@blamejs/core 0.18.55 → 0.18.56

package/lib/middleware/csrf-protect.js

@@ -253,7 +253,7 @@ function _writeReject(req, res, message, reason, onDeny, problemMode) {
  *     protocolResolver:       function(req): "http"|"https",  // own the HTTPS decision
  *     trustProxy:             boolean|number,    // legacy; refused unless paired with trustedProxies/protocolResolver (spoofable)
  *     audit:                  boolean,
- *     skipStateless:          boolean,   // default false — skip validation for Authorization-header / cookieless (not-CSRF-able) requests
+ *     skipStateless:          boolean,   // default false — skip the token check for cookieless (not-CSRF-able) requests. Turns on the absence of the ambient credential only: an Authorization header is not part of the test, and it never waives `checkOrigin`.
  *     onDeny:                 function(req, res, info): void,  // own the 403; info = { status, reason }
  *     problemDetails:         boolean,   // default false — emit RFC 9457 application/problem+json instead of the default JSON envelope
  *   }
@@ -363,17 +363,21 @@ function create(opts) {
   // is opt-in rather than silent.
   var requireOriginOpt = opts.requireOrigin === true;
 
-  // skipStateless — skip token VALIDATION for requests that carry an
-  // Authorization header (bearer / token auth) or no Cookie header at
-  // all. Such requests are not CSRF-able: CSRF abuses a victim's ambient
-  // cookie credential, and a token-authenticated or cookieless request
-  // has none to abuse. The token is still ISSUED on safe methods so a
-  // later cookie-authenticated browser flow on the same app works. Default
-  // false (strict — every state-changing request is validated). createApp
-  // wires its default csrf with this on so mixed browser-form + token-API
-  // surfaces don't reject legitimate API clients. Cross-site form CSRF is
-  // unaffected: the browser auto-sends the victim's cookies, so the attack
-  // request always carries a Cookie header and is validated.
+  // skipStateless — skip token VALIDATION for requests that carry no Cookie
+  // header at all. Such requests are not CSRF-able: CSRF abuses a victim's
+  // ambient cookie credential, and a request that sends none has nothing to
+  // abuse. The token is still ISSUED on safe methods so a later
+  // cookie-authenticated browser flow on the same app works. Default false
+  // (strict — every state-changing request is validated). createApp wires its
+  // default csrf with this on so mixed browser-form + token-API surfaces don't
+  // reject legitimate API clients. Cross-site form CSRF is unaffected: the
+  // browser auto-sends the victim's cookies, so the attack request always
+  // carries a Cookie header and is validated.
+  //
+  // An `Authorization` header is NOT part of the test, and a bearer client that
+  // also sends an unrelated cookie is validated like anything else. Deciding
+  // otherwise needs the auth layer's verdict about which credential
+  // authenticated the request, which header presence cannot supply.
   var skipStateless = opts.skipStateless === true;
 
   // Per-path exemption (string-prefix / RegExp / skip predicate), validated at
@@ -548,14 +552,6 @@ function create(opts) {
 
     if (methods.indexOf(req.method) === -1) return next();
 
-    // Stateless / token-authenticated requests are not CSRF-able — the
-    // token was still issued above for any later browser flow.
-    if (skipStateless) {
-      var hasAuthHeader = !!(req.headers && req.headers.authorization);
-      var hasCookieHeader = !!(req.headers && req.headers.cookie);
-      if (hasAuthHeader || !hasCookieHeader) return next();
-    }
-
     // requireJsonContentType — refuse before the token check.
     if (requireJsonCt) {
       var ct = req.headers && req.headers["content-type"];
@@ -578,6 +574,27 @@ function create(opts) {
       }
     }
 
+    // Stateless requests are not CSRF-able — the token was still issued above
+    // for any later browser flow.
+    //
+    // The test is the ABSENCE of the ambient credential, and nothing else. CSRF
+    // spends a cookie the browser attaches on its own; a request carrying none
+    // has nothing to abuse. This used to fire on an `Authorization` header too,
+    // which was two mistakes at once. Presence is not authenticity — an
+    // attacker composing a cross-site request writes their own headers, so
+    // `Authorization: Bearer nonsense` satisfied it by being typed. And the
+    // header says nothing about which credential authenticated the request:
+    // attachUser with tokenFrom: "both" reads the cookie FIRST, so a request
+    // carrying both was authenticated by exactly the ambient credential this
+    // gate protects, and skipped the gate on a header nobody had read.
+    //
+    // It also sits BELOW the origin cross-check now rather than above it. A
+    // consumer that asked for checkOrigin asked for something the token compare
+    // does not give them, and there is no reading of "stateless" under which a
+    // cross-origin state change becomes acceptable — the branch that waived the
+    // first line of defence was waiving the second one with it.
+    if (skipStateless && !(req.headers && req.headers.cookie)) return next();
+
     if (!cookieCfg) {
       // Session-stored mode — operator's tokenLookup is the source.
       expected = opts.tokenLookup(req);

package/lib/session-stores.js

@@ -29,9 +29,12 @@
  *   schema (sidHash PRIMARY KEY, userId, userIdHash, data, createdAt,
  *   expiresAt, lastActivity) plus the indexes session-side queries
  *   need (userIdHash for `destroyAllForUser`, expiresAt for
- *   `purgeExpired`). Operators typically point `file` at tmpfs (e.g.
- *   `/dev/shm/blamejs-sessions.db`) so session inserts run RAM-fast
- *   and don't compete with the main DB's encryption-flush cycle.
+ *   `purgeExpired`). Operators typically point `file` at tmpfs
+ *   (`/dev/shm/blamejs-sessions.db` on Linux, an in-memory volume on
+ *   Windows) so session inserts run RAM-fast and don't compete with
+ *   the main DB's encryption-flush cycle. The path is yours to name —
+ *   a leading slash is drive-relative on Windows, where `/dev/shm`
+ *   means `C:\dev\shm` and is ordinary disk.
  *
  *   Wire it once at boot, before the first session call:
  *

package/lib/vendor/MANIFEST.json

@@ -2,7 +2,7 @@
   "_comment": "Vendored dependencies — no npm runtime packages. Use scripts/vendor-update.sh to update.",
   "packages": {
     "@noble/ciphers": {
-      "version": "2.3.0",
+      "version": "2.4.0",
       "license": "MIT",
       "author": "Paul Miller",
       "source": "https://github.com/paulmillr/noble-ciphers",
@@ -15,16 +15,16 @@
         "browser": "lib/vendor/browser/noble-ciphers.mjs"
       },
       "bundler": "esbuild --format=cjs --platform=node (server), esbuild --format=esm --platform=browser (browser)",
-      "bundledAt": "2026-08-10T00:00:00Z",
-      "cpe": "cpe:2.3:a:paulmillr:noble-ciphers:2.3.0:*:*:*:*:node.js:*:*",
+      "bundledAt": "2026-08-27T00:00:00Z",
+      "cpe": "cpe:2.3:a:paulmillr:noble-ciphers:2.4.0:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:f3325f480cb8eb814fcb0baaa19336cbbf2b993f48624c6aa9600ffd69d0be5e",
-        "browser": "sha256:0ffd91540bcb586a29b56e52ee1c29df69097b50776beb4036a07558f7a4e12e"
+        "server": "sha256:acdcf1ba4bde8177cbfcfef22b543022284a1529afb68bc8329303837c8c021e",
+        "browser": "sha256:fc422d85a65c5dc1208066b0156e100c4790be3c8791f644b80524c25d4bc3ee"
       },
-      "refreshedAt": "2026-08-25T10:45:22.083Z"
+      "refreshedAt": "2026-08-28T04:49:21.011Z"
     },
     "@noble/hashes": {
-      "version": "2.3.0",
+      "version": "2.4.0",
       "license": "MIT",
       "author": "Paul Miller",
       "source": "https://github.com/paulmillr/noble-hashes",
@@ -43,15 +43,15 @@
         "browser": "lib/vendor/browser/noble-hashes.mjs"
       },
       "bundler": "esbuild --format=esm --platform=browser (browser only)",
-      "bundledAt": "2026-08-10T00:00:00Z",
-      "cpe": "cpe:2.3:a:paulmillr:noble-hashes:2.3.0:*:*:*:*:node.js:*:*",
+      "bundledAt": "2026-08-27T00:00:00Z",
+      "cpe": "cpe:2.3:a:paulmillr:noble-hashes:2.4.0:*:*:*:*:node.js:*:*",
       "hashes": {
-        "browser": "sha256:dfe4b7ae3c9880e388c8da4b68f44742b229b53afacd1e674179527e33da62b0"
+        "browser": "sha256:0e135cbb496a1b7d15bf36b8c611a8feaad49ced60a03bf916bada78b589aa66"
       },
-      "refreshedAt": "2026-08-25T10:45:22.083Z"
+      "refreshedAt": "2026-08-28T04:49:21.011Z"
     },
     "@noble/curves": {
-      "version": "2.3.0",
+      "version": "2.4.0",
       "license": "MIT",
       "author": "Paul Miller",
       "source": "https://github.com/paulmillr/noble-curves",
@@ -65,21 +65,21 @@
         "server": "lib/vendor/noble-curves.cjs"
       },
       "bundler": "esbuild --format=cjs --platform=node",
-      "bundledAt": "2026-08-21T00:00:00Z",
-      "cpe": "cpe:2.3:a:paulmillr:noble-curves:2.3.0:*:*:*:*:node.js:*:*",
+      "bundledAt": "2026-08-27T00:00:00Z",
+      "cpe": "cpe:2.3:a:paulmillr:noble-curves:2.4.0:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:b5fe88d1ea780d0581dee6145d666f89d46fc9531b5db35db2e5b16627840890"
+        "server": "sha256:477359f445eed241ad4ededb84921483c3c97618a160ef78b74bb1a421c17da7"
       },
-      "refreshedAt": "2026-08-25T10:45:22.083Z",
+      "refreshedAt": "2026-08-28T04:49:21.011Z",
       "components": {
         "@noble/hashes": {
           "url": "https://github.com/paulmillr/noble-hashes",
-          "version": "2.3.0"
+          "version": "2.4.0"
         }
       }
     },
     "@noble/post-quantum": {
-      "version": "0.7.0",
+      "version": "0.7.1",
       "license": "MIT",
       "author": "Paul Miller",
       "source": "https://github.com/paulmillr/noble-post-quantum",
@@ -108,25 +108,25 @@
         "browser": "lib/vendor/browser/noble-post-quantum.mjs"
       },
       "bundler": "esbuild --format=cjs --platform=node (server), esbuild --format=esm --platform=browser (browser)",
-      "bundledAt": "2026-08-10T00:00:00Z",
-      "cpe": "cpe:2.3:a:paulmillr:noble-post-quantum:0.7.0:*:*:*:*:node.js:*:*",
+      "bundledAt": "2026-08-27T00:00:00Z",
+      "cpe": "cpe:2.3:a:paulmillr:noble-post-quantum:0.7.1:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:fab7ebe5737793862c473444f4ee5912f79dd1edec86683acbb4eecbca0f5892",
-        "browser": "sha256:cae1d5bbdc7184b202b6ca68df6e1db7b0d0f668c77809ded189ca7f271accc9"
+        "server": "sha256:04eaaa4838b43162912c851dd2cab52ab82f56decad8542934171247017a6893",
+        "browser": "sha256:30ceef750bc57ae5f59c5aa7454eafb7aad55d30c261a1b5c538a66c569fc031"
       },
-      "refreshedAt": "2026-08-25T10:45:22.083Z",
+      "refreshedAt": "2026-08-28T04:49:21.011Z",
       "components": {
         "@noble/hashes": {
           "url": "https://github.com/paulmillr/noble-hashes",
-          "version": "2.3.0"
+          "version": "2.4.0"
         },
         "@noble/curves": {
           "url": "https://github.com/paulmillr/noble-curves",
-          "version": "2.3.0"
+          "version": "2.4.0"
         },
         "@noble/ciphers": {
           "url": "https://github.com/paulmillr/noble-ciphers",
-          "version": "2.3.0"
+          "version": "2.4.0"
         }
       }
     },
@@ -148,7 +148,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-25T10:45:22.083Z"
+      "refreshedAt": "2026-08-28T04:49:21.011Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -173,7 +173,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-25T10:45:22.083Z"
+      "refreshedAt": "2026-08-28T04:49:21.011Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -193,7 +193,7 @@
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-25T10:45:22.083Z"
+      "refreshedAt": "2026-08-28T04:49:21.011Z"
     },
     "@blamejs/pki": {
       "version": "0.5.31",
@@ -221,7 +221,7 @@
       "hashes": {
         "server": "sha256:8cc54fdfb7ac5277fb30f054f57500a9e77ce6b2d2b8f6846a14766d217770db"
       },
-      "refreshedAt": "2026-08-25T10:45:22.083Z"
+      "refreshedAt": "2026-08-28T04:49:21.011Z"
     }
   }
 }

package/lib/vendor/browser/noble-ciphers.mjs

@@ -1,4 +1,4 @@
-// XChaCha20-Poly1305 — vendored from @noble/ciphers v2.3.0 by Paul Miller
+// XChaCha20-Poly1305 — vendored from @noble/ciphers v2.4.0 by Paul Miller
 // License: MIT — https://github.com/paulmillr/noble-ciphers
 // Browser build (ESM), bundled with esbuild from the same install as the
 // server bundle beside it. Exports: xchacha20poly1305
@@ -71,6 +71,17 @@ function byteSwap32(arr) {
   return arr;
 }
 var swap32IfBE = isLE ? (u) => u : byteSwap32;
+function overlapBytes(a, b) {
+  if (!a.byteLength || !b.byteLength)
+    return false;
+  return a.buffer === b.buffer && // best we can do, may fail with an obscure Proxy
+  a.byteOffset < b.byteOffset + b.byteLength && // a starts before b end
+  b.byteOffset < a.byteOffset + a.byteLength;
+}
+function complexOverlapBytes(input, output) {
+  if (overlapBytes(input, output) && input.byteOffset < output.byteOffset)
+    throw new Error("complex overlap of input and output is not supported");
+}
 function checkOpts(defaults, opts) {
   aobject(defaults, "defaults");
   aobject(opts, "opts");
@@ -238,7 +249,10 @@ function createCipher(core, opts) {
     abytes(nonce, void 0, "nonce");
     abytes(data, void 0, "data");
     const len = data.length;
+    const hasOutput = output !== void 0;
     output = getOutput(len, output, false);
+    if (hasOutput)
+      complexOverlapBytes(data, output);
     anumber(counter);
     if (counter < 0 || counter >= MAX_COUNTER)
       throw new Error("arx: counter overflow");

package/lib/vendor/browser/noble-hashes.mjs

@@ -1,4 +1,4 @@
-// @noble/hashes v2.3.0 — vendored from Paul Miller
+// @noble/hashes v2.4.0 — vendored from Paul Miller
 // License: MIT — https://github.com/paulmillr/noble-hashes
 // Browser build (ESM), bundled with esbuild. The server side uses node:crypto
 // for these, so there is no .cjs beside it.
@@ -89,6 +89,14 @@ var aobject = (value, label) => {
   if (value === null || typeof value !== "object" || Array.isArray(value))
     throw new TypeError((label === "object" ? "" : `"${label}" `) + "expected object, got type=" + typeof value);
 };
+var aopts = (value, label) => {
+  aobject(value, label);
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null)
+    throw new TypeError(`"${label}" expected plain object`);
+  if (Object.hasOwn(value, "__proto__"))
+    throw new TypeError(`"${label}.__proto__" is not allowed`);
+};
 function aexists(instance, checkFinished = true) {
   if (instance.destroyed)
     throw new Error("hash was destroyed");
@@ -128,10 +136,10 @@ function byteSwap32(arr) {
 }
 var swap32IfBE = isLE ? (u) => u : byteSwap32;
 function checkOpts(defaults, opts, title = "opts") {
-  aobject(defaults, "defaults");
+  aopts(defaults, "defaults");
   if (opts !== void 0)
-    aobject(opts, title);
-  const merged = Object.assign(defaults, opts);
+    aopts(opts, title);
+  const merged = Object.assign(/* @__PURE__ */ Object.create(null), defaults, opts);
   return merged;
 }
 function createHasher(hashCons, info = {}) {

package/lib/vendor/browser/noble-post-quantum.mjs

@@ -1,4 +1,4 @@
-// @noble/post-quantum v0.7.0 — vendored from Paul Miller
+// @noble/post-quantum v0.7.1 — vendored from Paul Miller
 // License: MIT — https://github.com/paulmillr/noble-post-quantum
 // Browser build (ESM), bundled with esbuild from the same install as the
 // server bundle beside it. The KEM suites only — a client half encapsulates
@@ -57,6 +57,14 @@ var aobject = (value, label) => {
   if (value === null || typeof value !== "object" || Array.isArray(value))
     throw new TypeError((label === "object" ? "" : `"${label}" `) + "expected object, got type=" + typeof value);
 };
+var aopts = (value, label) => {
+  aobject(value, label);
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null)
+    throw new TypeError(`"${label}" expected plain object`);
+  if (Object.hasOwn(value, "__proto__"))
+    throw new TypeError(`"${label}.__proto__" is not allowed`);
+};
 function aexists(instance, checkFinished = true) {
   if (instance.destroyed)
     throw new Error("hash was destroyed");
@@ -90,10 +98,10 @@ function byteSwap32(arr) {
 }
 var swap32IfBE = isLE ? (u) => u : byteSwap32;
 function checkOpts(defaults, opts2, title = "opts") {
-  aobject(defaults, "defaults");
+  aopts(defaults, "defaults");
   if (opts2 !== void 0)
-    aobject(opts2, title);
-  const merged = Object.assign(defaults, opts2);
+    aopts(opts2, title);
+  const merged = Object.assign(/* @__PURE__ */ Object.create(null), defaults, opts2);
   return merged;
 }
 function createHasher(hashCons, info = {}) {
@@ -509,7 +517,7 @@ function equalBytes(a, b) {
   return diff === 0;
 }
 function copyBytes(bytes) {
-  return Uint8Array.from(abytes(bytes));
+  return new Uint8Array(abytes(bytes));
 }
 function splitCoder(label, ...lengths) {
   const getLength = (c) => typeof c === "number" ? c : c.bytesLen;
@@ -937,8 +945,9 @@ var genKPKE = (opts_) => {
       for (let i = 0; i < K; i++)
         polyAdd(tmp, MultiplyNTTs(sk[i], crystals.NTT.encode(u[i])));
       polySub(v, crystals.NTT.decode(tmp));
-      cleanBytes(tmp, sk, u);
-      return poly1.encode(v);
+      const res = poly1.encode(v);
+      cleanBytes(tmp, sk, u, v);
+      return res;
     }
   };
 };
@@ -968,32 +977,55 @@ function createKyber(opts2) {
   return Object.freeze({
     info: Object.freeze({ type: "ml-kem" }),
     lengths: kemLengths,
-    keygen: (seed = randomBytes2(seedLen)) => {
-      abytesDoc(seed, seedLen, "seed");
-      const { publicKey, secretKey: sk } = KPKE.keygen(seed.subarray(0, 32));
-      const publicKeyHash = HASH256(publicKey);
-      const secretKey = secretCoder.encode([sk, publicKey, publicKeyHash, seed.subarray(32)]);
-      cleanBytes(sk, publicKeyHash);
-      return {
-        publicKey,
-        secretKey
-      };
+    keygen: (seed) => {
+      const ownSeed = seed === void 0;
+      const s = ownSeed ? randomBytes2(seedLen) : seed;
+      let sk;
+      let publicKeyHash;
+      try {
+        abytesDoc(s, seedLen, "seed");
+        const keys = KPKE.keygen(s.subarray(0, 32));
+        const publicKey = keys.publicKey;
+        sk = keys.secretKey;
+        publicKeyHash = HASH256(publicKey);
+        const secretKey = secretCoder.encode([sk, publicKey, publicKeyHash, s.subarray(32)]);
+        return {
+          publicKey,
+          secretKey
+        };
+      } finally {
+        if (sk !== void 0)
+          cleanBytes(sk);
+        if (publicKeyHash !== void 0)
+          cleanBytes(publicKeyHash);
+        if (ownSeed)
+          cleanBytes(s);
+      }
     },
     getPublicKey: (secretKey) => {
       const [_sk, publicKey, _publicKeyHash, _z] = secretCoder.decode(secretKey);
       return Uint8Array.from(publicKey);
     },
-    encapsulate: (publicKey, msg = randomBytes2(msgLen)) => {
-      abytesDoc(publicKey, lengths.publicKey, "publicKey");
-      abytesDoc(msg, msgLen, "message");
-      validateModulus(publicKey, "encapsulate");
-      const kr = HASH512.create().update(msg).update(HASH256(publicKey)).digest();
-      const cipherText = KPKE.encrypt(publicKey, msg, kr.subarray(32, 64));
-      cleanBytes(kr.subarray(32));
-      return {
-        cipherText,
-        sharedSecret: kr.subarray(0, 32)
-      };
+    encapsulate: (publicKey, msg) => {
+      const ownMsg = msg === void 0;
+      const m = ownMsg ? randomBytes2(msgLen) : msg;
+      let kr;
+      try {
+        abytesDoc(publicKey, lengths.publicKey, "publicKey");
+        abytesDoc(m, msgLen, "message");
+        validateModulus(publicKey, "encapsulate");
+        kr = HASH512.create().update(m).update(HASH256(publicKey)).digest();
+        const cipherText = KPKE.encrypt(publicKey, m, kr.subarray(32, 64));
+        return {
+          cipherText,
+          sharedSecret: kr.subarray(0, 32)
+        };
+      } finally {
+        if (kr !== void 0)
+          cleanBytes(kr.subarray(32));
+        if (ownMsg)
+          cleanBytes(m);
+      }
     },
     decapsulate: (cipherText, secretKey) => {
       abytesDoc(secretKey, secretCoder.bytesLen, "secretKey");
@@ -1026,15 +1058,24 @@ function createKyber(opts2) {
       const cached = KPKE.prepare(ek);
       return Object.freeze({
         publicKey: ek,
-        encapsulate: (msg = randomBytes2(msgLen)) => {
-          abytesDoc(msg, msgLen, "message");
-          const kr = HASH512.create().update(msg).update(publicKeyHash).digest();
-          const cipherText = cached.encrypt(msg, kr.subarray(32, 64));
-          cleanBytes(kr.subarray(32));
-          return {
-            cipherText,
-            sharedSecret: kr.subarray(0, 32)
-          };
+        encapsulate: (msg) => {
+          const ownMsg = msg === void 0;
+          const m = ownMsg ? randomBytes2(msgLen) : msg;
+          let kr;
+          try {
+            abytesDoc(m, msgLen, "message");
+            kr = HASH512.create().update(m).update(publicKeyHash).digest();
+            const cipherText = cached.encrypt(m, kr.subarray(32, 64));
+            return {
+              cipherText,
+              sharedSecret: kr.subarray(0, 32)
+            };
+          } finally {
+            if (kr !== void 0)
+              cleanBytes(kr.subarray(32));
+            if (ownMsg)
+              cleanBytes(m);
+          }
         },
         decapsulate: (cipherText, secretKey) => {
           abytesDoc(secretKey, secretCoder.bytesLen, "secretKey");

package/lib/vendor/noble-ciphers.cjs

@@ -1,4 +1,4 @@
-// XChaCha20-Poly1305 — vendored from @noble/ciphers v2.3.0 by Paul Miller
+// XChaCha20-Poly1305 — vendored from @noble/ciphers v2.4.0 by Paul Miller
 // License: MIT — https://github.com/paulmillr/noble-ciphers
 // Bundled with esbuild. Exports: xchacha20poly1305
 var __defProp = Object.defineProperty;
@@ -95,6 +95,17 @@ function byteSwap32(arr) {
   return arr;
 }
 var swap32IfBE = isLE ? (u) => u : byteSwap32;
+function overlapBytes(a, b) {
+  if (!a.byteLength || !b.byteLength)
+    return false;
+  return a.buffer === b.buffer && // best we can do, may fail with an obscure Proxy
+  a.byteOffset < b.byteOffset + b.byteLength && // a starts before b end
+  b.byteOffset < a.byteOffset + a.byteLength;
+}
+function complexOverlapBytes(input, output) {
+  if (overlapBytes(input, output) && input.byteOffset < output.byteOffset)
+    throw new Error("complex overlap of input and output is not supported");
+}
 function checkOpts(defaults, opts) {
   aobject(defaults, "defaults");
   aobject(opts, "opts");
@@ -262,7 +273,10 @@ function createCipher(core, opts) {
     abytes(nonce, void 0, "nonce");
     abytes(data, void 0, "data");
     const len = data.length;
+    const hasOutput = output !== void 0;
     output = getOutput(len, output, false);
+    if (hasOutput)
+      complexOverlapBytes(data, output);
     anumber(counter);
     if (counter < 0 || counter >= MAX_COUNTER)
       throw new Error("arx: counter overflow");