Patch Changes

• #385 8100dbf Thanks @struong! - Fixed WithdrawalSenderTag.from to include the Zone withdrawal fallback nonce.

Patch Changes

• #365 c8bcc7e Thanks @RezaRahemtola! - Fixed Json.stringify throwing TypeError when a replacer returned a bigint unchanged.

Minor Changes

• #350 7cabe8b Thanks @jxom! - Added MlDsa44 for ML-DSA-44 signatures and included its WASM provider with Secp256k1 in ox/wasm's aggregate engine.

Minor Changes

• #348 fcd16f0 Thanks @struong! - Added WithdrawalSenderTag utilities for deriving Tempo Zone withdrawal sender tags.

Minor Changes

• #345 2e75896 Thanks @jxom! - Added Prf.tag to create credential-bound PRF configurations from stable UTF-8 tags.

Patch Changes

• #343 0068849 Thanks @jxom! - Fixed the published package missing the ox/_types/* subpath: postinstall regenerates exports without it, and zile publish:prepare strips the scripts needed to re-apply it, so publishing now re-applies it directly before changeset publish.

Minor Changes

• #341 c672615 Thanks @jxom! - Added WebAuthn PRF output and secp256k1, Ed25519, and AES-GCM key derivation, and deprecated WebAuthnP256 in favor of WebAuthn.

  import { AesGcm, Ed25519, Secp256k1, WebAuthn } from "ox";
  
  const credential = await WebAuthn.createCredential({
    name: "Example",
    prf: true,
  });
  const secp256k1PrivateKey = Secp256k1.fromPrf(credential.prf);
  const ed25519PrivateKey = Ed25519.fromPrf(credential.prf);
  const encryptionKey = await AesGcm.fromPrf(credential.prf);

• #336 e17518b Thanks @jxom! - Added incremental hash state factories with chunk updates, cloning, caller-owned output buffers, and destruction, plus Rlp.encodeTo for streaming encoded bytes.

  import { Hash, Rlp } from "ox";
  
  const hash = Hash.createKeccak256();
  Rlp.encodeTo(["0x01", "0x0203"], (chunk) => {
    hash.update(chunk);
  });
  const digest = hash.digest();

Patch Changes

• #342 d5197b9 Thanks @jxom! - Added an ox/_types/* subpath.

Minor Changes

• #335 0aaacc4 Thanks @jxom! - Added first-party trusted setup data and an explicit disposable c-kzg WASM factory for EIP-4844 and EIP-7594 operations.

• #333 a41c325 Thanks @jxom! - Added an opt-in ox/wasm/Secp256k1 provider backed by libsecp256k1.

  import { Engine } from "ox";
  import { Secp256k1 } from "ox/wasm";
  
  await Engine.install({ Secp256k1: Secp256k1.engine() });

Patch Changes

• #331 ee873dc Thanks @jxom! - Added Hash.blake3 for BLAKE3 hashing through Ox's default or an installed engine implementation.

  import { Hash } from "ox";
  
  const digest = Hash.blake3("0xdeadbeef");

• #334 1ef21a0 Thanks @jxom! - Added opt-in synchronous scrypt to the WASM Keystore provider.

Patch Changes

• #326 030f319 Thanks @jxom! - Re-exported Engine.InvalidSlotValueError from the Node and WASM entrypoints.

Minor Changes

• #321 3e5c27b Thanks @jxom! - Added ox/node for native SHA-256, RIPEMD-160, and HMAC-SHA256, and ox/wasm for those hashes plus WASM-backed Keccak256.

  import { Engine } from "ox/wasm";
  
  await Engine.load();

• #321 3e5c27b Thanks @jxom! - Added Engine, which swaps ox's cryptography for another implementation across the Bls, Ed25519, Hash, Keystore, Mnemonic, P256, Secp256k1 and X25519 slots.

Patch Changes

• #319 96bd9ce Thanks @jxom! - Fixed Hex.toBytes silently accepting characters above U+00FF, and sped up decoding of short values and encoding on runtimes without Uint8Array.prototype.toHex.

  Buffer.from(…, 'hex') masks each UTF-16 code unit to 8 bits, so a character
  above U+00FF could alias a hex digit rather than being rejected:

  Hex.toBytes("0x숰0");
  // before: Uint8Array [0]  (U+C230 masked to the digit `0`)
  // after:  throws Hex.InvalidHexValueError

• #321 3e5c27b Thanks @jxom! - Fixed VirtualMaster.mineSaltAsync accepting non-positive, non-finite, non-integer or larger-than-uint32 chunk sizes.

• #319 96bd9ce Thanks @jxom! - Fixed Base64.fromBytes double-padding URL-safe output, and Base64.toBytes silently accepting characters above U+00FF.

  omitPadding governs both alphabets, so padding was appended to an
  already-padded base64url string on every runtime with
  Uint8Array.prototype.toBase64 — browsers and Bun, but not Node:

  Base64.fromBytes(Bytes.from([0xfa]), { url: true, pad: true });
  // before: '-g===='
  // after:  '-g=='

  Separately, the decoder's alphabet table only spans Latin-1, so a character
  above it read as undefined and decoded as A rather than being refused:

  Base64.toBytes("숰GVsbG8=");
  // before: Uint8Array of "\u0000ello"
  // after:  throws Base64.InvalidCharacterError