refactor(sdk/js): use @noble/hashes instead of node crypto

replace crypto.createHash('sha384'|'sha256') calls with @noble/hashes
sha384/sha256, which work identically in node and browsers without
needing a polyfill. @noble/hashes is already a peer dependency.

this prepares for removing crypto-browserify, whose upstream chain
(elliptic, create-ecdh, browserify-sign) carries unpatched advisories.

Author: Leechael

sdk/js/src/get-compose-hash.browser.ts

@@ -2,7 +2,8 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 
-import crypto from 'crypto';
+import { sha256 } from '@noble/hashes/sha256';
+import { bytesToHex } from '@noble/hashes/utils';
 
 type SortableValue = string | number | boolean | null | undefined | SortableObject | SortableArray;
 interface SortableObject {
@@ -27,15 +28,8 @@ function sortObjectKeys(obj: SortableValue): SortableValue {
   return sortedObj;
 }
 
-/**
- * Browser-compatible SHA-256 hash using crypto-browserify
- * @param data - Data to hash
- * @returns Promise resolving to hex-encoded hash
- */
 async function sha256Hash(data: string): Promise<string> {
-  const hash = crypto.createHash('sha256');
-  hash.update(data, 'utf8');
-  return hash.digest('hex');
+  return bytesToHex(sha256(new TextEncoder().encode(data)));
 }
 
 /**

sdk/js/src/get-compose-hash.ts

@@ -2,7 +2,8 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 
-import crypto from "crypto";
+import { sha256 } from "@noble/hashes/sha256";
+import { bytesToHex } from "@noble/hashes/utils";
 
 type SortableValue = string | number | boolean | null | undefined | SortableObject | SortableArray;
 interface SortableObject {
@@ -104,5 +105,5 @@ export function getComposeHash(app_compose: AppCompose, normalize: boolean = fal
     app_compose = preprocessAppCompose(app_compose);
   }
   const manifest_str = toDeterministicJson(app_compose);
-  return crypto.createHash("sha256").update(manifest_str, "utf8").digest("hex");
+  return bytesToHex(sha256(new TextEncoder().encode(manifest_str)));
 }

sdk/js/src/index.ts

@@ -3,7 +3,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import fs from 'fs'
-import crypto from 'crypto'
+import { sha384 } from '@noble/hashes/sha512'
 import { send_rpc_request } from './send-rpc-request'
 export { getComposeHash } from './get-compose-hash'
 export { verifyEnvEncryptPublicKey, verifyEnvEncryptPublicKeyLegacy } from './verify-env-encrypt-public-key'
@@ -154,9 +154,7 @@ function replay_rtmr(history: string[]): string {
       const padding = Buffer.alloc(48 - contentBuffer.length, 0)
       contentBuffer = Buffer.concat([contentBuffer, padding])
     }
-    mr = Buffer.from(crypto.createHash('sha384')
-      .update(Buffer.concat([mr, contentBuffer]))
-      .digest())
+    mr = Buffer.from(sha384(Buffer.concat([mr, contentBuffer])))
   }
   return mr.toString('hex')
 }

sdk/js/src/solana.ts

@@ -2,7 +2,7 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 
-import crypto from 'crypto'
+import { sha256 } from '@noble/hashes/sha256'
 import { type GetKeyResponse, type GetTlsKeyResponse } from './index'
 import { Keypair } from '@solana/web3.js'
 
@@ -28,14 +28,9 @@ export function toKeypair(keyResponse: GetTlsKeyResponse | GetKeyResponse) {
 export function toKeypairSecure(keyResponse: GetTlsKeyResponse | GetKeyResponse) {
   // Keep legacy behavior for GetTlsKeyResponse, but with warning.
   if (keyResponse.__name__ === 'GetTlsKeyResponse') {
-    try {
-      console.warn('toKeypairSecure: Please don\'t use `deriveKey` method to get key, use `getKey` instead.')
-      // Get supported hash algorithm by `openssl list -digest-algorithms`, but it's not guaranteed to be supported by node.js
-      const buf = crypto.createHash('sha256').update(keyResponse.asUint8Array()).digest()
-      return Keypair.fromSeed(buf)
-    } catch (err) {
-      throw new Error('toKeypairSecure: missing sha256 support, please upgrade your openssl and node.js')
-    }
+    console.warn('toKeypairSecure: Please don\'t use `deriveKey` method to get key, use `getKey` instead.')
+    const buf = sha256(keyResponse.asUint8Array())
+    return Keypair.fromSeed(buf)
   }
   return Keypair.fromSeed(keyResponse.key)
 }

sdk/js/src/viem.ts

@@ -2,7 +2,8 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 
-import crypto from 'crypto'
+import { sha256 } from '@noble/hashes/sha256'
+import { bytesToHex } from '@noble/hashes/utils'
 import { type GetKeyResponse, type GetTlsKeyResponse } from './index'
 import { privateKeyToAccount } from 'viem/accounts'
 
@@ -29,13 +30,8 @@ export function toViemAccountSecure(keyResponse: GetKeyResponse | GetTlsKeyRespo
   // Keep legacy behavior for GetTlsKeyResponse, but with warning.
   if (keyResponse.__name__ === 'GetTlsKeyResponse') {
     console.warn('toViemAccountSecure: Please don\'t use `deriveKey` method to get key, use `getKey` instead.')
-    try {
-      // Get supported hash algorithm by `openssl list -digest-algorithms`, but it's not guaranteed to be supported by node.js
-      const hex = crypto.createHash('sha256').update(keyResponse.asUint8Array()).digest('hex')
-      return privateKeyToAccount(`0x${hex}`)
-    } catch (err) {
-      throw new Error('toViemAccountSecure: missing sha256 support, please upgrade your openssl and node.js')
-    }
+    const hex = bytesToHex(sha256(keyResponse.asUint8Array()))
+    return privateKeyToAccount(`0x${hex}`)
   }
   const hex = Array.from(keyResponse.key).map(b => b.toString(16).padStart(2, '0')).join('')
   return privateKeyToAccount(`0x${hex}`)