feat(sdk,wasm): wire WASM crypto backend into TS SDK

[bb-connor]

Summary

• Pluggable CryptoBackend interface in the TS SDK — all crypto (hashing, signing, verification) now routes through a backend abstraction
• Noble backend (default) wraps @noble/ed25519 + @noble/hashes — zero behavior change for existing consumers
• WASM backend (opt-in via initWasm()) wraps @clawdstrike/wasm (hush-core compiled to WebAssembly) for cross-language determinism
• 5 new WASM exports in hush-wasm: generate_keypair, sign_ed25519, public_key_from_private, hash_sha256_bytes, hash_keccak256_bytes
• Zero @noble/* imports outside noble-backend.ts — eliminates drift risk between Rust and TS crypto paths
• @clawdstrike/wasm added as optional peerDependency, externalized in tsup bundle

Consumer usage (no breaking changes)

// Works immediately — noble backend (default)
import { sha256, signMessage } from "@clawdstrike/sdk";

// Opt-in to WASM at startup:
import { initWasm } from "@clawdstrike/sdk";
const ok = await initWasm(); // true if @clawdstrike/wasm installed
// All subsequent crypto calls now use WASM

Test plan

• cargo test -p hush-wasm — 18 unit + 4 integration tests pass (new signing, bytes, keypair functions)
• npm test --workspace=packages/sdk/hush-ts — all 159 tests pass across 20 files (noble backend)
• npm run build --workspace=packages/sdk/hush-ts — tsup bundles ESM/CJS/DTS, @clawdstrike/wasm stays external
• grep -r "@noble" packages/sdk/hush-ts/src/ — only appears in noble-backend.ts
• npm run test:wasm --workspace=packages/sdk/hush-ts — determinism tests with WASM (requires wasm-pack build artifact)

🤖 Generated with Claude Code

---

Note

Medium Risk
Touches core cryptographic call paths and adds dynamic WASM loading, so regressions could affect hashing/signing correctness or runtime availability despite the noble default and added tests.

Overview
Adds a pluggable crypto layer to the TS SDK by routing hashing and Ed25519 operations through a new CryptoBackend abstraction (defaulting to a noble-based implementation) and exposing backend controls (getBackend, setBackend, initWasm, isWasmBackend).

Introduces an opt-in WASM backend loaded via dynamic import from @clawdstrike/wasm (optional peer dependency and externalized from the bundle), and updates watermarking key derivation to use the active backend instead of direct noble calls.

Extends hush-wasm exports with raw-byte hash variants plus Ed25519 keypair generation, signing, and public-key derivation, along with updated TypeScript typings and expanded Rust/wasm tests to cover these new APIs and backend behavior.

^{Written by Cursor Bugbot for commit 5122ea7. This will update automatically on new commits. Configure here.}

[bb-connor]

@codex

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ad09d227d5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[bb-connor]

@codex

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5122ea736f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Tighten WASM peer dependency to compatible release

The SDK’s new WASM backend now depends on exports introduced in this change (hash_sha256_bytes, hash_keccak256_bytes, generate_keypair, sign_ed25519, public_key_from_private), but the peer range >=0.1.0 still accepts older @clawdstrike/wasm builds that do not provide that surface. In that allowed configuration initWasm() can still return true, and the first crypto call then fails at runtime when an expected export is missing, so the declared compatibility range is too broad and should be constrained (or validated at init time).

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Make wasm test command initialize the WASM backend

The new test:wasm script only sets WASM_AVAILABLE=1 and runs the normal Vitest suite, but there is no test setup that reads this variable or calls initWasm(), while the backend defaults to noble. This means npm run test:wasm still primarily validates the JS path and can miss regressions in the newly added WASM backend integration, so the command should force WASM initialization (and fail if unavailable).

Useful? React with 👍 / 👎.