@blamejs/core 0.18.55 → 0.18.57

package/lib/vendor/browser/noble-post-quantum.mjs

@@ -1,4 +1,4 @@
-// @noble/post-quantum v0.7.0 — vendored from Paul Miller
+// @noble/post-quantum v0.7.1 — vendored from Paul Miller
 // License: MIT — https://github.com/paulmillr/noble-post-quantum
 // Browser build (ESM), bundled with esbuild from the same install as the
 // server bundle beside it. The KEM suites only — a client half encapsulates
@@ -57,6 +57,14 @@ var aobject = (value, label) => {
   if (value === null || typeof value !== "object" || Array.isArray(value))
     throw new TypeError((label === "object" ? "" : `"${label}" `) + "expected object, got type=" + typeof value);
 };
+var aopts = (value, label) => {
+  aobject(value, label);
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null)
+    throw new TypeError(`"${label}" expected plain object`);
+  if (Object.hasOwn(value, "__proto__"))
+    throw new TypeError(`"${label}.__proto__" is not allowed`);
+};
 function aexists(instance, checkFinished = true) {
   if (instance.destroyed)
     throw new Error("hash was destroyed");
@@ -90,10 +98,10 @@ function byteSwap32(arr) {
 }
 var swap32IfBE = isLE ? (u) => u : byteSwap32;
 function checkOpts(defaults, opts2, title = "opts") {
-  aobject(defaults, "defaults");
+  aopts(defaults, "defaults");
   if (opts2 !== void 0)
-    aobject(opts2, title);
-  const merged = Object.assign(defaults, opts2);
+    aopts(opts2, title);
+  const merged = Object.assign(/* @__PURE__ */ Object.create(null), defaults, opts2);
   return merged;
 }
 function createHasher(hashCons, info = {}) {
@@ -509,7 +517,7 @@ function equalBytes(a, b) {
   return diff === 0;
 }
 function copyBytes(bytes) {
-  return Uint8Array.from(abytes(bytes));
+  return new Uint8Array(abytes(bytes));
 }
 function splitCoder(label, ...lengths) {
   const getLength = (c) => typeof c === "number" ? c : c.bytesLen;
@@ -937,8 +945,9 @@ var genKPKE = (opts_) => {
       for (let i = 0; i < K; i++)
         polyAdd(tmp, MultiplyNTTs(sk[i], crystals.NTT.encode(u[i])));
       polySub(v, crystals.NTT.decode(tmp));
-      cleanBytes(tmp, sk, u);
-      return poly1.encode(v);
+      const res = poly1.encode(v);
+      cleanBytes(tmp, sk, u, v);
+      return res;
     }
   };
 };
@@ -968,32 +977,55 @@ function createKyber(opts2) {
   return Object.freeze({
     info: Object.freeze({ type: "ml-kem" }),
     lengths: kemLengths,
-    keygen: (seed = randomBytes2(seedLen)) => {
-      abytesDoc(seed, seedLen, "seed");
-      const { publicKey, secretKey: sk } = KPKE.keygen(seed.subarray(0, 32));
-      const publicKeyHash = HASH256(publicKey);
-      const secretKey = secretCoder.encode([sk, publicKey, publicKeyHash, seed.subarray(32)]);
-      cleanBytes(sk, publicKeyHash);
-      return {
-        publicKey,
-        secretKey
-      };
+    keygen: (seed) => {
+      const ownSeed = seed === void 0;
+      const s = ownSeed ? randomBytes2(seedLen) : seed;
+      let sk;
+      let publicKeyHash;
+      try {
+        abytesDoc(s, seedLen, "seed");
+        const keys = KPKE.keygen(s.subarray(0, 32));
+        const publicKey = keys.publicKey;
+        sk = keys.secretKey;
+        publicKeyHash = HASH256(publicKey);
+        const secretKey = secretCoder.encode([sk, publicKey, publicKeyHash, s.subarray(32)]);
+        return {
+          publicKey,
+          secretKey
+        };
+      } finally {
+        if (sk !== void 0)
+          cleanBytes(sk);
+        if (publicKeyHash !== void 0)
+          cleanBytes(publicKeyHash);
+        if (ownSeed)
+          cleanBytes(s);
+      }
     },
     getPublicKey: (secretKey) => {
       const [_sk, publicKey, _publicKeyHash, _z] = secretCoder.decode(secretKey);
       return Uint8Array.from(publicKey);
     },
-    encapsulate: (publicKey, msg = randomBytes2(msgLen)) => {
-      abytesDoc(publicKey, lengths.publicKey, "publicKey");
-      abytesDoc(msg, msgLen, "message");
-      validateModulus(publicKey, "encapsulate");
-      const kr = HASH512.create().update(msg).update(HASH256(publicKey)).digest();
-      const cipherText = KPKE.encrypt(publicKey, msg, kr.subarray(32, 64));
-      cleanBytes(kr.subarray(32));
-      return {
-        cipherText,
-        sharedSecret: kr.subarray(0, 32)
-      };
+    encapsulate: (publicKey, msg) => {
+      const ownMsg = msg === void 0;
+      const m = ownMsg ? randomBytes2(msgLen) : msg;
+      let kr;
+      try {
+        abytesDoc(publicKey, lengths.publicKey, "publicKey");
+        abytesDoc(m, msgLen, "message");
+        validateModulus(publicKey, "encapsulate");
+        kr = HASH512.create().update(m).update(HASH256(publicKey)).digest();
+        const cipherText = KPKE.encrypt(publicKey, m, kr.subarray(32, 64));
+        return {
+          cipherText,
+          sharedSecret: kr.subarray(0, 32)
+        };
+      } finally {
+        if (kr !== void 0)
+          cleanBytes(kr.subarray(32));
+        if (ownMsg)
+          cleanBytes(m);
+      }
     },
     decapsulate: (cipherText, secretKey) => {
       abytesDoc(secretKey, secretCoder.bytesLen, "secretKey");
@@ -1026,15 +1058,24 @@ function createKyber(opts2) {
       const cached = KPKE.prepare(ek);
       return Object.freeze({
         publicKey: ek,
-        encapsulate: (msg = randomBytes2(msgLen)) => {
-          abytesDoc(msg, msgLen, "message");
-          const kr = HASH512.create().update(msg).update(publicKeyHash).digest();
-          const cipherText = cached.encrypt(msg, kr.subarray(32, 64));
-          cleanBytes(kr.subarray(32));
-          return {
-            cipherText,
-            sharedSecret: kr.subarray(0, 32)
-          };
+        encapsulate: (msg) => {
+          const ownMsg = msg === void 0;
+          const m = ownMsg ? randomBytes2(msgLen) : msg;
+          let kr;
+          try {
+            abytesDoc(m, msgLen, "message");
+            kr = HASH512.create().update(m).update(publicKeyHash).digest();
+            const cipherText = cached.encrypt(m, kr.subarray(32, 64));
+            return {
+              cipherText,
+              sharedSecret: kr.subarray(0, 32)
+            };
+          } finally {
+            if (kr !== void 0)
+              cleanBytes(kr.subarray(32));
+            if (ownMsg)
+              cleanBytes(m);
+          }
         },
         decapsulate: (cipherText, secretKey) => {
           abytesDoc(secretKey, secretCoder.bytesLen, "secretKey");

package/lib/vendor/noble-ciphers.cjs

@@ -1,4 +1,4 @@
-// XChaCha20-Poly1305 — vendored from @noble/ciphers v2.3.0 by Paul Miller
+// XChaCha20-Poly1305 — vendored from @noble/ciphers v2.4.0 by Paul Miller
 // License: MIT — https://github.com/paulmillr/noble-ciphers
 // Bundled with esbuild. Exports: xchacha20poly1305
 var __defProp = Object.defineProperty;
@@ -95,6 +95,17 @@ function byteSwap32(arr) {
   return arr;
 }
 var swap32IfBE = isLE ? (u) => u : byteSwap32;
+function overlapBytes(a, b) {
+  if (!a.byteLength || !b.byteLength)
+    return false;
+  return a.buffer === b.buffer && // best we can do, may fail with an obscure Proxy
+  a.byteOffset < b.byteOffset + b.byteLength && // a starts before b end
+  b.byteOffset < a.byteOffset + a.byteLength;
+}
+function complexOverlapBytes(input, output) {
+  if (overlapBytes(input, output) && input.byteOffset < output.byteOffset)
+    throw new Error("complex overlap of input and output is not supported");
+}
 function checkOpts(defaults, opts) {
   aobject(defaults, "defaults");
   aobject(opts, "opts");
@@ -262,7 +273,10 @@ function createCipher(core, opts) {
     abytes(nonce, void 0, "nonce");
     abytes(data, void 0, "data");
     const len = data.length;
+    const hasOutput = output !== void 0;
     output = getOutput(len, output, false);
+    if (hasOutput)
+      complexOverlapBytes(data, output);
     anumber(counter);
     if (counter < 0 || counter >= MAX_COUNTER)
       throw new Error("arx: counter overflow");

package/lib/vendor/noble-curves.cjs

@@ -1,4 +1,4 @@
-// @noble/curves v2.3.0 — vendored from Paul Miller
+// @noble/curves v2.4.0 — vendored from Paul Miller
 // License: MIT — https://github.com/paulmillr/noble-curves
 // Bundled with esbuild. Exports the RFC 9497 OPRF suites:
 //   ristretto255_oprf (ristretto255-SHA512), p256_oprf (P-256-SHA256),
@@ -104,6 +104,14 @@ var aobject = (value, label) => {
   if (value === null || typeof value !== "object" || Array.isArray(value))
     throw new TypeError((label === "object" ? "" : `"${label}" `) + "expected object, got type=" + typeof value);
 };
+var aopts = (value, label) => {
+  aobject(value, label);
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null)
+    throw new TypeError(`"${label}" expected plain object`);
+  if (Object.hasOwn(value, "__proto__"))
+    throw new TypeError(`"${label}.__proto__" is not allowed`);
+};
 function aexists(instance, checkFinished = true) {
   if (instance.destroyed)
     throw new Error("hash was destroyed");
@@ -190,10 +198,10 @@ function concatBytes(...arrays) {
   return res;
 }
 function checkOpts(defaults, opts, title = "opts") {
-  aobject(defaults, "defaults");
+  aopts(defaults, "defaults");
   if (opts !== void 0)
-    aobject(opts, title);
-  const merged = Object.assign(defaults, opts);
+    aopts(opts, title);
+  const merged = Object.assign(/* @__PURE__ */ Object.create(null), defaults, opts);
   return merged;
 }
 function createHasher(hashCons, info = {}) {
@@ -1019,6 +1027,17 @@ function invert(number, modulo) {
     throw new Error("invert: does not exist");
   return mod(x, modulo);
 }
+function invertCt(a, prime) {
+  if (prime <= _1n2)
+    throw new Error("invertCt: expected prime modulus > 1, got " + prime);
+  const an = mod(a, prime);
+  if (an === _0n2)
+    throw new Error("invertCt: expected non-zero number");
+  const inverse = pow(an, prime - _2n, prime);
+  if (mod(an * inverse, prime) !== _1n2)
+    throw new Error("invertCt: does not exist");
+  return inverse;
+}
 function assertIsSquare(Fp2, root, n) {
   const F = Fp2;
   if (!F.eql(F.sqr(root), n))
@@ -2454,12 +2473,13 @@ function createOPRF(opts) {
     hashToGroup: "function"
   });
   validatePointCons(opts.Point);
-  const { name, Point, hash } = opts;
+  const { name, Point, hash, hashToGroup: hashToGroupHook, hashToScalar } = opts;
   const { Fn: Fn2 } = Point;
-  const hashToGroup = (msg, ctx) => opts.hashToGroup(msg, {
+  const invertSecret = (value) => invertCt(value, Fn2.ORDER);
+  const hashToGroup = (msg, ctx) => hashToGroupHook(msg, {
     DST: concatBytes2(asciiToBytes("HashToGroup-"), ctx)
   });
-  const hashToScalarPrefixed = (msg, ctx) => opts.hashToScalar(msg, { DST: concatBytes2(_DST_scalarBytes, ctx) });
+  const hashToScalarPrefixed = (msg, ctx) => hashToScalar(msg, { DST: concatBytes2(_DST_scalarBytes, ctx) });
   const randomScalar = (rng = randomBytes2) => {
     if (typeof rng !== "function")
       throw new TypeError('"rng" expected function, got type=' + typeof rng);
@@ -2551,7 +2571,7 @@ function createOPRF(opts) {
     const msg = concatBytes2(seed, encode(info), Uint8Array.of(0));
     for (let counter = 0; counter <= 255; counter++) {
       msg[msg.length - 1] = counter;
-      const skS = opts.hashToScalar(msg, { DST: dst });
+      const skS = hashToScalar(msg, { DST: dst });
       if (Fn2.is0(skS))
         continue;
       return {
@@ -2669,7 +2689,7 @@ function createOPRF(opts) {
           throw new Error("expected array");
         const skS = Fn2.fromBytes(secretKey);
         const t = Fn2.add(skS, m);
-        const invT = Fn2.inv(t);
+        const invT = invertSecret(t);
         const blindedPoints = blinded.map((i) => wirePoint("blinded", i));
         const evalPoints = blindedPoints.map((i) => i.multiply(invT));
         const tweakedKey = Point.BASE.multiply(t);
@@ -2702,13 +2722,13 @@ function createOPRF(opts) {
         if (inputPoint.equals(Point.ZERO))
           throw new Error("Input point at infinity");
         const t = Fn2.add(skS, m);
-        const invT = Fn2.inv(t);
+        const invT = invertSecret(t);
         const unblinded = inputPoint.multiply(invT).toBytes();
         return hashInput(input, info, unblinded);
       }
     });
   };
-  const res = { name, oprf, voprf, poprf, __tests: Object.freeze({ Fn: Fn2 }) };
+  const res = { name, oprf, voprf, poprf, __tests: Object.freeze({ Fn: Fn2, invertSecret }) };
   return Object.freeze(res);
 }
 
@@ -2999,21 +3019,28 @@ function weierstrass(params, extraOpts = {}) {
     endo: "object",
     randomBytes: "function"
   });
-  const { endo, allowInfinityPoint } = extraOpts;
+  const { endo: endoOpts, allowInfinityPoint, clearCofactor, isTorsionFree, fromBytes, toBytes } = extraOpts;
   const randomBytes3 = extraOpts.randomBytes === void 0 ? randomBytes2 : extraOpts.randomBytes;
-  if (endo) {
-    if (!Fp2.is0(CURVE.a) || typeof endo.beta !== "bigint" || !Array.isArray(endo.basises)) {
+  if (endoOpts) {
+    if (!Fp2.is0(CURVE.a) || typeof endoOpts.beta !== "bigint" || !Array.isArray(endoOpts.basises)) {
       throw new Error('invalid endo: expected "beta": bigint and "basises": array');
     }
   }
+  const endo = endoOpts ? {
+    beta: endoOpts.beta,
+    basises: endoOpts.basises.map((basis) => [...basis])
+  } : void 0;
   const lengths = getWLengths(Fp2, Fn2);
   function assertCompressionIsSupported() {
     if (!Fp2.isOdd)
       throw new Error("compression is not supported: Field does not have .isOdd()");
   }
   function pointToBytes(_c, point, isCompressed) {
-    if (allowInfinityPoint && point.is0())
+    if (point.is0()) {
+      if (!allowInfinityPoint)
+        throw new Error("bad point: ZERO");
       return Uint8Array.of(0);
+    }
     const { x, y } = point.toAffine();
     const bx = Fp2.toBytes(x);
     abool(isCompressed, "isCompressed");
@@ -3062,8 +3089,8 @@ function weierstrass(params, extraOpts = {}) {
       throw new Error(`bad point: got length ${length}, expected compressed=${comp} or uncompressed=${uncomp}`);
     }
   }
-  const encodePoint = extraOpts.toBytes === void 0 ? pointToBytes : extraOpts.toBytes;
-  const decodePoint = extraOpts.fromBytes === void 0 ? pointFromBytes : extraOpts.fromBytes;
+  const encodePoint = toBytes === void 0 ? pointToBytes : toBytes;
+  const decodePoint = fromBytes === void 0 ? pointFromBytes : fromBytes;
   const b3 = Fp2.mul(CURVE.b, _3n3);
   const mulA = Fp2.is0(CURVE.a) ? (_) => Fp2.ZERO : (x) => Fp2.mul(CURVE.a, x);
   function weierstrassEquation(x) {
@@ -3085,7 +3112,7 @@ function weierstrass(params, extraOpts = {}) {
   function acoord(title, n, banZero = false) {
     if (!Fp2.isValid(n) || banZero && Fp2.is0(n))
       throw new Error(`bad point coordinate ${title}`);
-    return n;
+    return typeof n === "object" && n !== null ? Fp2.create(n) : n;
   }
   function aprjpoint(other) {
     if (!(other instanceof Point))
@@ -3167,7 +3194,7 @@ function weierstrass(params, extraOpts = {}) {
     assertValidity() {
       const p = this;
       if (p.is0()) {
-        if (extraOpts.allowInfinityPoint && Fp2.is0(p.X) && Fp2.eql(p.Y, Fp2.ONE) && Fp2.is0(p.Z))
+        if (allowInfinityPoint && Fp2.is0(p.X) && Fp2.eql(p.Y, Fp2.ONE) && Fp2.is0(p.Z))
           return;
         throw new Error("bad point: ZERO");
       }
@@ -3379,7 +3406,6 @@ function weierstrass(params, extraOpts = {}) {
      * Always torsion-free for cofactor=1 curves.
      */
     isTorsionFree() {
-      const { isTorsionFree } = extraOpts;
       if (cofactor === _1n7)
         return true;
       if (isTorsionFree)
@@ -3387,7 +3413,6 @@ function weierstrass(params, extraOpts = {}) {
       return wnaf.mulUnsafe(this, CURVE_ORDER).is0();
     }
     clearCofactor() {
-      const { clearCofactor } = extraOpts;
       if (cofactor === _1n7)
         return this;
       if (clearCofactor)