@oxy.so/protocol 1.5.1 → 1.6.0

package/dist/cjs/auth/registrationPow.js

@@ -25,7 +25,7 @@
  * platform hashing primitive and is trivially unit-testable with fixed
  * digests. Each side hashes with whatever SHA-256 it already has — Node's
  * `crypto` server-side (`packages/api/src/controllers/session.controller.ts`),
- * `@noble/hashes/sha256` client-side (`packages/core/src/crypto/registrationPow.ts`,
+ * `@noble/hashes/sha2.js`'s `sha256` client-side (`packages/core/src/crypto/registrationPow.ts`,
  * already a `@oxy.so/core` dependency — see `crypto/kdf.ts`,
  * `crypto/identityProof.ts`) — and both produce byte-identical digests over
  * the same message, because SHA-256 has exactly one correct output for a
@@ -101,7 +101,7 @@ function registrationPowMessage(publicKey, timestamp, nonce) {
  * requires of a solved nonce's digest.
  *
  * 16 bits ⇒ 65,536 SHA-256 attempts on average to solve. The client grinds
- * with `@noble/hashes/sha256` — a pure-JS, SYNCHRONOUS implementation with
+ * with `@noble/hashes/sha2.js`'s `sha256` — a pure-JS, SYNCHRONOUS implementation with
  * "identical behaviour on web, Node, and React Native with zero WebCrypto /
  * native-module dependency" (its own doc comment in `crypto/kdf.ts`) — so,
  * unlike a solve loop built on a platform hashing primitive that crosses a

package/dist/cjs/platform/random.native.js

@@ -7,11 +7,10 @@
  *
  * This module is deliberately tiny and imports NOTHING but `expo-crypto`: it
  * backs `@oxy.so/core`'s `globalThis.crypto.getRandomValues` polyfill, which
- * must be fully installed before any module that captures `globalThis.crypto`
- * at evaluation time (`@noble/hashes` 1.x's `crypto.js` does exactly that) is
- * evaluated. Reaching a crypto library from here would let that library
- * capture the missing global first and throw
- * `crypto.getRandomValues must be defined` for the lifetime of the app.
+ * must be fully installed before any module that reads `globalThis.crypto`
+ * at evaluation time is evaluated (`@noble/hashes` 1.x's `crypto.js` did, and
+ * threw `crypto.getRandomValues must be defined` for the lifetime of the app).
+ * Reaching a crypto library from here would evaluate it before the shim.
  *
  * `expo-crypto` is an OPTIONAL peer, so it is resolved with a string-literal
  * `require` inside a `try` (Metro's optional-dependency form; see

package/dist/cjs/random.js

@@ -3,13 +3,12 @@
  * `@oxy.so/protocol/random` — the platform randomness source, and nothing else.
  *
  * `@oxy.so/core`'s crypto polyfill installs `globalThis.crypto.getRandomValues`
- * on hosts that lack it (React Native / Hermes). `@noble/hashes` 1.x captures
- * `globalThis.crypto` ONCE, when its `crypto.js` is evaluated, so the polyfill
- * has to be installed before any `@noble/*` module is evaluated. ES imports are
+ * on hosts that lack it (React Native / Hermes), and has to be installed before
+ * any module that reads `globalThis.crypto` is evaluated. ES imports are
  * evaluated before the importing module's body, so whatever the polyfill
  * imports is evaluated first: importing the ROOT entry (which reaches
- * `@noble/curves` through the envelope signer) let noble capture `undefined`
- * and broke identity creation on Android.
+ * `@noble/curves` through the envelope signer) let `@noble/hashes` 1.x capture
+ * `undefined` at evaluation and broke identity creation on Android.
  *
  * This entry therefore reaches no crypto library, no `@oxy.so/*` package and no
  * third-party module other than the optional `expo-crypto` peer (RN variant

package/dist/cjs/secp256k1.js

@@ -121,10 +121,13 @@ function normalizeSecp256k1PublicKey(publicKeyHex, compressed = false) {
  * accepts both forms; callers that require low-S normalization opt in explicitly.
  */
 function signSecp256k1Digest(privateKeyHex, digestHex, options = {}) {
+    // The input is already a digest: `prehash: false` keeps noble from hashing it again.
     const signature = secp256k1_js_1.secp256k1.sign(parseDigest(digestHex), parsePrivateKey(privateKeyHex), {
+        prehash: false,
         lowS: options.lowS ?? false,
+        format: 'der',
     });
-    return signature.toHex('der');
+    return bytesToHex(signature);
 }
 /** Verify a DER-encoded ECDSA signature, accepting historical high-S signatures. */
 function verifySecp256k1Digest(publicKeyHex, digestHex, signatureDerHex) {
@@ -134,6 +137,7 @@ function verifySecp256k1Digest(publicKeyHex, digestHex, signatureDerHex) {
     // Parse once up front so malformed or non-DER input is rejected explicitly.
     secp256k1_js_1.secp256k1.Signature.fromBytes(signature, 'der');
     return secp256k1_js_1.secp256k1.verify(signature, digest, publicKey, {
+        prehash: false,
         format: 'der',
         lowS: false,
     });

package/dist/esm/auth/registrationPow.js

@@ -24,7 +24,7 @@
  * platform hashing primitive and is trivially unit-testable with fixed
  * digests. Each side hashes with whatever SHA-256 it already has — Node's
  * `crypto` server-side (`packages/api/src/controllers/session.controller.ts`),
- * `@noble/hashes/sha256` client-side (`packages/core/src/crypto/registrationPow.ts`,
+ * `@noble/hashes/sha2.js`'s `sha256` client-side (`packages/core/src/crypto/registrationPow.ts`,
  * already a `@oxy.so/core` dependency — see `crypto/kdf.ts`,
  * `crypto/identityProof.ts`) — and both produce byte-identical digests over
  * the same message, because SHA-256 has exactly one correct output for a
@@ -95,7 +95,7 @@ export function registrationPowMessage(publicKey, timestamp, nonce) {
  * requires of a solved nonce's digest.
  *
  * 16 bits ⇒ 65,536 SHA-256 attempts on average to solve. The client grinds
- * with `@noble/hashes/sha256` — a pure-JS, SYNCHRONOUS implementation with
+ * with `@noble/hashes/sha2.js`'s `sha256` — a pure-JS, SYNCHRONOUS implementation with
  * "identical behaviour on web, Node, and React Native with zero WebCrypto /
  * native-module dependency" (its own doc comment in `crypto/kdf.ts`) — so,
  * unlike a solve loop built on a platform hashing primitive that crosses a

package/dist/esm/platform/random.native.js

@@ -6,11 +6,10 @@
  *
  * This module is deliberately tiny and imports NOTHING but `expo-crypto`: it
  * backs `@oxy.so/core`'s `globalThis.crypto.getRandomValues` polyfill, which
- * must be fully installed before any module that captures `globalThis.crypto`
- * at evaluation time (`@noble/hashes` 1.x's `crypto.js` does exactly that) is
- * evaluated. Reaching a crypto library from here would let that library
- * capture the missing global first and throw
- * `crypto.getRandomValues must be defined` for the lifetime of the app.
+ * must be fully installed before any module that reads `globalThis.crypto`
+ * at evaluation time is evaluated (`@noble/hashes` 1.x's `crypto.js` did, and
+ * threw `crypto.getRandomValues must be defined` for the lifetime of the app).
+ * Reaching a crypto library from here would evaluate it before the shim.
  *
  * `expo-crypto` is an OPTIONAL peer, so it is resolved with a string-literal
  * `require` inside a `try` (Metro's optional-dependency form; see

package/dist/esm/random.js

@@ -2,13 +2,12 @@
  * `@oxy.so/protocol/random` — the platform randomness source, and nothing else.
  *
  * `@oxy.so/core`'s crypto polyfill installs `globalThis.crypto.getRandomValues`
- * on hosts that lack it (React Native / Hermes). `@noble/hashes` 1.x captures
- * `globalThis.crypto` ONCE, when its `crypto.js` is evaluated, so the polyfill
- * has to be installed before any `@noble/*` module is evaluated. ES imports are
+ * on hosts that lack it (React Native / Hermes), and has to be installed before
+ * any module that reads `globalThis.crypto` is evaluated. ES imports are
  * evaluated before the importing module's body, so whatever the polyfill
  * imports is evaluated first: importing the ROOT entry (which reaches
- * `@noble/curves` through the envelope signer) let noble capture `undefined`
- * and broke identity creation on Android.
+ * `@noble/curves` through the envelope signer) let `@noble/hashes` 1.x capture
+ * `undefined` at evaluation and broke identity creation on Android.
  *
  * This entry therefore reaches no crypto library, no `@oxy.so/*` package and no
  * third-party module other than the optional `expo-crypto` peer (RN variant

package/dist/esm/secp256k1.js

@@ -109,10 +109,13 @@ export function normalizeSecp256k1PublicKey(publicKeyHex, compressed = false) {
  * accepts both forms; callers that require low-S normalization opt in explicitly.
  */
 export function signSecp256k1Digest(privateKeyHex, digestHex, options = {}) {
+    // The input is already a digest: `prehash: false` keeps noble from hashing it again.
     const signature = secp256k1.sign(parseDigest(digestHex), parsePrivateKey(privateKeyHex), {
+        prehash: false,
         lowS: options.lowS ?? false,
+        format: 'der',
     });
-    return signature.toHex('der');
+    return bytesToHex(signature);
 }
 /** Verify a DER-encoded ECDSA signature, accepting historical high-S signatures. */
 export function verifySecp256k1Digest(publicKeyHex, digestHex, signatureDerHex) {
@@ -122,6 +125,7 @@ export function verifySecp256k1Digest(publicKeyHex, digestHex, signatureDerHex)
     // Parse once up front so malformed or non-DER input is rejected explicitly.
     secp256k1.Signature.fromBytes(signature, 'der');
     return secp256k1.verify(signature, digest, publicKey, {
+        prehash: false,
         format: 'der',
         lowS: false,
     });

package/dist/types/auth/registrationPow.d.ts

@@ -24,7 +24,7 @@
  * platform hashing primitive and is trivially unit-testable with fixed
  * digests. Each side hashes with whatever SHA-256 it already has — Node's
  * `crypto` server-side (`packages/api/src/controllers/session.controller.ts`),
- * `@noble/hashes/sha256` client-side (`packages/core/src/crypto/registrationPow.ts`,
+ * `@noble/hashes/sha2.js`'s `sha256` client-side (`packages/core/src/crypto/registrationPow.ts`,
  * already a `@oxy.so/core` dependency — see `crypto/kdf.ts`,
  * `crypto/identityProof.ts`) — and both produce byte-identical digests over
  * the same message, because SHA-256 has exactly one correct output for a
@@ -67,7 +67,7 @@ export declare function registrationPowMessage(publicKey: string, timestamp: num
  * requires of a solved nonce's digest.
  *
  * 16 bits ⇒ 65,536 SHA-256 attempts on average to solve. The client grinds
- * with `@noble/hashes/sha256` — a pure-JS, SYNCHRONOUS implementation with
+ * with `@noble/hashes/sha2.js`'s `sha256` — a pure-JS, SYNCHRONOUS implementation with
  * "identical behaviour on web, Node, and React Native with zero WebCrypto /
  * native-module dependency" (its own doc comment in `crypto/kdf.ts`) — so,
  * unlike a solve loop built on a platform hashing primitive that crosses a

package/dist/types/platform/random.native.d.ts

@@ -6,11 +6,10 @@
  *
  * This module is deliberately tiny and imports NOTHING but `expo-crypto`: it
  * backs `@oxy.so/core`'s `globalThis.crypto.getRandomValues` polyfill, which
- * must be fully installed before any module that captures `globalThis.crypto`
- * at evaluation time (`@noble/hashes` 1.x's `crypto.js` does exactly that) is
- * evaluated. Reaching a crypto library from here would let that library
- * capture the missing global first and throw
- * `crypto.getRandomValues must be defined` for the lifetime of the app.
+ * must be fully installed before any module that reads `globalThis.crypto`
+ * at evaluation time is evaluated (`@noble/hashes` 1.x's `crypto.js` did, and
+ * threw `crypto.getRandomValues must be defined` for the lifetime of the app).
+ * Reaching a crypto library from here would evaluate it before the shim.
  *
  * `expo-crypto` is an OPTIONAL peer, so it is resolved with a string-literal
  * `require` inside a `try` (Metro's optional-dependency form; see

package/dist/types/random.d.ts

@@ -2,13 +2,12 @@
  * `@oxy.so/protocol/random` — the platform randomness source, and nothing else.
  *
  * `@oxy.so/core`'s crypto polyfill installs `globalThis.crypto.getRandomValues`
- * on hosts that lack it (React Native / Hermes). `@noble/hashes` 1.x captures
- * `globalThis.crypto` ONCE, when its `crypto.js` is evaluated, so the polyfill
- * has to be installed before any `@noble/*` module is evaluated. ES imports are
+ * on hosts that lack it (React Native / Hermes), and has to be installed before
+ * any module that reads `globalThis.crypto` is evaluated. ES imports are
  * evaluated before the importing module's body, so whatever the polyfill
  * imports is evaluated first: importing the ROOT entry (which reaches
- * `@noble/curves` through the envelope signer) let noble capture `undefined`
- * and broke identity creation on Android.
+ * `@noble/curves` through the envelope signer) let `@noble/hashes` 1.x capture
+ * `undefined` at evaluation and broke identity creation on Android.
  *
  * This entry therefore reaches no crypto library, no `@oxy.so/*` package and no
  * third-party module other than the optional `expo-crypto` peer (RN variant

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/protocol",
-  "version": "1.5.1",
+  "version": "1.6.0",
   "description": "Oxy Protocol — the app-agnostic base substrate: signed-record envelope, canonical JSON, signature/verification, and platform crypto. Reused by any Oxy app to decentralize its own content.",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -98,8 +98,10 @@
     "NOTICE",
     "dist",
     "!dist/**/*.tsbuildinfo",
-    "src"
+    "src",
+    "!dist/.oxy-source-digest"
   ],
+  "oxySourceStamp": "dist",
   "keywords": [
     "oxyhq",
     "protocol",
@@ -117,10 +119,10 @@
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://oxy.so",
   "engines": {
-    "node": ">=18.0.0"
+    "node": "^20.19.0 || >=22.12.0"
   },
   "scripts": {
-    "build": "bun run build:cjs && bun run build:esm && bun run build:types",
+    "build": "bun run build:cjs && bun run build:esm && bun run build:types && node -e \"const p='../app-preset/metro/source-stamp.js';require('node:fs').existsSync(p)&&require(p).writeStamp(process.cwd())\"",
     "build:cjs": "tsc -p tsconfig.cjs.json",
     "build:esm": "tsc -p tsconfig.esm.json && node scripts/fix-esm-imports.mjs",
     "build:types": "tsc -p tsconfig.types.json",
@@ -130,11 +132,11 @@
     "lint": "biome lint --error-on-warnings ./src"
   },
   "dependencies": {
-    "@noble/curves": "^1.9.7",
-    "@oxy.so/contracts": "^6.0.0"
+    "@noble/curves": "^2.4.0",
+    "@oxy.so/contracts": "^6.5.0"
   },
   "peerDependencies": {
-    "@react-native-async-storage/async-storage": "<3.0.0",
+    "@react-native-async-storage/async-storage": "<4.0.0",
     "expo-crypto": "<59.0.0",
     "expo-secure-store": "<59.0.0",
     "express": "^4.18.0 || ^5.0.0",
@@ -155,12 +157,12 @@
     }
   },
   "devDependencies": {
-    "@react-native-async-storage/async-storage": "^2.2.0",
+    "@react-native-async-storage/async-storage": "^3.1.1",
     "@types/express": "^4.17.25",
     "@types/node": "^22.20.1",
     "@types/supertest": "^6.0.2",
     "expo-crypto": "~56.0.3",
-    "expo-modules-core": "~58.0.22",
+    "expo-modules-core": "~58.0.26",
     "expo-secure-store": "~57.0.4",
     "express": "^4.22.2",
     "jest": "^30.5.1",

package/src/__tests__/randomEntry.test.ts

@@ -4,11 +4,10 @@
  *
  * `@oxy.so/core`'s crypto polyfill imports this entry to install
  * `globalThis.crypto.getRandomValues` on React Native. Everything the polyfill
- * imports is evaluated BEFORE the polyfill body, and `@noble/hashes` 1.x
- * captures `globalThis.crypto` once, at evaluation. When the polyfill imported
- * the root entry instead, noble was reached through the envelope signer,
- * captured `undefined`, and every Android identity creation failed with
- * `crypto.getRandomValues must be defined`. This guard keeps the entry's graph
+ * imports is evaluated BEFORE the polyfill body. When the polyfill imported
+ * the root entry instead, `@noble/hashes` 1.x was reached through the envelope
+ * signer, captured an absent `globalThis.crypto` at evaluation, and every
+ * Android identity creation failed with `crypto.getRandomValues must be defined`. This guard keeps the entry's graph
  * dependency-free, including the `.native` siblings Metro substitutes.
  */
 

package/src/auth/registrationPow.ts

@@ -24,7 +24,7 @@
  * platform hashing primitive and is trivially unit-testable with fixed
  * digests. Each side hashes with whatever SHA-256 it already has — Node's
  * `crypto` server-side (`packages/api/src/controllers/session.controller.ts`),
- * `@noble/hashes/sha256` client-side (`packages/core/src/crypto/registrationPow.ts`,
+ * `@noble/hashes/sha2.js`'s `sha256` client-side (`packages/core/src/crypto/registrationPow.ts`,
  * already a `@oxy.so/core` dependency — see `crypto/kdf.ts`,
  * `crypto/identityProof.ts`) — and both produce byte-identical digests over
  * the same message, because SHA-256 has exactly one correct output for a
@@ -102,7 +102,7 @@ export function registrationPowMessage(
  * requires of a solved nonce's digest.
  *
  * 16 bits ⇒ 65,536 SHA-256 attempts on average to solve. The client grinds
- * with `@noble/hashes/sha256` — a pure-JS, SYNCHRONOUS implementation with
+ * with `@noble/hashes/sha2.js`'s `sha256` — a pure-JS, SYNCHRONOUS implementation with
  * "identical behaviour on web, Node, and React Native with zero WebCrypto /
  * native-module dependency" (its own doc comment in `crypto/kdf.ts`) — so,
  * unlike a solve loop built on a platform hashing primitive that crosses a

package/src/platform/random.native.ts

@@ -6,11 +6,10 @@
  *
  * This module is deliberately tiny and imports NOTHING but `expo-crypto`: it
  * backs `@oxy.so/core`'s `globalThis.crypto.getRandomValues` polyfill, which
- * must be fully installed before any module that captures `globalThis.crypto`
- * at evaluation time (`@noble/hashes` 1.x's `crypto.js` does exactly that) is
- * evaluated. Reaching a crypto library from here would let that library
- * capture the missing global first and throw
- * `crypto.getRandomValues must be defined` for the lifetime of the app.
+ * must be fully installed before any module that reads `globalThis.crypto`
+ * at evaluation time is evaluated (`@noble/hashes` 1.x's `crypto.js` did, and
+ * threw `crypto.getRandomValues must be defined` for the lifetime of the app).
+ * Reaching a crypto library from here would evaluate it before the shim.
  *
  * `expo-crypto` is an OPTIONAL peer, so it is resolved with a string-literal
  * `require` inside a `try` (Metro's optional-dependency form; see

package/src/random.ts

@@ -2,13 +2,12 @@
  * `@oxy.so/protocol/random` — the platform randomness source, and nothing else.
  *
  * `@oxy.so/core`'s crypto polyfill installs `globalThis.crypto.getRandomValues`
- * on hosts that lack it (React Native / Hermes). `@noble/hashes` 1.x captures
- * `globalThis.crypto` ONCE, when its `crypto.js` is evaluated, so the polyfill
- * has to be installed before any `@noble/*` module is evaluated. ES imports are
+ * on hosts that lack it (React Native / Hermes), and has to be installed before
+ * any module that reads `globalThis.crypto` is evaluated. ES imports are
  * evaluated before the importing module's body, so whatever the polyfill
  * imports is evaluated first: importing the ROOT entry (which reaches
- * `@noble/curves` through the envelope signer) let noble capture `undefined`
- * and broke identity creation on Android.
+ * `@noble/curves` through the envelope signer) let `@noble/hashes` 1.x capture
+ * `undefined` at evaluation and broke identity creation on Android.
  *
  * This entry therefore reaches no crypto library, no `@oxy.so/*` package and no
  * third-party module other than the optional `expo-crypto` peer (RN variant

package/src/secp256k1.ts

@@ -144,10 +144,13 @@ export function signSecp256k1Digest(
   digestHex: string,
   options: Secp256k1SignatureOptions = {},
 ): string {
+  // The input is already a digest: `prehash: false` keeps noble from hashing it again.
   const signature = secp256k1.sign(parseDigest(digestHex), parsePrivateKey(privateKeyHex), {
+    prehash: false,
     lowS: options.lowS ?? false,
+    format: 'der',
   });
-  return signature.toHex('der');
+  return bytesToHex(signature);
 }
 
 /** Verify a DER-encoded ECDSA signature, accepting historical high-S signatures. */
@@ -163,6 +166,7 @@ export function verifySecp256k1Digest(
   // Parse once up front so malformed or non-DER input is rejected explicitly.
   secp256k1.Signature.fromBytes(signature, 'der');
   return secp256k1.verify(signature, digest, publicKey, {
+    prehash: false,
     format: 'der',
     lowS: false,
   });