS, } from '@oxy.so/protocol';
 /**
  * How many attempts the grind loop runs before yielding to the event loop.
@@ -28,7 +28,7 @@ function yieldToEventLoop() {
  * Grind a nonce for `publicKey`/`timestamp` that clears
  * {@link REGISTRATION_POW_DIFFICULTY_BITS}, returned as a decimal counter.
  *
- * Hashes with `@noble/hashes/sha256` — pure JS, synchronous, identical output
+ * Hashes with `@noble/hashes/sha2.js`'s `sha256` — pure JS, synchronous, identical output
  * on web/Node/React Native with no native module and no per-attempt bridge
  * crossing (see the difficulty constant's own doc for why that distinction is
  * the whole point). Nonces are sequential (0, 1, 2, …) rather than random: the

package/dist/esm/index.js

@@ -22,8 +22,8 @@
 // The crypto shim MUST stay the first import. The root itself ships no crypto
 // library (`__tests__/rootEntryGraph.test.ts`), but `@oxy.so/protocol`'s root
 // entry (reached by the OAuth/PKCE and device helpers) does, and Metro does not
-// tree-shake: on Hermes, `@noble/hashes` would capture an absent
-// `globalThis.crypto` at evaluation. See the note in `./crypto/polyfill`.
+// tree-shake: on Hermes, the shim has to exist before any of it evaluates. See
+// the note in `./crypto/polyfill`.
 import './crypto/polyfill.js';
 // ---------------------------------------------------------------------------
 // API client

package/dist/types/crypto/polyfill.d.ts

@@ -17,20 +17,20 @@
  * global WebCrypto, and a `require('node:crypto')` here made web bundlers ship
  * Node's crypto, stream and buffer polyfills (~600 KB) to every browser.
  *
- * # Evaluation order — this module must import NOTHING that can capture the global
+ * # Evaluation order — this module must import NOTHING that reaches a crypto library
  *
- * `@noble/hashes` 1.x reads `globalThis.crypto` exactly once, when its
- * `crypto.js` is evaluated, and `randomBytes` uses that captured binding for
- * the lifetime of the app. ES imports are evaluated before the importing
- * module's body, so every module this file imports runs BEFORE the shim below
- * is installed. This file used to import `@oxy.so/protocol`'s root entry,
- * which reaches `@noble/curves` → `@noble/hashes` through the envelope signer:
- * on Hermes (no `globalThis.crypto` at startup) noble captured `undefined`
- * before the shim existed, and every identity creation on Android failed with
- * `crypto.getRandomValues must be defined`. Its imports are therefore limited
- * to `buffer` and `@oxy.so/protocol/random`, both free of crypto libraries,
- * and `index.ts` imports this file first. `__tests__/polyfillOrder.test.ts`
- * guards both halves.
+ * ES imports are evaluated before the importing module's body, so every module
+ * this file imports runs BEFORE the shim below is installed. This file used to
+ * import `@oxy.so/protocol`'s root entry, which reaches `@noble/curves` →
+ * `@noble/hashes` through the envelope signer, and `@noble/hashes` 1.x read
+ * `globalThis.crypto` once, at evaluation: on Hermes (no `globalThis.crypto` at
+ * startup) it captured `undefined` before the shim existed, and every identity
+ * creation on Android failed with `crypto.getRandomValues must be defined`.
+ * Noble 2.x reads the global on every call, so that capture is gone, but the
+ * shim still has to exist before any module body that reads it runs. Its
+ * imports are therefore limited to `buffer` and `@oxy.so/protocol/random`,
+ * both free of crypto libraries, and `index.ts` imports this file first.
+ * `__tests__/polyfillOrder.test.ts` guards both halves.
  *
  */
 import { Buffer } from 'buffer';

package/dist/types/crypto/registrationPow.d.ts

@@ -11,7 +11,7 @@ import './polyfill';
  * Grind a nonce for `publicKey`/`timestamp` that clears
  * {@link REGISTRATION_POW_DIFFICULTY_BITS}, returned as a decimal counter.
  *
- * Hashes with `@noble/hashes/sha256` — pure JS, synchronous, identical output
+ * Hashes with `@noble/hashes/sha2.js`'s `sha256` — pure JS, synchronous, identical output
  * on web/Node/React Native with no native module and no per-attempt bridge
  * crossing (see the difficulty constant's own doc for why that distinction is
  * the whole point). Nonces are sequential (0, 1, 2, …) rather than random: the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/core",
-  "version": "7.13.1",
+  "version": "7.14.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -160,7 +160,7 @@
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://oxy.so",
   "engines": {
-    "node": ">=20.0.0"
+    "node": "^20.19.0 || >=22.12.0"
   },
   "scripts": {
     "build": "bun run check:compact-locales && node scripts/build-workspace-deps.mjs @oxy.so/telemetry && bun run build:cjs && bun run build:esm && bun run build:types && node scripts/mark-module-formats.mjs && node -e \"const p='../app-preset/metro/source-stamp.js';require('node:fs').existsSync(p)&&require(p).writeStamp(process.cwd())\"",
@@ -179,12 +179,12 @@
     "test:bun": "cd bun-tests && bun test"
   },
   "dependencies": {
-    "@noble/ciphers": "^1.3.0",
-    "@noble/hashes": "^1.8.0",
+    "@noble/ciphers": "^2.4.0",
+    "@noble/hashes": "^2.4.0",
     "@oxy.so/contracts": "6.5.0",
-    "@oxy.so/protocol": "^1.5.1",
+    "@oxy.so/protocol": "^1.6.0",
     "@oxy.so/telemetry": "^2.1.0",
-    "@scure/bip39": "^1.6.0",
+    "@scure/bip39": "^2.4.0",
     "buffer": "^6.0.3",
     "express-rate-limit": "^8.6.0",
     "helmet": "^8.0.0",
@@ -195,7 +195,7 @@
     "zod": "^4.6.7"
   },
   "peerDependencies": {
-    "@react-native-async-storage/async-storage": "<3.0.0",
+    "@react-native-async-storage/async-storage": "<4.0.0",
     "expo-crypto": "<59.0.0",
     "expo-secure-store": "<59.0.0",
     "express": "^4.0.0",
@@ -223,7 +223,7 @@
     }
   },
   "devDependencies": {
-    "@react-native-async-storage/async-storage": "^2.2.0",
+    "@react-native-async-storage/async-storage": "^3.1.1",
     "@types/express": "^4.17.25",
     "@types/invariant": "^2.2.34",
     "@types/node": "^20.19.43",

package/src/crypto/aead.ts

@@ -23,7 +23,7 @@
 // Loading the polyfill guarantees `globalThis.crypto.getRandomValues` exists on
 // every platform (native crypto on web/Node; expo-crypto-backed shim on RN).
 import './polyfill';
-import { xchacha20poly1305 } from '@noble/ciphers/chacha';
+import { xchacha20poly1305 } from '@noble/ciphers/chacha.js';
 
 /** Key length for XChaCha20-Poly1305, in bytes (256-bit). */
 export const AEAD_KEY_LENGTH = 32;

package/src/crypto/contentHash.ts

@@ -6,8 +6,8 @@
  * directly: `@noble/hashes` must load after this entry's polyfill, and through
  * the ONE lazy root, so it never lands in an app's startup JavaScript.
  */
-import { sha256 } from '@noble/hashes/sha256';
-import { bytesToHex } from '@noble/hashes/utils';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { bytesToHex } from '@noble/hashes/utils.js';
 
 export interface ContentHasher {
   update(chunk: Uint8Array): void;

package/src/crypto/identityDerivations.ts

@@ -11,8 +11,8 @@
  * ESM/CJS safe: static `import` only, no `require()`.
  */
 
-import { hmac } from '@noble/hashes/hmac';
-import { sha256, sha512 } from '@noble/hashes/sha2';
+import { hmac } from '@noble/hashes/hmac.js';
+import { sha256, sha512 } from '@noble/hashes/sha2.js';
 import {
   deriveSecp256k1PublicKey,
   normalizeSecp256k1PrivateKey,

package/src/crypto/identityLink.ts

@@ -6,8 +6,8 @@
  * confirmed, so a photographed QR cannot slip another key in.
  */
 
-import { sha256 } from '@noble/hashes/sha256';
-import { utf8ToBytes } from '@noble/hashes/utils';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { utf8ToBytes } from '@noble/hashes/utils.js';
 
 const DOMAIN = 'oxy-identity-link-code/v1';
 

package/src/crypto/identityProof.ts

@@ -7,8 +7,8 @@
  */
 
 import './polyfill';
-import { sha256 } from '@noble/hashes/sha256';
-import { bytesToHex, utf8ToBytes } from '@noble/hashes/utils';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { bytesToHex, utf8ToBytes } from '@noble/hashes/utils.js';
 import { signMessage } from '@oxy.so/protocol/sign';
 import type { IdentityProof, IdentityProofClaims } from '@oxy.so/contracts';
 import {

package/src/crypto/index.ts

@@ -11,8 +11,8 @@
  * common chunk, which is the cost the lazy loading exists to avoid.
  */
 
-// MUST stay the first import: `@noble/hashes` captures `globalThis.crypto` when
-// it is evaluated, so the shim has to exist before anything below reaches it.
+// MUST stay the first import: the shim has to exist before any module below
+// evaluates or draws randomness (see `./polyfill`).
 import './polyfill';
 
 export {

package/src/crypto/kdf.ts

@@ -10,8 +10,8 @@
  * ESM/CJS safe: static `import` only, no `require()`.
  */
 
-import { hkdf } from '@noble/hashes/hkdf';
-import { sha256 } from '@noble/hashes/sha256';
+import { hkdf } from '@noble/hashes/hkdf.js';
+import { sha256 } from '@noble/hashes/sha2.js';
 
 /**
  * Derive `length` bytes of keying material from `ikm` using HKDF-SHA256

package/src/crypto/polyfill.ts

@@ -17,20 +17,20 @@
  * global WebCrypto, and a `require('node:crypto')` here made web bundlers ship
  * Node's crypto, stream and buffer polyfills (~600 KB) to every browser.
  *
- * # Evaluation order — this module must import NOTHING that can capture the global
+ * # Evaluation order — this module must import NOTHING that reaches a crypto library
  *
- * `@noble/hashes` 1.x reads `globalThis.crypto` exactly once, when its
- * `crypto.js` is evaluated, and `randomBytes` uses that captured binding for
- * the lifetime of the app. ES imports are evaluated before the importing
- * module's body, so every module this file imports runs BEFORE the shim below
- * is installed. This file used to import `@oxy.so/protocol`'s root entry,
- * which reaches `@noble/curves` → `@noble/hashes` through the envelope signer:
- * on Hermes (no `globalThis.crypto` at startup) noble captured `undefined`
- * before the shim existed, and every identity creation on Android failed with
- * `crypto.getRandomValues must be defined`. Its imports are therefore limited
- * to `buffer` and `@oxy.so/protocol/random`, both free of crypto libraries,
- * and `index.ts` imports this file first. `__tests__/polyfillOrder.test.ts`
- * guards both halves.
+ * ES imports are evaluated before the importing module's body, so every module
+ * this file imports runs BEFORE the shim below is installed. This file used to
+ * import `@oxy.so/protocol`'s root entry, which reaches `@noble/curves` →
+ * `@noble/hashes` through the envelope signer, and `@noble/hashes` 1.x read
+ * `globalThis.crypto` once, at evaluation: on Hermes (no `globalThis.crypto` at
+ * startup) it captured `undefined` before the shim existed, and every identity
+ * creation on Android failed with `crypto.getRandomValues must be defined`.
+ * Noble 2.x reads the global on every call, so that capture is gone, but the
+ * shim still has to exist before any module body that reads it runs. Its
+ * imports are therefore limited to `buffer` and `@oxy.so/protocol/random`,
+ * both free of crypto libraries, and `index.ts` imports this file first.
+ * `__tests__/polyfillOrder.test.ts` guards both halves.
  *
  */
 

package/src/crypto/recoveryPhrase.ts

@@ -14,7 +14,7 @@
  */
 
 import { generateMnemonic, mnemonicToSeed, validateMnemonic } from '@scure/bip39';
-import { wordlist } from '@scure/bip39/wordlists/english';
+import { wordlist } from '@scure/bip39/wordlists/english.js';
 import { KeyManager } from './keyManager';
 import { hkdfSha256 } from './kdf';
 

package/src/crypto/registrationPow.ts

@@ -8,8 +8,8 @@
  */
 
 import './polyfill';
-import { sha256 } from '@noble/hashes/sha256';
-import { bytesToHex, utf8ToBytes } from '@noble/hashes/utils';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { bytesToHex, utf8ToBytes } from '@noble/hashes/utils.js';
 import {
   meetsRegistrationPowDifficulty,
   registrationPowMessage,
@@ -36,7 +36,7 @@ function yieldToEventLoop(): Promise<void> {
  * Grind a nonce for `publicKey`/`timestamp` that clears
  * {@link REGISTRATION_POW_DIFFICULTY_BITS}, returned as a decimal counter.
  *
- * Hashes with `@noble/hashes/sha256` — pure JS, synchronous, identical output
+ * Hashes with `@noble/hashes/sha2.js`'s `sha256` — pure JS, synchronous, identical output
  * on web/Node/React Native with no native module and no per-attempt bridge
  * crossing (see the difficulty constant's own doc for why that distinction is
  * the whole point). Nonces are sequential (0, 1, 2, …) rather than random: the

package/src/index.ts

@@ -23,8 +23,8 @@
 // The crypto shim MUST stay the first import. The root itself ships no crypto
 // library (`__tests__/rootEntryGraph.test.ts`), but `@oxy.so/protocol`'s root
 // entry (reached by the OAuth/PKCE and device helpers) does, and Metro does not
-// tree-shake: on Hermes, `@noble/hashes` would capture an absent
-// `globalThis.crypto` at evaluation. See the note in `./crypto/polyfill`.
+// tree-shake: on Hermes, the shim has to exist before any of it evaluates. See
+// the note in `./crypto/polyfill`.
 import './crypto/polyfill';
 
 // ---------------------------------------------------------------------------