@smartledger/bsv 7.12.0 → 7.13.0

package/lib/didweb/index.js

@@ -58,6 +58,44 @@ async function generateIssuerKeys(opts) {
   }
 }
 
+// The five verification relationships DID Core defines. They exist to be DISTINCT:
+// `authentication` proves who you are right now, `assertionMethod` makes a claim that
+// outlives the session. Keeping them apart is what stops a low-friction login signature
+// from being redeemed as a signed statement.
+//
+// This module used to cross-list every key into both, which erased the distinction and
+// left a caller unable to express "this key may log in but may not make assertions".
+var VERIFICATION_RELATIONSHIPS = [
+  'authentication',
+  'assertionMethod',
+  'keyAgreement',
+  'capabilityInvocation',
+  'capabilityDelegation'
+]
+
+// Preserves the historical output when a key does not say otherwise.
+var DEFAULT_RELATIONSHIPS = ['authentication', 'assertionMethod']
+
+/**
+ * Resolve the verification relationships for a key descriptor.
+ *
+ * @param {object} key - `{ kid, jwk, relationships? }`
+ * @returns {Array<string>}
+ */
+function relationshipsFor (key) {
+  var rels = key.relationships || DEFAULT_RELATIONSHIPS
+  if (!Array.isArray(rels) || rels.length === 0) {
+    throw new Error('relationships must be a non-empty array of DID Core verification relationships')
+  }
+  rels.forEach(function (rel) {
+    if (VERIFICATION_RELATIONSHIPS.indexOf(rel) === -1) {
+      throw new Error('unknown verification relationship: ' + rel +
+        ' (expected one of ' + VERIFICATION_RELATIONSHIPS.join(', ') + ')')
+    }
+  })
+  return rels
+}
+
 // Build did:web documents (did.json and jwks.json)
 function buildDidWebDocuments(params) {
   if (!params.domain) {
@@ -68,6 +106,7 @@ function buildDidWebDocuments(params) {
   var did = 'did:web:' + domain.replace(/:/g, '%3A')
   
   var verificationMethods = []
+  var methodRelationships = []
   var publicKeys = []
 
   // Add P-256 key if provided
@@ -79,6 +118,7 @@ function buildDidWebDocuments(params) {
       publicKeyJwk: params.p256.jwk
     }
     verificationMethods.push(p256Method)
+    methodRelationships.push(relationshipsFor(params.p256))
     publicKeys.push(params.p256.jwk)
   }
 
@@ -91,6 +131,7 @@ function buildDidWebDocuments(params) {
       publicKeyJwk: params.k1.jwk
     }
     verificationMethods.push(k1Method)
+    methodRelationships.push(relationshipsFor(params.k1))
     publicKeys.push(params.k1.jwk)
   }
 
@@ -105,11 +146,19 @@ function buildDidWebDocuments(params) {
       'https://w3id.org/security/suites/jws-2020/v1'
     ],
     id: did,
-    verificationMethod: verificationMethods,
-    authentication: verificationMethods.map(function(vm) { return vm.id }),
-    assertionMethod: verificationMethods.map(function(vm) { return vm.id })
+    verificationMethod: verificationMethods
   }
 
+  // Scope each key to the relationships it was given. Omitting `relationships`
+  // reproduces the previous output exactly (every key in both authentication and
+  // assertionMethod), so existing callers are unaffected.
+  VERIFICATION_RELATIONSHIPS.forEach(function (rel) {
+    var ids = verificationMethods
+      .filter(function (vm, i) { return methodRelationships[i].indexOf(rel) !== -1 })
+      .map(function (vm) { return vm.id })
+    if (ids.length) didDocument[rel] = ids
+  })
+
   if (params.controllerName) {
     didDocument.controller = params.controllerName
   }
@@ -144,6 +193,11 @@ function rotateIssuerKey(params) {
     publicKeyJwk: params.newKey.jwk
   }
 
+  // Which relationships this rotation actually replaces. Defaults to both, which is
+  // the historical behaviour.
+  var rotating = relationshipsFor(params.newKey)
+  var current = params.currentDocument || null
+
   // Build updated DID Document with new key as primary
   var didDocument = {
     '@context': [
@@ -151,13 +205,38 @@ function rotateIssuerKey(params) {
       'https://w3id.org/security/suites/jws-2020/v1'
     ],
     id: did,
-    verificationMethod: [newMethod],
-    authentication: [newMethod.id],
-    assertionMethod: [newMethod.id],
-    rotationInfo: {
-      rotatedAt: new Date().toISOString(),
-      gracePeriodDays: keepOldForDays
+    verificationMethod: [newMethod]
+  }
+
+  // A rotation must not silently reach beyond the relationship being rotated.
+  // Replacing a compromised `authentication` key used to rewrite `assertionMethod`
+  // too, which invalidates every statement the issuer has ever signed. Relationships
+  // outside `rotating` are carried across from `currentDocument` untouched; without a
+  // `currentDocument` there is nothing to carry, and the result matches the old output.
+  VERIFICATION_RELATIONSHIPS.forEach(function (rel) {
+    if (rotating.indexOf(rel) !== -1) {
+      didDocument[rel] = [newMethod.id]
+    } else if (current && Array.isArray(current[rel]) && current[rel].length) {
+      didDocument[rel] = current[rel].slice()
     }
+  })
+
+  // Keep the verification methods those carried-over relationships still point at,
+  // otherwise the document references key ids it does not define. The rotated-out key
+  // drops out here automatically: nothing references it any more.
+  if (current && Array.isArray(current.verificationMethod)) {
+    var referenced = {}
+    VERIFICATION_RELATIONSHIPS.forEach(function (rel) {
+      (didDocument[rel] || []).forEach(function (id) { referenced[id] = true })
+    })
+    current.verificationMethod.forEach(function (vm) {
+      if (referenced[vm.id] && vm.id !== newMethod.id) didDocument.verificationMethod.push(vm)
+    })
+  }
+
+  didDocument.rotationInfo = {
+    rotatedAt: new Date().toISOString(),
+    gracePeriodDays: keepOldForDays
   }
 
   var jwks = {

package/lib/encoding/base58.js

@@ -1,7 +1,6 @@
 'use strict'
 
 var _ = require('../util/_')
-var bs58 = require('bs58')
 var buffer = require('buffer')
 
 /**
@@ -11,6 +10,71 @@ var buffer = require('buffer')
  */
 var ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'.split('')
 
+// Reverse lookup for decoding. Built from ALPHABET so the two cannot disagree.
+var ALPHABET_MAP = {}
+for (var _i = 0; _i < ALPHABET.length; _i++) ALPHABET_MAP[ALPHABET[_i]] = _i
+
+/**
+ * Base58 encode/decode, replacing the `bs58` dependency (which also pulled `base-x`).
+ *
+ * This is the standard big-number-in-base-58 conversion: repeatedly multiply the
+ * accumulator by 256 (encode) or 58 (decode) and carry. Two details are where
+ * implementations usually go wrong, and both are exercised by the differential test in
+ * test/encoding/base58.js:
+ *
+ *   - Leading zero bytes are NOT part of the number — they are significant and each one
+ *     maps to a literal '1'. Dropping them silently truncates an address.
+ *   - The carry loops must run to completion before the next digit, or long inputs lose
+ *     the high-order bytes.
+ *
+ * These functions encode and decode addresses and WIF private keys, so they were
+ * verified by differential test against bs58 across 20,000 random inputs — including
+ * every leading-zero-count from 0 to 8 — before the dependency was removed.
+ */
+function base58encode (buf) {
+  if (buf.length === 0) return ''
+  var digits = [0]
+  var i, j, carry
+  for (i = 0; i < buf.length; i++) {
+    for (j = 0, carry = buf[i]; j < digits.length; j++) {
+      carry += digits[j] << 8
+      digits[j] = carry % 58
+      carry = (carry / 58) | 0
+    }
+    while (carry > 0) {
+      digits.push(carry % 58)
+      carry = (carry / 58) | 0
+    }
+  }
+  var out = ''
+  // Each leading zero byte is a significant '1', not part of the number.
+  for (i = 0; buf[i] === 0 && i < buf.length - 1; i++) out += ALPHABET[0]
+  for (i = digits.length - 1; i >= 0; i--) out += ALPHABET[digits[i]]
+  return out
+}
+
+function base58decode (str) {
+  if (str.length === 0) return Buffer.alloc(0)
+  var bytes = [0]
+  var i, j, carry
+  for (i = 0; i < str.length; i++) {
+    var value = ALPHABET_MAP[str[i]]
+    if (value === undefined) throw new Error('Non-base58 character')
+    for (j = 0, carry = value; j < bytes.length; j++) {
+      carry += bytes[j] * 58
+      bytes[j] = carry & 0xff
+      carry >>= 8
+    }
+    while (carry > 0) {
+      bytes.push(carry & 0xff)
+      carry >>= 8
+    }
+  }
+  // Mirror of the encode side: each leading '1' is a zero byte.
+  for (i = 0; str[i] === ALPHABET[0] && i < str.length - 1; i++) bytes.push(0)
+  return Buffer.from(bytes.reverse())
+}
+
 /**
  * A Base58 object can encode/decoded Base 58, which is used primarily for
  * string-formatted Bitcoin addresses and private keys. Addresses and private
@@ -54,7 +118,7 @@ Base58.encode = function (buf) {
   if (!buffer.Buffer.isBuffer(buf)) {
     throw new Error('Input should be a buffer')
   }
-  return bs58.encode(buf)
+  return base58encode(buf)
 }
 
 /**
@@ -67,7 +131,7 @@ Base58.decode = function (str) {
   if (typeof str !== 'string') {
     throw new Error('Input should be a string')
   }
-  return Buffer.from(bs58.decode(str))
+  return base58decode(str)
 }
 
 Base58.prototype.fromBuffer = function (buf) {

package/lib/mnemonic/mnemonic.js

@@ -2,7 +2,6 @@
 
 var HDPrivateKey = require('../hdprivatekey')
 var BN = require('../crypto/bn')
-var unorm = require('unorm')
 var _ = require('../util/_')
 
 var pbkdf2 = require('./pbkdf2')
@@ -16,6 +15,21 @@ var Random = require('../crypto/random')
 
 var $ = require('../util/preconditions')
 
+/**
+ * NFKD-normalise a mnemonic or passphrase, as BIP-39 requires before PBKDF2.
+ *
+ * Replaces the `unorm` dependency: `String.prototype.normalize` has been in the language
+ * since ES6 and this package requires Node >= 20.19, so the shim was redundant.
+ *
+ * Non-strings return '' so that `Mnemonic.isValid(garbage)` answers false instead of
+ * throwing. unorm was inconsistent about this — `[]` and `{}` returned '' while `['a']`
+ * and a Buffer threw — and a validity predicate that fails closed for every non-string
+ * is both the safer answer and the coherent one.
+ */
+function nfkd (str) {
+  return typeof str === 'string' ? str.normalize('NFKD') : ''
+}
+
 /**
  * This is an immutable class that represents a BIP39 Mnemonic code.
  * See BIP39 specification for more info: https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki
@@ -52,7 +66,7 @@ var Mnemonic = function (data, wordlist) {
   if (Buffer.isBuffer(data)) {
     seed = data
   } else if (_.isString(data)) {
-    phrase = unorm.nfkd(data)
+    phrase = nfkd(data)
   } else if (_.isNumber(data)) {
     ent = data
   } else if (data) {
@@ -145,7 +159,7 @@ Mnemonic.Words = require('./words')
  * @returns {boolean}
  */
 Mnemonic.isValid = function (mnemonic, wordlist) {
-  mnemonic = unorm.nfkd(mnemonic)
+  mnemonic = nfkd(mnemonic)
   wordlist = wordlist || Mnemonic._getDictionary(mnemonic)
 
   if (!wordlist) {
@@ -179,7 +193,7 @@ Mnemonic.isValid = function (mnemonic, wordlist) {
  * @returns {boolean}
  */
 Mnemonic._belongsToWordlist = function (mnemonic, wordlist) {
-  var words = unorm.nfkd(mnemonic).split(' ')
+  var words = nfkd(mnemonic).split(' ')
   for (var i = 0; i < words.length; i++) {
     var ind = wordlist.indexOf(words[i])
     if (ind < 0) return false
@@ -217,7 +231,7 @@ Mnemonic._getDictionary = function (mnemonic) {
  */
 Mnemonic.prototype.toSeed = function (passphrase) {
   passphrase = passphrase || ''
-  return pbkdf2(unorm.nfkd(this.phrase), unorm.nfkd('mnemonic' + passphrase), 2048, 64)
+  return pbkdf2(nfkd(this.phrase), nfkd('mnemonic' + passphrase), 2048, 64)
 }
 
 /**

package/lib/mnemonic/pbkdf2.js

@@ -1,2 +1,35 @@
-if (process.browser) module.exports = require('./pbkdf2.browser')
-else module.exports = require('./pbkdf2.node')
+'use strict'
+
+// Pick the PBKDF2 backend by CAPABILITY, not by `process.browser`. Same reasoning as
+// lib/crypto/hash.js: that flag is undefined in React Native, Deno, Workers and Bun, so
+// all of them took the node branch and required('crypto') — failing outright, or
+// resolving to a partial shim.
+//
+// The node variant needs `createHmac('sha512')`, so that is what is probed, and the
+// result is checked against RFC 4231 test case 1 rather than merely existing. A shim
+// that returns a wrong or stubbed HMAC would otherwise silently corrupt every seed
+// derived from a mnemonic — and unlike a crash, that failure is invisible until funds
+// are missing. The pure-JS fallback is audited and always safe.
+
+var RFC4231_CASE1 = '87aa7cdea5ef619d4ff0b4241a1d6cb02379f4e2ce4ec2787ad0b30545e17cdedaa833b7d6b8a702038b274eaea3f4e4be9d914eeb61f1702e696c203a126854'
+
+function nodeHmacIsUsable () {
+  var crypto
+  try {
+    crypto = require('crypto')
+  } catch (e) {
+    return false
+  }
+  if (!crypto || typeof crypto.createHmac !== 'function') return false
+
+  try {
+    var mac = crypto.createHmac('sha512', Buffer.alloc(20, 0x0b))
+      .update('Hi There')
+      .digest('hex')
+    return mac === RFC4231_CASE1
+  } catch (e) {
+    return false
+  }
+}
+
+module.exports = nodeHmacIsUsable() ? require('./pbkdf2.node') : require('./pbkdf2.browser')

package/lib/script/interpreter.js

@@ -8,7 +8,26 @@ var BN = require('../crypto/bn')
 var Hash = require('../crypto/hash')
 var Signature = require('../crypto/signature')
 var PublicKey = require('../publickey')
-var cloneDeep = require('clone-deep')
+/**
+ * Copy a script stack for the step listener, so a listener that mutates what it is
+ * handed cannot corrupt the running evaluation.
+ *
+ * Replaces the `clone-deep` dependency. The stack is an array of Buffers — every one of
+ * the 32 push sites in this file pushes a Buffer — so a shallow map with `Buffer.from`
+ * reproduces `cloneDeep(stack, true)` exactly for this input: same bytes, new backing
+ * memory, `Buffer.isBuffer` still true, empty buffers preserved.
+ *
+ * `structuredClone` is NOT a substitute: it returns Uint8Array for a Buffer input, which
+ * would silently change the type handed to every existing stepListener.
+ *
+ * Anything non-Buffer is passed through by reference. Nothing puts such a value on the
+ * stack today; if something ever does it will be a primitive, where sharing is harmless.
+ */
+function cloneStack (stack) {
+  return stack.map(function (item) {
+    return Buffer.isBuffer(item) ? Buffer.from(item) : item
+  })
+}
 
 /**
  * Bitcoin transactions contain scripts. Each input has a script called the
@@ -653,7 +672,7 @@ Interpreter.prototype.evaluate = function () {
 Interpreter.prototype._callbackStep = function (thisStep) {
   if (typeof this.stepListener === 'function') {
     try {
-      this.stepListener(thisStep, cloneDeep(this.stack, true), cloneDeep(this.altstack, true))
+      this.stepListener(thisStep, cloneStack(this.stack), cloneStack(this.altstack))
     } catch (err) {
       console.log(`Error in Step callback:${err}`)
     }

package/lib/transaction/input/multisig.js

@@ -1,7 +1,7 @@
 'use strict'
 
 var _ = require('../../util/_')
-var inherits = require('inherits')
+var inherits = require('../../util/inherits')
 var Input = require('./input')
 var Output = require('../output')
 var $ = require('../../util/preconditions')

package/lib/transaction/input/multisigscripthash.js

@@ -1,7 +1,7 @@
 'use strict'
 
 var _ = require('../../util/_')
-var inherits = require('inherits')
+var inherits = require('../../util/inherits')
 var Input = require('./input')
 var Output = require('../output')
 var $ = require('../../util/preconditions')

package/lib/transaction/input/publickey.js

@@ -1,6 +1,6 @@
 'use strict'
 
-var inherits = require('inherits')
+var inherits = require('../../util/inherits')
 
 var $ = require('../../util/preconditions')
 

package/lib/transaction/input/publickeyhash.js

@@ -1,6 +1,6 @@
 'use strict'
 
-var inherits = require('inherits')
+var inherits = require('../../util/inherits')
 
 var $ = require('../../util/preconditions')
 

package/lib/transaction/signature.js

@@ -2,7 +2,7 @@
 
 var _ = require('../util/_')
 var $ = require('../util/preconditions')
-var inherits = require('inherits')
+var inherits = require('../util/inherits')
 var JSUtil = require('../util/js')
 
 var PublicKey = require('../publickey')

package/lib/util/inherits.js

@@ -0,0 +1,37 @@
+'use strict'
+
+/**
+ * Set up prototypal inheritance between two constructors.
+ *
+ * Replaces the `inherits` dependency, whose modern branch this reproduces exactly:
+ * `ctor.super_` is assigned and `ctor.prototype` is REPLACED with an object whose
+ * prototype is `superCtor.prototype`.
+ *
+ * Two details are load-bearing and must not be "simplified" into
+ * `Object.setPrototypeOf(ctor.prototype, superCtor.prototype)`:
+ *
+ *   - `constructor` is redefined as non-enumerable. A plain assignment would make it
+ *     enumerable, so it would start showing up in `for…in` and in anything that walks
+ *     own+inherited keys — this library's `toObject`/`toJSON` paths among them.
+ *   - `ctor.super_` is part of the observable surface; `TransactionSignature` and the
+ *     four Input subclasses are public classes, so anything reading `.super_` today
+ *     keeps working.
+ *
+ * The package also carried an `Object.create`-less fallback for pre-ES5 browsers. That
+ * branch is unreachable on Node >= 20.19 and in every browser this library targets.
+ *
+ * @param {Function} ctor - the subclass constructor
+ * @param {Function} superCtor - the superclass constructor
+ */
+module.exports = function inherits (ctor, superCtor) {
+  if (!superCtor) return
+  ctor.super_ = superCtor
+  ctor.prototype = Object.create(superCtor.prototype, {
+    constructor: {
+      value: ctor,
+      enumerable: false,
+      writable: true,
+      configurable: true
+    }
+  })
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartledger/bsv",
-  "version": "7.12.0",
+  "version": "7.13.0",
   "description": "🚀 Complete Bitcoin SV development framework with legally-recognizable DID:web + W3C VC-JWT toolkit, Legal Token Protocol (LTP), Global Digital Attestation Framework (GDAF), StatusList2021 revocation, and 16 flexible loading options. Standards-based credentials with ES256/ES256K support, on-chain BSV anchoring, and comprehensive Bitcoin SV API. Perfect for legal tokens, verifiable credentials, DeFi, smart contracts, and secure Bitcoin applications.",
   "author": "SmartLedger Technology <hello@smartledger.technology> (https://smartledger.technology)",
   "homepage": "https://github.com/codenlighten/smartledger-bsv#readme",
@@ -231,12 +231,7 @@
     "@noble/curves": "2.2.0",
     "@noble/hashes": "2.2.0",
     "bn.js": "=4.12.5",
-    "bs58": "=4.0.1",
-    "clone-deep": "^4.0.1",
-    "hash.js": "^1.1.7",
-    "inherits": "2.0.4",
-    "secrets.js-grempe": "^2.0.0",
-    "unorm": "1.6.0"
+    "secrets.js-grempe": "^2.0.0"
   },
   "devDependencies": {
     "assert": "^2.1.0",
@@ -277,7 +272,8 @@
       "before",
       "beforeEach",
       "describe",
-      "it"
+      "it",
+      "globalThis"
     ],
     "ignore": [
       "dist/**",

package/test/crypto/backend_selection.js

@@ -0,0 +1,126 @@
+'use strict'
+
+/* global describe, it */
+
+// The hashing and PBKDF2 backends are chosen by CAPABILITY, not by `process.browser`.
+//
+// `process.browser` is a Browserify-era convention, undefined in React Native, Deno,
+// Cloudflare Workers and Bun. Every one of those took the node branch and
+// require('crypto')'d, which fails outright in React Native or — worse — resolves to a
+// partial shim. rn-nodeify and several RN starter templates register exactly such a
+// shim, so this is a reported failure mode, not a hypothetical one.
+//
+// Each case runs in a child process because it has to intercept module resolution
+// before lib/ is loaded, which cannot be undone safely in-process.
+
+require('chai').should()
+var path = require('path')
+var spawnSync = require('child_process').spawnSync
+
+var ROOT = path.resolve(__dirname, '../..')
+var SHA256_ABC = 'ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad'
+
+// Run `body` with Module._load intercepted by `stub`, and print the result of `report`.
+function inChild (stub, report) {
+  var src = [
+    'var Module = require("module"), orig = Module._load',
+    'var real = orig.call(Module, "crypto", module, false)',
+    'Module._load = function (r) {',
+    '  if (r === "crypto") { ' + stub + ' }',
+    '  return orig.apply(this, arguments)',
+    '}',
+    // Only the pure-JS backend is loaded for comparison. hash.node.js require()s
+    // 'crypto' at module scope, so it is not even loadable when the stub removes it —
+    // which is precisely why hash.js must not reach for it unconditionally.
+    'var HASH = require(' + JSON.stringify(path.join(ROOT, 'lib/crypto/hash.js')) + ')',
+    'var PURE = require(' + JSON.stringify(path.join(ROOT, 'lib/crypto/hash.browser.js')) + ')',
+    'console.log(' + report + ')'
+  ].join('\n')
+  var out = spawnSync(process.execPath, ['-e', src], { encoding: 'utf8' })
+  if (out.status !== 0) throw new Error('child failed: ' + out.stderr)
+  return out.stdout.trim()
+}
+
+describe('crypto backend selection', function () {
+  this.timeout(30000)
+
+  it('uses node crypto when it is present and correct', function () {
+    // Not the pure-JS module => the node backend was selected.
+    inChild('return real', '(HASH !== PURE) + " " + HASH.sha256(Buffer.from("abc")).toString("hex")')
+      .should.equal('true ' + SHA256_ABC)
+  })
+
+  it('falls back to the pure-JS backend when there is no crypto module', function () {
+    inChild('var e = new Error("no crypto"); e.code = "MODULE_NOT_FOUND"; throw e',
+      '(HASH === PURE) + " " + HASH.sha256(Buffer.from("abc")).toString("hex")')
+      .should.equal('true ' + SHA256_ABC)
+  })
+
+  // The important one. A shim that EXISTS but computes the wrong digest must be
+  // rejected — trusting it would silently corrupt every hash in the library, and a
+  // wrong hash is invisible until it matters.
+  it('rejects a crypto shim that returns incorrect digests', function () {
+    inChild(
+      'return { createHash: function () { return { update: function () { return this }, ' +
+      'digest: function () { return "deadbeef" } } } }',
+      '(HASH === PURE) + " " + HASH.sha256(Buffer.from("abc")).toString("hex")')
+      .should.equal('true ' + SHA256_ABC)
+  })
+
+  // OpenSSL 3 moved ripemd160 to the legacy provider, so some Node builds have sha256
+  // but throw on ripemd160 — and ripemd160 is what addresses are built from.
+  it('rejects a crypto build without ripemd160', function () {
+    inChild(
+      'return Object.assign({}, real, { createHash: function (a) { ' +
+      'if (a === "ripemd160") throw new Error("Digest method not supported"); ' +
+      'return real.createHash(a) } })',
+      '(HASH === PURE) + " " + HASH.sha256ripemd160(Buffer.from("abc")).toString("hex").slice(0, 16)')
+      .should.equal('true bb1be98c142444d7')
+  })
+
+  it('does not consult process.browser', function () {
+    var src = [
+      'process.browser = undefined',
+      'var a = require(' + JSON.stringify(path.join(ROOT, 'lib/crypto/hash.js')) + ')',
+      'console.log(a.sha256(Buffer.from("abc")).toString("hex"))'
+    ].join('\n')
+    var withoutFlag = spawnSync(process.execPath, ['-e', src], { encoding: 'utf8' })
+    var withFlag = spawnSync(process.execPath, ['-e', 'process.browser = true\n' + src.split('\n').slice(1).join('\n')], { encoding: 'utf8' })
+    withoutFlag.stdout.trim().should.equal(SHA256_ABC)
+    withFlag.stdout.trim().should.equal(SHA256_ABC)
+  })
+
+  describe('pbkdf2', function () {
+    // BIP-39 English test vector; the seed must not depend on which backend ran.
+    var PHRASE = 'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about'
+    var SEED = 'c55257c360c07c72029aebc1b53c05ed0362ada38ead3e3e9efa3708e53495531f09a6987599d18264c1e1c92f2cf141630c7a3c4ab7c81b2f001698e7463b04'
+
+    function seedInChild (stub) {
+      var src = [
+        'var Module = require("module"), orig = Module._load',
+        'var real = orig.call(Module, "crypto", module, false)',
+        'Module._load = function (r) { if (r === "crypto") { ' + stub + ' } return orig.apply(this, arguments) }',
+        'var bsv = require(' + JSON.stringify(ROOT) + ')',
+        'console.log(new bsv.Mnemonic(' + JSON.stringify(PHRASE) + ').toSeed("TREZOR").toString("hex"))'
+      ].join('\n')
+      var out = spawnSync(process.execPath, ['-e', src], { encoding: 'utf8' })
+      if (out.status !== 0) throw new Error('child failed: ' + out.stderr)
+      return out.stdout.trim()
+    }
+
+    it('derives the BIP-39 vector with node crypto', function () {
+      seedInChild('return real').should.equal(SEED)
+    })
+
+    it('derives the same seed with no crypto module', function () {
+      seedInChild('var e = new Error("no crypto"); e.code = "MODULE_NOT_FOUND"; throw e').should.equal(SEED)
+    })
+
+    it('rejects a shim whose HMAC is wrong and still derives the right seed', function () {
+      seedInChild(
+        'return Object.assign({}, real, { createHmac: function () { return { ' +
+        'update: function () { return this }, digest: function () { return Buffer.alloc(64) } } } })'
+      ).should.equal(SEED)
+    })
+  })
+})