@totemsdk/core 1.2.11 → 1.3.0

package/dist/cjs/index.js

@@ -22,8 +22,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createChallenge = exports.timingSafeEqual = exports.deserializeTransaction = exports.computeTransactionDigest = exports.serializeTransaction = exports.wotsAddressFromKeypair = exports.parseMxAddress = exports.makeMxAddress = exports.cleanSeedPhrase = exports.validatePhrase = exports.generateWordList = exports.phraseToSeed = exports.verifyMMRProof = exports.mmrRootFromPublicKeys = exports.verifyTreeSignature = exports.deriveUnifiedAddressPublicKey = exports.createUnifiedRootTreeKey = exports.createUnifiedChildTreeKey = exports.precomputeTransactionCoinID = exports.writeMiniString = exports.writeMiniData = exports.writeMiniNumber = exports.deriveRootPrivSeed = exports.derivePerAddressSeed = exports.deriveChainSeedJava = exports.wotsKeypairFromSeed = exports.wotsPublicKeyFromSeed = exports.wotsPkFromSig = exports.wotsVerifyDigest = exports.wotsVerify = exports.wotsSign = exports.deriveFullPublicKey = exports.derivePKdigest = exports.hashChain = exports.expandPrivateKey = exports.sha3_256 = exports.concatBytes = exports.hexToBytes = exports.bytesToHex = exports.TransactionReceiptStore = exports.WatermarkExhaustedError = exports.TransactionLifecycleError = exports.TransactionLifecycle = exports.TransactionService = exports.flatIndexFromLanes = exports.finalizeLease = exports.prepareLease = exports.LeaseMonitor = exports.WatermarkStore = exports.LeaseStore = void 0;
-exports.DEFAULT_KEYS_PER_LEVEL = exports.getRootPublicKey = exports.deserializeTreeSignature = exports.serializeTreeSignature = exports.TreeKeyNode = exports.TreeKey = exports.serializeMMREntry = exports.serializeMMRData = exports.serializeMMREntryNumber = exports.createMMREntryNumber = exports.deriveUnifiedChildSeed = exports.indexToMiniDataBytes = exports.javaHashAllObjects = exports.writeHashToStream = exports.serializeMiniNumberONE = exports.serializeMiniNumberZERO = exports.hashObject = exports.deriveChildTreeSeedJava = exports.hashAllObjects = exports.serializeMiniData = exports.serializeMiniNumber = exports.bigIntToByteArray = exports.concat = exports.writeSignatureProof = exports.writeSignature = exports.writeMMREntryNumber = exports.writeMiniByte = exports.normalizeHex = exports.deriveAddressFromPublicKey = exports.verifyTreeSignatureDetailed = exports.verifySignatureDetailed = exports.verifySignature = exports.buildMinimaCoin = exports.createDefaultTransaction = exports.serializeTokenDescriptor = exports.computeTokenId = exports.serializeTransactionObject = exports.serializeCoin = exports.parseDecimalToMiniNumber = exports.MiniNumber = exports.generateSeedPhrase = exports.convertWordListToSeed = exports.convertStringToSeed = exports.WORD_LIST = exports.addressToRoot = exports.scriptToAddress = exports.decodeMx = exports.encodeMx = exports.scriptFromWotsPk = exports.validateChallenge = void 0;
-exports.MINIMA_CONSTANTS = exports.bytesToUtf8 = exports.utf8ToBytes = exports.hashCanonical = exports.canonicalJson = exports.toHex = exports.wotsSignLegacy = exports.baseWWithChecksum = exports.toWinternitzDigits = exports.prfChainSeed = exports.h = exports.assert32 = exports.u32be = exports.u16be = exports.disableWotsLogger = exports.setWotsLogger = exports.fromHex = exports.hex = exports.F = exports.disableTreeKeyLogger = exports.setTreeKeyLogger = exports.createPerAddressTreeKeyAsync = exports.createPerAddressTreeKey = exports.createUnifiedChildTreeKeyAsync = exports.DEFAULT_LEVELS = void 0;
+exports.TreeKeyNode = exports.TreeKey = exports.serializeMMREntry = exports.serializeMMRData = exports.serializeMMREntryNumber = exports.createMMREntryNumber = exports.deriveUnifiedChildSeed = exports.indexToMiniDataBytes = exports.javaHashAllObjects = exports.writeHashToStream = exports.serializeMiniNumberONE = exports.serializeMiniNumberZERO = exports.hashObject = exports.deriveChildTreeSeedJava = exports.hashAllObjects = exports.serializeMiniData = exports.serializeMiniNumber = exports.bigIntToByteArray = exports.concat = exports.writeSignatureProof = exports.writeSignature = exports.writeMMREntryNumber = exports.writeMiniByte = exports.verifyDeterministicAddress = exports.deriveAddress = exports.deriveUnifiedAddress = exports.deriveDeterministicAddress = exports.normalizeHex = exports.deriveAddressFromPublicKey = exports.verifyTreeSignatureDetailed = exports.verifySignatureDetailed = exports.verifySignature = exports.buildMinimaCoin = exports.createDefaultTransaction = exports.serializeTokenDescriptor = exports.computeTokenId = exports.serializeTransactionObject = exports.serializeCoin = exports.parseDecimalToMiniNumber = exports.MiniNumber = exports.generateSeedPhrase = exports.convertWordListToSeed = exports.convertStringToSeed = exports.WORD_LIST = exports.addressToRoot = exports.scriptToAddress = exports.decodeMx = exports.encodeMx = exports.scriptFromWotsPk = exports.validateChallenge = void 0;
+exports.MINIMA_CONSTANTS = exports.bytesToUtf8 = exports.utf8ToBytes = exports.hashCanonical = exports.canonicalJson = exports.toHex = exports.wotsSignLegacy = exports.baseWWithChecksum = exports.toWinternitzDigits = exports.prfChainSeed = exports.h = exports.assert32 = exports.u32be = exports.u16be = exports.disableWotsLogger = exports.setWotsLogger = exports.fromHex = exports.hex = exports.F = exports.disableTreeKeyLogger = exports.setTreeKeyLogger = exports.createPerAddressTreeKeyAsync = exports.createPerAddressTreeKey = exports.createUnifiedChildTreeKeyAsync = exports.DEFAULT_LEVELS = exports.DEFAULT_KEYS_PER_LEVEL = exports.getRootPublicKey = exports.deserializeTreeSignature = exports.serializeTreeSignature = void 0;
 exports.mxToHex = mxToHex;
 // Version information for bundle duplication detection
 __exportStar(require("./version.js"), exports);
@@ -48,37 +48,38 @@ Object.defineProperty(exports, "TransactionReceiptStore", { enumerable: true, ge
 // Cryptographic primitives — backed by Rust/WASM (@totemsdk/core-wasm)
 // ---------------------------------------------------------------------------
 // Utilities
-var wasm_sync_js_1 = require("./wasm-sync.js");
-Object.defineProperty(exports, "bytesToHex", { enumerable: true, get: function () { return wasm_sync_js_1.bytesToHex; } });
-Object.defineProperty(exports, "hexToBytes", { enumerable: true, get: function () { return wasm_sync_js_1.hexToBytes; } });
-Object.defineProperty(exports, "concatBytes", { enumerable: true, get: function () { return wasm_sync_js_1.concatBytes; } });
-const wasm_sync_js_2 = require("./wasm-sync.js");
+var bytes_js_1 = require("./bytes.js");
+Object.defineProperty(exports, "bytesToHex", { enumerable: true, get: function () { return bytes_js_1.bytesToHex; } });
+Object.defineProperty(exports, "hexToBytes", { enumerable: true, get: function () { return bytes_js_1.hexToBytes; } });
+Object.defineProperty(exports, "concatBytes", { enumerable: true, get: function () { return bytes_js_1.concatBytes; } });
+const bytes_js_2 = require("./bytes.js");
+const wasm_sync_js_1 = require("./wasm-sync.js");
 // SHA3-256
-var wasm_sync_js_3 = require("./wasm-sync.js");
-Object.defineProperty(exports, "sha3_256", { enumerable: true, get: function () { return wasm_sync_js_3.sha3_256; } });
+var wasm_sync_js_2 = require("./wasm-sync.js");
+Object.defineProperty(exports, "sha3_256", { enumerable: true, get: function () { return wasm_sync_js_2.sha3_256; } });
 // WOTS Signatures
-var wasm_sync_js_4 = require("./wasm-sync.js");
-Object.defineProperty(exports, "expandPrivateKey", { enumerable: true, get: function () { return wasm_sync_js_4.expandPrivateKey; } });
-Object.defineProperty(exports, "hashChain", { enumerable: true, get: function () { return wasm_sync_js_4.hashChain; } });
-Object.defineProperty(exports, "derivePKdigest", { enumerable: true, get: function () { return wasm_sync_js_4.derivePKdigest; } });
-Object.defineProperty(exports, "deriveFullPublicKey", { enumerable: true, get: function () { return wasm_sync_js_4.deriveFullPublicKey; } });
-Object.defineProperty(exports, "wotsSign", { enumerable: true, get: function () { return wasm_sync_js_4.wotsSign; } });
-Object.defineProperty(exports, "wotsVerify", { enumerable: true, get: function () { return wasm_sync_js_4.wotsVerify; } });
-Object.defineProperty(exports, "wotsVerifyDigest", { enumerable: true, get: function () { return wasm_sync_js_4.wotsVerifyDigest; } });
-Object.defineProperty(exports, "wotsPkFromSig", { enumerable: true, get: function () { return wasm_sync_js_4.wotsPkFromSig; } });
-Object.defineProperty(exports, "wotsPublicKeyFromSeed", { enumerable: true, get: function () { return wasm_sync_js_4.wotsPublicKeyFromSeed; } });
-Object.defineProperty(exports, "wotsKeypairFromSeed", { enumerable: true, get: function () { return wasm_sync_js_4.wotsKeypairFromSeed; } });
+var wasm_sync_js_3 = require("./wasm-sync.js");
+Object.defineProperty(exports, "expandPrivateKey", { enumerable: true, get: function () { return wasm_sync_js_3.expandPrivateKey; } });
+Object.defineProperty(exports, "hashChain", { enumerable: true, get: function () { return wasm_sync_js_3.hashChain; } });
+Object.defineProperty(exports, "derivePKdigest", { enumerable: true, get: function () { return wasm_sync_js_3.derivePKdigest; } });
+Object.defineProperty(exports, "deriveFullPublicKey", { enumerable: true, get: function () { return wasm_sync_js_3.deriveFullPublicKey; } });
+Object.defineProperty(exports, "wotsSign", { enumerable: true, get: function () { return wasm_sync_js_3.wotsSign; } });
+Object.defineProperty(exports, "wotsVerify", { enumerable: true, get: function () { return wasm_sync_js_3.wotsVerify; } });
+Object.defineProperty(exports, "wotsVerifyDigest", { enumerable: true, get: function () { return wasm_sync_js_3.wotsVerifyDigest; } });
+Object.defineProperty(exports, "wotsPkFromSig", { enumerable: true, get: function () { return wasm_sync_js_3.wotsPkFromSig; } });
+Object.defineProperty(exports, "wotsPublicKeyFromSeed", { enumerable: true, get: function () { return wasm_sync_js_3.wotsPublicKeyFromSeed; } });
+Object.defineProperty(exports, "wotsKeypairFromSeed", { enumerable: true, get: function () { return wasm_sync_js_3.wotsKeypairFromSeed; } });
 // WOTS Params (from params.ts — constants, no crypto)
 __exportStar(require("./params.js"), exports);
 // Java-Compatible Serialization
-var wasm_sync_js_5 = require("./wasm-sync.js");
-Object.defineProperty(exports, "deriveChainSeedJava", { enumerable: true, get: function () { return wasm_sync_js_5.deriveChainSeedJava; } });
-Object.defineProperty(exports, "derivePerAddressSeed", { enumerable: true, get: function () { return wasm_sync_js_5.derivePerAddressSeed; } });
-Object.defineProperty(exports, "deriveRootPrivSeed", { enumerable: true, get: function () { return wasm_sync_js_5.deriveRootPrivSeed; } });
-Object.defineProperty(exports, "writeMiniNumber", { enumerable: true, get: function () { return wasm_sync_js_5.writeMiniNumber; } });
-Object.defineProperty(exports, "writeMiniData", { enumerable: true, get: function () { return wasm_sync_js_5.writeMiniData; } });
-Object.defineProperty(exports, "writeMiniString", { enumerable: true, get: function () { return wasm_sync_js_5.writeMiniString; } });
-Object.defineProperty(exports, "precomputeTransactionCoinID", { enumerable: true, get: function () { return wasm_sync_js_5.precomputeTransactionCoinID; } });
+var wasm_sync_js_4 = require("./wasm-sync.js");
+Object.defineProperty(exports, "deriveChainSeedJava", { enumerable: true, get: function () { return wasm_sync_js_4.deriveChainSeedJava; } });
+Object.defineProperty(exports, "derivePerAddressSeed", { enumerable: true, get: function () { return wasm_sync_js_4.derivePerAddressSeed; } });
+Object.defineProperty(exports, "deriveRootPrivSeed", { enumerable: true, get: function () { return wasm_sync_js_4.deriveRootPrivSeed; } });
+Object.defineProperty(exports, "writeMiniNumber", { enumerable: true, get: function () { return wasm_sync_js_4.writeMiniNumber; } });
+Object.defineProperty(exports, "writeMiniData", { enumerable: true, get: function () { return wasm_sync_js_4.writeMiniData; } });
+Object.defineProperty(exports, "writeMiniString", { enumerable: true, get: function () { return wasm_sync_js_4.writeMiniString; } });
+Object.defineProperty(exports, "precomputeTransactionCoinID", { enumerable: true, get: function () { return wasm_sync_js_4.precomputeTransactionCoinID; } });
 // TreeKey/TreeKeyNode — WASM-backed
 // createUnifiedChildTreeKey / createUnifiedRootTreeKey come from the TS
 // implementation (returning a full TreeKey object with setUses/sign/getPublicKey)
@@ -89,9 +90,9 @@ Object.defineProperty(exports, "createUnifiedChildTreeKey", { enumerable: true,
 Object.defineProperty(exports, "createUnifiedRootTreeKey", { enumerable: true, get: function () { return treekey_js_1.createUnifiedRootTreeKey; } });
 Object.defineProperty(exports, "deriveUnifiedAddressPublicKey", { enumerable: true, get: function () { return treekey_js_1.deriveUnifiedAddressPublicKey; } });
 Object.defineProperty(exports, "verifyTreeSignature", { enumerable: true, get: function () { return treekey_js_1.verifyTreeSignature; } });
-var wasm_sync_js_6 = require("./wasm-sync.js");
-Object.defineProperty(exports, "mmrRootFromPublicKeys", { enumerable: true, get: function () { return wasm_sync_js_6.mmrRootFromPublicKeys; } });
-Object.defineProperty(exports, "verifyMMRProof", { enumerable: true, get: function () { return wasm_sync_js_6.verifyMMRProof; } });
+var wasm_sync_js_5 = require("./wasm-sync.js");
+Object.defineProperty(exports, "mmrRootFromPublicKeys", { enumerable: true, get: function () { return wasm_sync_js_5.mmrRootFromPublicKeys; } });
+Object.defineProperty(exports, "verifyMMRProof", { enumerable: true, get: function () { return wasm_sync_js_5.verifyMMRProof; } });
 // BIP39 Seed Phrase Handling
 // The WASM binding (wasm-sync.ts) shares the canonical 2048-word BIP39 list
 // and Minima-compatible uppercase canonicalization with the TS implementation
@@ -104,22 +105,22 @@ Object.defineProperty(exports, "generateWordList", { enumerable: true, get: func
 Object.defineProperty(exports, "validatePhrase", { enumerable: true, get: function () { return bip39_js_1.validatePhrase; } });
 Object.defineProperty(exports, "cleanSeedPhrase", { enumerable: true, get: function () { return bip39_js_1.cleanSeedPhrase; } });
 // Address Derivation
-var wasm_sync_js_7 = require("./wasm-sync.js");
-Object.defineProperty(exports, "makeMxAddress", { enumerable: true, get: function () { return wasm_sync_js_7.makeMxAddress; } });
-Object.defineProperty(exports, "parseMxAddress", { enumerable: true, get: function () { return wasm_sync_js_7.parseMxAddress; } });
-Object.defineProperty(exports, "wotsAddressFromKeypair", { enumerable: true, get: function () { return wasm_sync_js_7.wotsAddressFromKeypair; } });
+var wasm_sync_js_6 = require("./wasm-sync.js");
+Object.defineProperty(exports, "makeMxAddress", { enumerable: true, get: function () { return wasm_sync_js_6.makeMxAddress; } });
+Object.defineProperty(exports, "parseMxAddress", { enumerable: true, get: function () { return wasm_sync_js_6.parseMxAddress; } });
+Object.defineProperty(exports, "wotsAddressFromKeypair", { enumerable: true, get: function () { return wasm_sync_js_6.wotsAddressFromKeypair; } });
 // Transaction Serialization & Digest
-var wasm_sync_js_8 = require("./wasm-sync.js");
-Object.defineProperty(exports, "serializeTransaction", { enumerable: true, get: function () { return wasm_sync_js_8.serializeTransaction; } });
-Object.defineProperty(exports, "computeTransactionDigest", { enumerable: true, get: function () { return wasm_sync_js_8.computeTransactionDigest; } });
+var wasm_sync_js_7 = require("./wasm-sync.js");
+Object.defineProperty(exports, "serializeTransaction", { enumerable: true, get: function () { return wasm_sync_js_7.serializeTransaction; } });
+Object.defineProperty(exports, "computeTransactionDigest", { enumerable: true, get: function () { return wasm_sync_js_7.computeTransactionDigest; } });
 // Transaction deserialization (byte-exact inverse of the TS serializer)
 var transaction_js_1 = require("./transaction.js");
 Object.defineProperty(exports, "deserializeTransaction", { enumerable: true, get: function () { return transaction_js_1.deserializeTransaction; } });
 // Verification
-var wasm_sync_js_9 = require("./wasm-sync.js");
-Object.defineProperty(exports, "timingSafeEqual", { enumerable: true, get: function () { return wasm_sync_js_9.timingSafeEqual; } });
-Object.defineProperty(exports, "createChallenge", { enumerable: true, get: function () { return wasm_sync_js_9.createChallenge; } });
-Object.defineProperty(exports, "validateChallenge", { enumerable: true, get: function () { return wasm_sync_js_9.validateChallenge; } });
+var wasm_sync_js_8 = require("./wasm-sync.js");
+Object.defineProperty(exports, "timingSafeEqual", { enumerable: true, get: function () { return wasm_sync_js_8.timingSafeEqual; } });
+Object.defineProperty(exports, "createChallenge", { enumerable: true, get: function () { return wasm_sync_js_8.createChallenge; } });
+Object.defineProperty(exports, "validateChallenge", { enumerable: true, get: function () { return wasm_sync_js_8.validateChallenge; } });
 // ---------------------------------------------------------------------------
 // TypeScript-only modules (no crypto — keep as-is)
 // ---------------------------------------------------------------------------
@@ -127,14 +128,14 @@ Object.defineProperty(exports, "validateChallenge", { enumerable: true, get: fun
 var script_js_1 = require("./script.js");
 Object.defineProperty(exports, "scriptFromWotsPk", { enumerable: true, get: function () { return script_js_1.scriptFromWotsPk; } });
 // Base32 Encoding (Minima-compatible) — re-export from WASM
-var wasm_sync_js_10 = require("./wasm-sync.js");
-Object.defineProperty(exports, "encodeMx", { enumerable: true, get: function () { return wasm_sync_js_10.makeMxAddress; } });
-Object.defineProperty(exports, "decodeMx", { enumerable: true, get: function () { return wasm_sync_js_10.parseMxAddress; } });
+var wasm_sync_js_9 = require("./wasm-sync.js");
+Object.defineProperty(exports, "encodeMx", { enumerable: true, get: function () { return wasm_sync_js_9.makeMxAddress; } });
+Object.defineProperty(exports, "decodeMx", { enumerable: true, get: function () { return wasm_sync_js_9.parseMxAddress; } });
 /** Convert an Mx (radix-32) or hex Minima address to lowercase hex. */
 function mxToHex(address) {
     const upper = address.startsWith('0x') || address.startsWith('0X') ? address.slice(2) : address;
     return upper.toUpperCase().startsWith('MX')
-        ? (0, wasm_sync_js_2.bytesToHex)((0, wasm_sync_js_2.parseMxAddress)(address))
+        ? (0, bytes_js_2.bytesToHex)((0, wasm_sync_js_1.parseMxAddress)(address))
         : upper.replace(/^0x/i, '');
 }
 // Merkle Mountain Range (original JS — types and helpers)
@@ -170,6 +171,12 @@ Object.defineProperty(exports, "verifySignatureDetailed", { enumerable: true, ge
 Object.defineProperty(exports, "verifyTreeSignatureDetailed", { enumerable: true, get: function () { return verify_js_1.verifyTreeSignatureDetailed; } });
 Object.defineProperty(exports, "deriveAddressFromPublicKey", { enumerable: true, get: function () { return verify_js_1.deriveAddressFromPublicKey; } });
 Object.defineProperty(exports, "normalizeHex", { enumerable: true, get: function () { return verify_js_1.normalizeHex; } });
+// Deterministic address derivation (CAN-005)
+var address_derivation_js_1 = require("./address-derivation.js");
+Object.defineProperty(exports, "deriveDeterministicAddress", { enumerable: true, get: function () { return address_derivation_js_1.deriveDeterministicAddress; } });
+Object.defineProperty(exports, "deriveUnifiedAddress", { enumerable: true, get: function () { return address_derivation_js_1.deriveUnifiedAddress; } });
+Object.defineProperty(exports, "deriveAddress", { enumerable: true, get: function () { return address_derivation_js_1.deriveAddress; } });
+Object.defineProperty(exports, "verifyDeterministicAddress", { enumerable: true, get: function () { return address_derivation_js_1.verifyDeterministicAddress; } });
 // Streamable primitives (low-level serialization building blocks)
 var Streamable_js_1 = require("./Streamable.js");
 Object.defineProperty(exports, "writeMiniByte", { enumerable: true, get: function () { return Streamable_js_1.writeMiniByte; } });
@@ -227,7 +234,8 @@ Object.defineProperty(exports, "wotsSignLegacy", { enumerable: true, get: functi
 var canonical_js_1 = require("./canonical.js");
 Object.defineProperty(exports, "toHex", { enumerable: true, get: function () { return canonical_js_1.toHex; } });
 Object.defineProperty(exports, "canonicalJson", { enumerable: true, get: function () { return canonical_js_1.canonicalJson; } });
-Object.defineProperty(exports, "hashCanonical", { enumerable: true, get: function () { return canonical_js_1.hashCanonical; } });
+var canonical_hash_js_1 = require("./canonical-hash.js");
+Object.defineProperty(exports, "hashCanonical", { enumerable: true, get: function () { return canonical_hash_js_1.hashCanonical; } });
 // Byte/string utilities
 var utils_js_1 = require("./utils.js");
 Object.defineProperty(exports, "utf8ToBytes", { enumerable: true, get: function () { return utils_js_1.utf8ToBytes; } });

package/dist/cjs/legacy.d.ts

@@ -1,12 +1,21 @@
 /**
- * Legacy JS implementations — backward compatibility.
+ * Legacy JS crypto kernels — **deprecated (RFC-031 P4), frozen**.
  *
- * These are the original TypeScript implementations preserved for
- * environments where WASM is not available. The main entry point
- * (`@totemsdk/core`) now delegates to WASM by default.
+ * @deprecated The pure-JS kernels are scheduled for removal (RFC-031 P5). Use
+ * the WASM surface instead:
+ *   - `@totemsdk/core` / `@totemsdk/core/wasm` — synchronous WASM (bundler loader required)
+ *   - `@totemsdk/core/wasm-async` — async-init WASM (portable to edge/Workers)
  *
- * Import legacy implementations directly:
- *   import { wotsSign } from '@totemsdk/core/legacy';
+ * This entry stays only as a migration bridge for environments that cannot run
+ * WASM yet; it is **frozen** (no new kernels are added here) and will be deleted
+ * in a major release. Exports are `legacy`-prefixed where they collide with the
+ * WASM names (`legacyWotsSign`, …).
+ *
+ *   // before
+ *   import { legacyWotsSign } from '@totemsdk/core/legacy';
+ *   // after
+ *   import { init, wotsSign } from '@totemsdk/core/wasm-async';
+ *   await init();
  */
 export { F, hex, fromHex, u16be, u32be, assert32, h, prfChainSeed, toWinternitzDigits, baseWWithChecksum, derivePKdigest as legacyDerivePKdigest, wotsKeypairFromSeed as legacyWotsKeypairFromSeed, wotsSign as legacyWotsSign, wotsSignLegacy, wotsPkFromSig as legacyWotsPkFromSig, wotsVerify as legacyWotsVerify, wotsVerifyDigest as legacyWotsVerifyDigest, wotsPublicKeyFromSeed as legacyWotsPublicKeyFromSeed, type WotsKeypair, type WotsSignature, } from './wots.js';
 export { TreeKey, TreeKeyNode, verifyTreeSignature as legacyVerifyTreeSignature, serializeTreeSignature, deserializeTreeSignature, getRootPublicKey, DEFAULT_KEYS_PER_LEVEL, DEFAULT_LEVELS, createUnifiedChildTreeKey as legacyCreateUnifiedChildTreeKey, createUnifiedChildTreeKeyAsync, createUnifiedRootTreeKey as legacyCreateUnifiedRootTreeKey, deriveUnifiedAddressPublicKey as legacyDeriveUnifiedAddressPublicKey, createPerAddressTreeKey, createPerAddressTreeKeyAsync, type KeyGenProgress, type ProgressCallback, type SignatureProof, type TreeSignature, } from './treekey.js';

package/dist/cjs/legacy.js

@@ -1,13 +1,22 @@
 "use strict";
 /**
- * Legacy JS implementations — backward compatibility.
+ * Legacy JS crypto kernels — **deprecated (RFC-031 P4), frozen**.
  *
- * These are the original TypeScript implementations preserved for
- * environments where WASM is not available. The main entry point
- * (`@totemsdk/core`) now delegates to WASM by default.
+ * @deprecated The pure-JS kernels are scheduled for removal (RFC-031 P5). Use
+ * the WASM surface instead:
+ *   - `@totemsdk/core` / `@totemsdk/core/wasm` — synchronous WASM (bundler loader required)
+ *   - `@totemsdk/core/wasm-async` — async-init WASM (portable to edge/Workers)
  *
- * Import legacy implementations directly:
- *   import { wotsSign } from '@totemsdk/core/legacy';
+ * This entry stays only as a migration bridge for environments that cannot run
+ * WASM yet; it is **frozen** (no new kernels are added here) and will be deleted
+ * in a major release. Exports are `legacy`-prefixed where they collide with the
+ * WASM names (`legacyWotsSign`, …).
+ *
+ *   // before
+ *   import { legacyWotsSign } from '@totemsdk/core/legacy';
+ *   // after
+ *   import { init, wotsSign } from '@totemsdk/core/wasm-async';
+ *   await init();
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;

package/dist/cjs/scripts/contract-helpers.js

@@ -17,9 +17,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.StatefulGameHelper = exports.SlowCashHelper = exports.FlashCashHelper = exports.VaultHelper = exports.ExchangeHelper = exports.MASTHelper = exports.HTLCHelper = exports.TimelockHelper = void 0;
 const wasm_sync_js_1 = require("../wasm-sync.js");
-const node_crypto_1 = require("node:crypto");
+const sha256_js_1 = require("@noble/hashes/sha256.js");
 function sha256(data) {
-    return new Uint8Array((0, node_crypto_1.createHash)('sha256').update(data).digest());
+    return (0, sha256_js_1.sha256)(data);
 }
 const types_js_1 = require("./types.js");
 function kissHex(hex) {
@@ -83,7 +83,7 @@ class HTLCHelper {
      * Generate a random preimage and its hash.
      */
     static generateSecret() {
-        const preimageBytes = (0, node_crypto_1.randomBytes)(32);
+        const preimageBytes = globalThis.crypto.getRandomValues(new Uint8Array(32));
         const preimage = bytesToHex(preimageBytes);
         const hashBytes = (0, wasm_sync_js_1.sha3_256)(preimageBytes);
         const hash = bytesToHex(hashBytes);

package/dist/cjs/wasm-sync.d.ts

@@ -8,7 +8,7 @@
  *   import { wotsSign, sha3_256 } from '@totemsdk/core/wasm';
  *   const sig = wotsSign(seed, 0, message); // synchronous!
  */
-import { bytes_to_hex_wasm, clean_seed_phrase_wasm, compute_transaction_digest_wasm, concat_bytes_wasm, create_challenge_wasm, create_unified_child_tree_key_wasm, create_unified_root_tree_key_wasm, derive_chain_seed_wasm, derive_full_public_key_batch_wasm, derive_full_public_key_wasm, derive_per_address_seed_wasm, derive_pk_digest_batch_wasm, derive_pk_digest_wasm, derive_root_priv_seed_wasm, derive_unified_address_public_key_wasm, expand_private_key_wasm, generate_mnemonic_wasm, get_params, hash_chain_wasm, hex_to_bytes_wasm, make_mx_address_wasm, mine_txpow_chunk_wasm, mine_txpow_wasm, mmr_root_from_public_keys_wasm, parse_mx_address_wasm, phrase_to_seed_wasm, precompute_transaction_coin_id_wasm, serialize_transaction_wasm, sha3_256_wasm, timing_safe_equal_wasm, validate_challenge_wasm, validate_phrase_wasm, verify_mmr_proof_wasm, verify_tree_signature_wasm, wasm_tree_key_free, wasm_tree_key_get_max_uses, wasm_tree_key_get_public_key, wasm_tree_key_get_uses, wasm_tree_key_new, wasm_tree_key_set_uses, wasm_tree_key_sign, wots_pk_from_sig_wasm, wots_sign_batch_wasm, wots_sign_wasm, wots_verify_digest_wasm, wots_verify_wasm, write_mini_data_wasm, write_mini_string_wasm } from '@totemsdk/core-wasm';
+import { bytes_to_hex_wasm, clean_seed_phrase_wasm, compute_transaction_digest_wasm, concat_bytes_wasm, create_unified_child_tree_key_wasm, create_unified_root_tree_key_wasm, derive_chain_seed_wasm, derive_full_public_key_batch_wasm, derive_full_public_key_wasm, derive_per_address_seed_wasm, derive_pk_digest_batch_wasm, derive_pk_digest_wasm, derive_root_priv_seed_wasm, derive_unified_address_public_key_wasm, expand_private_key_wasm, generate_mnemonic_wasm, get_params, hash_chain_wasm, hex_to_bytes_wasm, make_mx_address_wasm, mine_txpow_chunk_wasm, mine_txpow_wasm, mmr_root_from_public_keys_wasm, parse_mx_address_wasm, phrase_to_seed_wasm, precompute_transaction_coin_id_wasm, serialize_transaction_wasm, sha3_256_wasm, timing_safe_equal_wasm, validate_phrase_wasm, verify_mmr_proof_wasm, verify_tree_signature_wasm, wasm_tree_key_free, wasm_tree_key_get_max_uses, wasm_tree_key_get_public_key, wasm_tree_key_get_uses, wasm_tree_key_new, wasm_tree_key_set_uses, wasm_tree_key_sign, wots_pk_from_sig_wasm, wots_sign_batch_wasm, wots_sign_wasm, wots_verify_digest_wasm, wots_verify_wasm, write_mini_data_wasm, write_mini_string_wasm } from '@totemsdk/core-wasm';
 export declare const bytesToHex: typeof bytes_to_hex_wasm;
 export declare const hexToBytes: typeof hex_to_bytes_wasm;
 export declare const concatBytes: typeof concat_bytes_wasm;
@@ -41,8 +41,8 @@ export declare const computeTransactionDigest: typeof compute_transaction_digest
 export declare const precomputeTransactionCoinID: typeof precompute_transaction_coin_id_wasm;
 export declare const verifyTreeSignature: typeof verify_tree_signature_wasm;
 export declare const timingSafeEqual: typeof timing_safe_equal_wasm;
-export declare const createChallenge: typeof create_challenge_wasm;
-export declare const validateChallenge: typeof validate_challenge_wasm;
+export declare function createChallenge(domain: string, statement: string): string;
+export declare function validateChallenge(challengeJson: string, domain: string): boolean;
 export declare function writeMiniNumber(value: bigint, scale?: number): Uint8Array;
 export declare const writeMiniData: typeof write_mini_data_wasm;
 export declare const writeMiniString: typeof write_mini_string_wasm;

package/dist/cjs/wasm-sync.js

@@ -10,8 +10,10 @@
  *   const sig = wotsSign(seed, 0, message); // synchronous!
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.wasmTreeKeyFree = exports.wasmTreeKeyGetMaxUses = exports.wasmTreeKeySetUses = exports.wasmTreeKeyGetUses = exports.wasmTreeKeyGetPublicKey = exports.wasmTreeKeySign = exports.wasmTreeKeyNew = exports.mineTxPoWChunk = exports.mineTxPoW = exports.deriveFullPublicKeyBatch = exports.derivePKdigestBatch = exports.wotsSignBatch = exports.getParams = exports.verifyMMRProof = exports.mmrRootFromPublicKeys = exports.deriveUnifiedAddressPublicKey = exports.createUnifiedRootTreeKey = exports.createUnifiedChildTreeKey = exports.writeMiniString = exports.writeMiniData = exports.validateChallenge = exports.createChallenge = exports.timingSafeEqual = exports.verifyTreeSignature = exports.precomputeTransactionCoinID = exports.computeTransactionDigest = exports.serializeTransaction = exports.parseMxAddress = exports.makeMxAddress = exports.cleanSeedPhrase = exports.validatePhrase = exports.generateWordList = exports.phraseToSeed = exports.deriveRootPrivSeed = exports.derivePerAddressSeed = exports.deriveChainSeedJava = exports.wotsPublicKeyFromSeed = exports.wotsPkFromSig = exports.wotsVerifyDigest = exports.wotsVerify = exports.wotsSign = exports.deriveFullPublicKey = exports.derivePKdigest = exports.hashChain = exports.expandPrivateKey = exports.sha3_256 = exports.concatBytes = exports.hexToBytes = exports.bytesToHex = void 0;
+exports.wasmTreeKeyFree = exports.wasmTreeKeyGetMaxUses = exports.wasmTreeKeySetUses = exports.wasmTreeKeyGetUses = exports.wasmTreeKeyGetPublicKey = exports.wasmTreeKeySign = exports.wasmTreeKeyNew = exports.mineTxPoWChunk = exports.mineTxPoW = exports.deriveFullPublicKeyBatch = exports.derivePKdigestBatch = exports.wotsSignBatch = exports.getParams = exports.verifyMMRProof = exports.mmrRootFromPublicKeys = exports.deriveUnifiedAddressPublicKey = exports.createUnifiedRootTreeKey = exports.createUnifiedChildTreeKey = exports.writeMiniString = exports.writeMiniData = exports.timingSafeEqual = exports.verifyTreeSignature = exports.precomputeTransactionCoinID = exports.computeTransactionDigest = exports.serializeTransaction = exports.parseMxAddress = exports.makeMxAddress = exports.cleanSeedPhrase = exports.validatePhrase = exports.generateWordList = exports.phraseToSeed = exports.deriveRootPrivSeed = exports.derivePerAddressSeed = exports.deriveChainSeedJava = exports.wotsPublicKeyFromSeed = exports.wotsPkFromSig = exports.wotsVerifyDigest = exports.wotsVerify = exports.wotsSign = exports.deriveFullPublicKey = exports.derivePKdigest = exports.hashChain = exports.expandPrivateKey = exports.sha3_256 = exports.concatBytes = exports.hexToBytes = exports.bytesToHex = void 0;
 exports.wotsAddressFromKeypair = wotsAddressFromKeypair;
+exports.createChallenge = createChallenge;
+exports.validateChallenge = validateChallenge;
 exports.writeMiniNumber = writeMiniNumber;
 exports.wotsKeypairFromSeed = wotsKeypairFromSeed;
 // The bundler target initializes WASM synchronously at import time.
@@ -55,8 +57,13 @@ exports.computeTransactionDigest = core_wasm_1.compute_transaction_digest_wasm;
 exports.precomputeTransactionCoinID = core_wasm_1.precompute_transaction_coin_id_wasm;
 exports.verifyTreeSignature = core_wasm_1.verify_tree_signature_wasm;
 exports.timingSafeEqual = core_wasm_1.timing_safe_equal_wasm;
-exports.createChallenge = core_wasm_1.create_challenge_wasm;
-exports.validateChallenge = core_wasm_1.validate_challenge_wasm;
+// SystemTime panics on wasm32-unknown-unknown; supply the clock from JS.
+function createChallenge(domain, statement) {
+    return (0, core_wasm_1.create_challenge_wasm)(domain, statement, Math.floor(Date.now() / 1000));
+}
+function validateChallenge(challengeJson, domain) {
+    return (0, core_wasm_1.validate_challenge_wasm)(challengeJson, domain, Math.floor(Date.now() / 1000));
+}
 function writeMiniNumber(value, scale = 0) {
     return (0, core_wasm_1.write_mini_number_wasm)(value.toString(), scale);
 }

package/dist/index.d.ts

@@ -10,7 +10,7 @@ export * from './adapters/index.js';
 export { LeaseStore, WatermarkStore, LeaseMonitor, prepareLease, finalizeLease, flatIndexFromLanes, type StoredLease, type LeaseStatus, type LeaseStoreConfig, type LeaseWotsIndices, type WatermarkState, type SyncResult, type WatermarkStoreConfig, type LeaseExpiryEvent, type LeaseExpiryCallback, type LeaseMonitorConfig, type PrepareArgs, type PrepareResp, } from './lease/index.js';
 export { TransactionService, TransactionLifecycle, TransactionLifecycleError, WatermarkExhaustedError, TransactionReceiptStore, type TransactionServiceConfig, type WotsSigningDependencies, type TransactionLifecycleConfig, type WatermarkSyncFunction, type PrepareResult, type TransactionReceiptStoreConfig, type PrepareRequest, type PrepareResponse, type SignRequest, type SignResult, type HierarchicalWitnessBundle, type WitnessBundle, type FinalizeRequest, type FinalizeResponse, type TransactionMetadata, type TransactionReceipt, type TransactionError, } from './tx/index.js';
 export type { WotsIndices } from './tx/index.js';
-export { bytesToHex, hexToBytes, concatBytes } from './wasm-sync.js';
+export { bytesToHex, hexToBytes, concatBytes } from './bytes.js';
 export { sha3_256 } from './wasm-sync.js';
 export { expandPrivateKey, hashChain, derivePKdigest, deriveFullPublicKey, wotsSign, wotsVerify, wotsVerifyDigest, wotsPkFromSig, wotsPublicKeyFromSeed, wotsKeypairFromSeed, } from './wasm-sync.js';
 export * from './params.js';
@@ -33,12 +33,14 @@ export { WORD_LIST, convertStringToSeed, convertWordListToSeed, generateSeedPhra
 export { MiniNumber } from './MiniNumber.js';
 export { type MinimaTransaction, type MinimaCoin, type ParsedMiniNumber, type MinimaToken, type StateVariable, type RawStateVariable, type CoinProofData, type SpendableCoinInput, type TransactionBuildResult, parseDecimalToMiniNumber, serializeCoin, serializeTransaction as serializeTransactionObject, computeTokenId, serializeTokenDescriptor, createDefaultTransaction, buildMinimaCoin, } from './transaction.js';
 export { verifySignature, verifySignatureDetailed, verifyTreeSignatureDetailed, deriveAddressFromPublicKey, normalizeHex, type VerificationResult, } from './verify.js';
+export { deriveDeterministicAddress, deriveUnifiedAddress, deriveAddress, verifyDeterministicAddress, type AddressScheme, type DerivedAddress, } from './address-derivation.js';
 export { writeMiniByte, writeMMREntryNumber, writeSignature, writeSignatureProof, concat, bigIntToByteArray, type Bytes, } from './Streamable.js';
 export { serializeMiniNumber, serializeMiniData, hashAllObjects, deriveChildTreeSeedJava, hashObject, serializeMiniNumberZERO, serializeMiniNumberONE, writeHashToStream, javaHashAllObjects, indexToMiniDataBytes, deriveUnifiedChildSeed, createMMREntryNumber, serializeMMREntryNumber, serializeMMRData, serializeMMREntry, type MMREntryNumber as JavaMMREntryNumber, type MMRData as JavaMMRData, type MMREntry as JavaMMREntry, } from './javaStreamables.js';
 export { TreeKey, TreeKeyNode, serializeTreeSignature, deserializeTreeSignature, getRootPublicKey, DEFAULT_KEYS_PER_LEVEL, DEFAULT_LEVELS, createUnifiedChildTreeKeyAsync, createPerAddressTreeKey, createPerAddressTreeKeyAsync, setTreeKeyLogger, disableTreeKeyLogger, type KeyGenProgress, type ProgressCallback, type SignatureProof, type TreeSignature, } from './treekey.js';
 export type { WotsKeypair, WotsSignature } from './wots.js';
 export { F, hex, fromHex, setWotsLogger, disableWotsLogger, u16be, u32be, assert32, h, prfChainSeed, toWinternitzDigits, baseWWithChecksum, wotsSignLegacy, } from './wots.js';
-export { toHex, canonicalJson, hashCanonical } from './canonical.js';
+export { toHex, canonicalJson } from './canonical.js';
+export { hashCanonical } from './canonical-hash.js';
 export { utf8ToBytes, bytesToUtf8 } from './utils.js';
 export declare const MINIMA_CONSTANTS: {
     readonly WOTS_W: 8;

package/dist/index.js

@@ -17,23 +17,24 @@ export { TransactionService, TransactionLifecycle, TransactionLifecycleError, Wa
 // Cryptographic primitives — backed by Rust/WASM (@totemsdk/core-wasm)
 // ---------------------------------------------------------------------------
 // Utilities
-export { bytesToHex, hexToBytes, concatBytes } from './wasm-sync.js';
-import { bytesToHex, parseMxAddress } from './wasm-sync.js';
+export { bytesToHex, hexToBytes, concatBytes } from './bytes.js';
+import { bytesToHex } from './bytes.js';
+import { parseMxAddress } from './wasm-async.js';
 // SHA3-256
-export { sha3_256 } from './wasm-sync.js';
+export { sha3_256 } from './wasm-async.js';
 // WOTS Signatures
-export { expandPrivateKey, hashChain, derivePKdigest, deriveFullPublicKey, wotsSign, wotsVerify, wotsVerifyDigest, wotsPkFromSig, wotsPublicKeyFromSeed, wotsKeypairFromSeed, } from './wasm-sync.js';
+export { expandPrivateKey, hashChain, derivePKdigest, deriveFullPublicKey, wotsSign, wotsVerify, wotsVerifyDigest, wotsPkFromSig, wotsPublicKeyFromSeed, wotsKeypairFromSeed, } from './wasm-async.js';
 // WOTS Params (from params.ts — constants, no crypto)
 export * from './params.js';
 // Java-Compatible Serialization
-export { deriveChainSeedJava, derivePerAddressSeed, deriveRootPrivSeed, writeMiniNumber, writeMiniData, writeMiniString, precomputeTransactionCoinID, } from './wasm-sync.js';
+export { deriveChainSeedJava, derivePerAddressSeed, deriveRootPrivSeed, writeMiniNumber, writeMiniData, writeMiniString, precomputeTransactionCoinID, } from './wasm-async.js';
 // TreeKey/TreeKeyNode — WASM-backed
 // createUnifiedChildTreeKey / createUnifiedRootTreeKey come from the TS
 // implementation (returning a full TreeKey object with setUses/sign/getPublicKey)
 // to match the object API that downstream consumers (server, root-identity)
 // rely on. The WASM binding only returns the root public key bytes.
 export { createUnifiedChildTreeKey, createUnifiedRootTreeKey, deriveUnifiedAddressPublicKey, verifyTreeSignature, } from './treekey.js';
-export { mmrRootFromPublicKeys, verifyMMRProof, } from './wasm-sync.js';
+export { mmrRootFromPublicKeys, verifyMMRProof, } from './wasm-async.js';
 // BIP39 Seed Phrase Handling
 // The WASM binding (wasm-sync.ts) shares the canonical 2048-word BIP39 list
 // and Minima-compatible uppercase canonicalization with the TS implementation
@@ -42,20 +43,20 @@ export { mmrRootFromPublicKeys, verifyMMRProof, } from './wasm-sync.js';
 // canonical source of truth and avoids double-entering the list.
 export { phraseToSeed, generateWordList, validatePhrase, cleanSeedPhrase, } from './bip39.js';
 // Address Derivation
-export { makeMxAddress, parseMxAddress, wotsAddressFromKeypair, } from './wasm-sync.js';
+export { makeMxAddress, parseMxAddress, wotsAddressFromKeypair, } from './wasm-async.js';
 // Transaction Serialization & Digest
-export { serializeTransaction, computeTransactionDigest, } from './wasm-sync.js';
+export { serializeTransaction, computeTransactionDigest, } from './wasm-async.js';
 // Transaction deserialization (byte-exact inverse of the TS serializer)
 export { deserializeTransaction } from './transaction.js';
 // Verification
-export { timingSafeEqual, createChallenge, validateChallenge, } from './wasm-sync.js';
+export { timingSafeEqual, createChallenge, validateChallenge, } from './wasm-async.js';
 // ---------------------------------------------------------------------------
 // TypeScript-only modules (no crypto — keep as-is)
 // ---------------------------------------------------------------------------
 // Script helpers (for address derivation)
 export { scriptFromWotsPk } from './script.js';
 // Base32 Encoding (Minima-compatible) — re-export from WASM
-export { makeMxAddress as encodeMx, parseMxAddress as decodeMx } from './wasm-sync.js';
+export { makeMxAddress as encodeMx, parseMxAddress as decodeMx } from './wasm-async.js';
 /** Convert an Mx (radix-32) or hex Minima address to lowercase hex. */
 export function mxToHex(address) {
     const upper = address.startsWith('0x') || address.startsWith('0X') ? address.slice(2) : address;
@@ -77,6 +78,8 @@ export { MiniNumber } from './MiniNumber.js';
 export { parseDecimalToMiniNumber, serializeCoin, serializeTransaction as serializeTransactionObject, computeTokenId, serializeTokenDescriptor, createDefaultTransaction, buildMinimaCoin, } from './transaction.js';
 // High-level Verification API (convenience functions for integrators)
 export { verifySignature, verifySignatureDetailed, verifyTreeSignatureDetailed, deriveAddressFromPublicKey, normalizeHex, } from './verify.js';
+// Deterministic address derivation (CAN-005)
+export { deriveDeterministicAddress, deriveUnifiedAddress, deriveAddress, verifyDeterministicAddress, } from './address-derivation.js';
 // Streamable primitives (low-level serialization building blocks)
 export { writeMiniByte, writeMMREntryNumber, writeSignature, writeSignatureProof, concat, bigIntToByteArray, } from './Streamable.js';
 // Java-Compatible Serialization Helpers (non-crypto)
@@ -85,7 +88,8 @@ export { serializeMiniNumber, serializeMiniData, hashAllObjects, deriveChildTree
 export { TreeKey, TreeKeyNode, serializeTreeSignature, deserializeTreeSignature, getRootPublicKey, DEFAULT_KEYS_PER_LEVEL, DEFAULT_LEVELS, createUnifiedChildTreeKeyAsync, createPerAddressTreeKey, createPerAddressTreeKeyAsync, setTreeKeyLogger, disableTreeKeyLogger, } from './treekey.js';
 export { F, hex, fromHex, setWotsLogger, disableWotsLogger, u16be, u32be, assert32, h, prfChainSeed, toWinternitzDigits, baseWWithChecksum, wotsSignLegacy, } from './wots.js';
 // Canonical helpers (deterministic JSON + hashing)
-export { toHex, canonicalJson, hashCanonical } from './canonical.js';
+export { toHex, canonicalJson } from './canonical.js';
+export { hashCanonical } from './canonical-hash.js';
 // Byte/string utilities
 export { utf8ToBytes, bytesToUtf8 } from './utils.js';
 // Constants

package/dist/javaStreamables.js

@@ -12,7 +12,7 @@
  * NOTE: This module provides number-based wrappers for backward compatibility.
  * The canonical implementations are in Streamable.ts which uses bigint for precision.
  */
-import { sha3_256 } from './wasm-sync.js';
+import { sha3_256 } from './wasm-async.js';
 import { writeMiniNumber as streamableWriteMiniNumber, writeMiniData as streamableWriteMiniData, writeHashToStream as streamableWriteHashToStream, bigIntToByteArray } from './Streamable.js';
 /**
  * Serialize a number in MiniNumber format (Java compatible)

package/dist/legacy.d.ts

@@ -1,12 +1,21 @@
 /**
- * Legacy JS implementations — backward compatibility.
+ * Legacy JS crypto kernels — **deprecated (RFC-031 P4), frozen**.
  *
- * These are the original TypeScript implementations preserved for
- * environments where WASM is not available. The main entry point
- * (`@totemsdk/core`) now delegates to WASM by default.
+ * @deprecated The pure-JS kernels are scheduled for removal (RFC-031 P5). Use
+ * the WASM surface instead:
+ *   - `@totemsdk/core` / `@totemsdk/core/wasm` — synchronous WASM (bundler loader required)
+ *   - `@totemsdk/core/wasm-async` — async-init WASM (portable to edge/Workers)
  *
- * Import legacy implementations directly:
- *   import { wotsSign } from '@totemsdk/core/legacy';
+ * This entry stays only as a migration bridge for environments that cannot run
+ * WASM yet; it is **frozen** (no new kernels are added here) and will be deleted
+ * in a major release. Exports are `legacy`-prefixed where they collide with the
+ * WASM names (`legacyWotsSign`, …).
+ *
+ *   // before
+ *   import { legacyWotsSign } from '@totemsdk/core/legacy';
+ *   // after
+ *   import { init, wotsSign } from '@totemsdk/core/wasm-async';
+ *   await init();
  */
 export { F, hex, fromHex, u16be, u32be, assert32, h, prfChainSeed, toWinternitzDigits, baseWWithChecksum, derivePKdigest as legacyDerivePKdigest, wotsKeypairFromSeed as legacyWotsKeypairFromSeed, wotsSign as legacyWotsSign, wotsSignLegacy, wotsPkFromSig as legacyWotsPkFromSig, wotsVerify as legacyWotsVerify, wotsVerifyDigest as legacyWotsVerifyDigest, wotsPublicKeyFromSeed as legacyWotsPublicKeyFromSeed, type WotsKeypair, type WotsSignature, } from './wots.js';
 export { TreeKey, TreeKeyNode, verifyTreeSignature as legacyVerifyTreeSignature, serializeTreeSignature, deserializeTreeSignature, getRootPublicKey, DEFAULT_KEYS_PER_LEVEL, DEFAULT_LEVELS, createUnifiedChildTreeKey as legacyCreateUnifiedChildTreeKey, createUnifiedChildTreeKeyAsync, createUnifiedRootTreeKey as legacyCreateUnifiedRootTreeKey, deriveUnifiedAddressPublicKey as legacyDeriveUnifiedAddressPublicKey, createPerAddressTreeKey, createPerAddressTreeKeyAsync, type KeyGenProgress, type ProgressCallback, type SignatureProof, type TreeSignature, } from './treekey.js';

package/dist/legacy.js

@@ -1,12 +1,21 @@
 /**
- * Legacy JS implementations — backward compatibility.
+ * Legacy JS crypto kernels — **deprecated (RFC-031 P4), frozen**.
  *
- * These are the original TypeScript implementations preserved for
- * environments where WASM is not available. The main entry point
- * (`@totemsdk/core`) now delegates to WASM by default.
+ * @deprecated The pure-JS kernels are scheduled for removal (RFC-031 P5). Use
+ * the WASM surface instead:
+ *   - `@totemsdk/core` / `@totemsdk/core/wasm` — synchronous WASM (bundler loader required)
+ *   - `@totemsdk/core/wasm-async` — async-init WASM (portable to edge/Workers)
  *
- * Import legacy implementations directly:
- *   import { wotsSign } from '@totemsdk/core/legacy';
+ * This entry stays only as a migration bridge for environments that cannot run
+ * WASM yet; it is **frozen** (no new kernels are added here) and will be deleted
+ * in a major release. Exports are `legacy`-prefixed where they collide with the
+ * WASM names (`legacyWotsSign`, …).
+ *
+ *   // before
+ *   import { legacyWotsSign } from '@totemsdk/core/legacy';
+ *   // after
+ *   import { init, wotsSign } from '@totemsdk/core/wasm-async';
+ *   await init();
  */
 // WOTS — unique exports
 export { F, hex, fromHex, u16be, u32be, assert32, h, prfChainSeed, toWinternitzDigits, baseWWithChecksum, derivePKdigest as legacyDerivePKdigest, wotsKeypairFromSeed as legacyWotsKeypairFromSeed, wotsSign as legacyWotsSign, wotsSignLegacy, wotsPkFromSig as legacyWotsPkFromSig, wotsVerify as legacyWotsVerify, wotsVerifyDigest as legacyWotsVerifyDigest, wotsPublicKeyFromSeed as legacyWotsPublicKeyFromSeed, } from './wots.js';

package/dist/minima32.js

@@ -39,7 +39,7 @@ export function decodeMxRadix32Frame(mx) {
     }
     return bigIntToBytes(x);
 }
-import { sha3_256 as nobleSha3 } from './wasm-sync.js';
+import { sha3_256 as nobleSha3 } from './wasm-async.js';
 /** Encode raw 32 bytes to Mx address with frame and checksum */
 export function makeMxAddress(root32) {
     if (root32.length !== 32) {

package/dist/mmr.js

@@ -1,6 +1,6 @@
 // packages/core/src/mmr.ts
 // Full MMR implementation matching Minima's MMR.java, MMRData.java, and TreeKeyNode.java
-import { sha3_256 as nobleSha3 } from './wasm-sync.js';
+import { sha3_256 as nobleSha3 } from './wasm-async.js';
 import { serializeMiniNumber, serializeMiniData, javaHashAllObjects } from "./javaStreamables.js";
 // Import canonical wire serialization from Streamable.ts (single source of truth)
 import { writeMMRProof } from "./Streamable.js";

package/dist/scripts/contract-helpers.js

@@ -13,10 +13,10 @@
  * Each helper validates inputs and builds the appropriate ScriptDescriptor
  * for use with the EnhancedTransactionBuilder.
  */
-import { sha3_256 } from '../wasm-sync.js';
-import { createHash, randomBytes } from 'node:crypto';
+import { sha3_256 } from '../wasm-async.js';
+import { sha256 as nobleSha256 } from '@noble/hashes/sha256.js';
 function sha256(data) {
-    return new Uint8Array(createHash('sha256').update(data).digest());
+    return nobleSha256(data);
 }
 import { createTimelockDescriptor, createHTLCDescriptor, createMASTDescriptor, createExchangeDescriptor, createFlashCashDescriptor, createSlowCashDescriptor } from './types.js';
 function kissHex(hex) {
@@ -79,7 +79,7 @@ export class HTLCHelper {
      * Generate a random preimage and its hash.
      */
     static generateSecret() {
-        const preimageBytes = randomBytes(32);
+        const preimageBytes = globalThis.crypto.getRandomValues(new Uint8Array(32));
         const preimage = bytesToHex(preimageBytes);
         const hashBytes = sha3_256(preimageBytes);
         const hash = bytesToHex(hashBytes);

package/dist/scripts/witness-serializer.js

@@ -1,4 +1,4 @@
-import { sha3_256 } from '../wasm-sync.js';
+import { sha3_256 } from '../wasm-async.js';
 import { wotsVerifyDigest } from '../wots.js';
 import { serializeMMRProof } from '../mmr.js';
 import { mxToHex } from '../minima32.js';

package/dist/transaction.js

@@ -10,7 +10,7 @@
  * precomputeTransactionCoinID() to set output coin IDs. Without this, the signed
  * digest won't match what the Minima node verifies, causing allsignaturesvalid=false.
  */
-import { sha3_256 } from './wasm-sync.js';
+import { sha3_256 } from './wasm-async.js';
 import { writeMiniNumber, writeMiniData, writeHashToStream, writeMiniByte, writeMMREntryNumber, concat, hexToBytes, } from './Streamable.js';
 const ZERO_TXPOWID = new Uint8Array([0x00]);
 const STATETYPE_HEX = 1;

package/dist/verify.js

@@ -1,4 +1,4 @@
-import { sha3_256 } from './wasm-sync.js';
+import { sha3_256 } from './wasm-async.js';
 import { deserializeTreeSignature } from './treekey.js';
 import { scriptToAddress } from './derive.js';
 import { scriptFromWotsPk } from './script.js';