Version Packages

packages/agent-core/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @tangle-network/agent-core
 
+## 0.4.1
+
+### Patch Changes
+
+- 077b3d4: fix(auth): make the token module browser-import-safe
+
+  The auth token module referenced `Buffer` at module-eval time (top-level
+  `JWT_HEADER` / `JWT_HEADER_EDDSA` = `base64UrlEncode(...)`) and statically
+  imported `node:crypto`. Because the package **root** re-exports this module,
+  any browser bundle that transitively imports `@tangle-network/agent-core`
+  (e.g. via `@tangle-network/sdk-telemetry`) boot-crashed with
+  `ReferenceError: Buffer is not defined`.
+
+  - base64url encode/decode is now isomorphic (`btoa`/`atob` + `TextEncoder`/
+    `TextDecoder`), never `Buffer`
+  - the HS256 and EdDSA JWT headers are computed lazily on first use, not at
+    module load
+  - HMAC/Ed25519 signing, verification, and key generation resolve `node:crypto`
+    on demand via `process.getBuiltinModule` (server-only), so merely importing
+    the module never pulls the builtin into a browser graph
+
+  Token wire format is unchanged — already-issued tokens still verify.
+
 ## 0.4.0
 
 ### Minor Changes

packages/agent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-core",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Core transport interfaces, event utilities, auth, SSE parsing, and resilience primitives for talking to Tangle agents",
   "type": "module",
   "license": "MIT",