fix(wallet-toolbox): derive Argon2 without WebAssembly

[BraydenLangley]

Program and scope

• Tracker or issue: none; compatibility regression reproduced independently
• Program gate(s) advanced: React Native/Hermes UMP v3 wallet availability
• Why this change is needed: Hermes can omit the global WebAssembly API, causing hash-wasm to reject every Argon2id-backed wallet unlock before password verification.
• Explicitly out of scope: npm publication, application release, KDF parameter changes, or token migration.
• Exact head SHA reviewed: 747daf2

Impact

• Public package source or manifest changed; affected packages are listed below
• Public API, exports, types, runtime targets, or browser/mobile behavior changed
• Security-sensitive boundary changed
• Documentation or examples changed

Affected packages: @bsv/wallet-toolbox, @bsv/wallet-toolbox-client, and @bsv/wallet-toolbox-mobile; all are already governed for the pending 2.11.0 minor release.

Verification

• Local commands and results: root pnpm build, pnpm lint, pnpm format:check, pnpm typecheck, and pnpm health:check pass. Wallet Toolbox 222 suites / 2,149 tests pass, with one pre-existing governed skip. Mobile 24/24 and client 17/17 tests pass.
• Hosted CI: CI 33657568947, CodeQL 33657568871, and Conformance 33657568814 are terminal and successful, including the required merge gate.
• Conformance evidence: deterministic Argon2id vector matches the existing hash-wasm result when WebAssembly is removed. Existing UMP v3 parameters and bytes are unchanged.
• Coverage delta: the mobile suite covers all 15 changed line/branch points in hashWasm.ts at 100%; hosted aggregate patch coverage passed.
• Lint/typecheck delta: zero new warnings or type errors
• Browser/mobile/packed-consumer evidence: all three packed package checks pass; Vite, esbuild, Metro, and optimized Hermes contracts pass.
• Performance or bundle-size delta: measured and ratcheted in CHANGELOG.md. The JavaScript implementation is dynamically loaded only after WebAssembly fails.
• I self-reviewed the complete diff for correctness, security, compatibility, public API, artifacts, dependencies, docs, and operations

Security and dependencies

• Changelog, runtime relevance, peer compatibility, transitive graph, and audit results were reviewed
• No new override, advisory dismissal, quality suppression, or skipped test
• Workflow permissions and lifecycle-script behavior remain least privilege

Dependency evidence

• Release notes and necessity: adds @noble/hashes 2.4.0 solely as a standards-compatible asynchronous Argon2id fallback for runtimes without WebAssembly.
• Runtime, build, and peer compatibility: supports the governed Node range; ESM is loaded dynamically; React Native Metro/Hermes, browser Vite/esbuild, ESM, and CommonJS packed consumers pass.
• Deduplicated lockfile: one exact 2.4.0 snapshot shared by the three affected packages; no unrelated lock changes.
• Audit and CodeQL: local dependency/license governance passes; exact-head CodeQL and dependency review pass, and Sonar reports zero new issues and zero new security hotspots. CI-discovered advisory hygiene refreshes the existing AJV transitive from fast-uri 3.1.5 to patched 3.1.6 in the frozen lock only; no manifest dependency or override was added, and pnpm audit:security now reports only the two governed ignored advisories.
• Package and consumer tests: full Wallet Toolbox suite, mobile/client suites, all packed-consumer checks, and an independent create/reopen regression pass.
• Bundle and performance impact: exact measurements and reviewed ceilings are documented in the package changelog. Production-parameter fallback create+unlock completed in 7.2 seconds on the reference machine.
• Affected public package versions: pending 2.11.0 minor for all three packages.

Release and operations

• No npm publication was performed from a workstation or from this PR
• Required npm patch bumps are intentionally deferred by the controlling 2.11.0 release program
• Image/SBOM/provenance/deployment/rollback impact is documented
• Documentation, changelog, migration, and operational guidance are current

Completion evidence

• Documentation, changelog, migration notes, release notes, and operator guidance are current or concretely not applicable
• All applicable exact-head checks are terminal and successful; intentional skips are out-of-scope lanes
• CodeQL has no new findings, Sonar reports zero new issues or hotspots, and there are no unresolved review conversations
• One qualified maintainer approval is sufficient; no last-pusher restriction is assumed

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​noble/​hashes@​2.4.0

View full report

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!