@clef-sh/agent 0.1.16 → 0.1.18

package/dist/agent.cjs

@@ -67,12 +67,16 @@ var require_age_encryption = __commonJS({
     });
     module2.exports = __toCommonJS2(stdin_exports);
     function isBytes(a5) {
-      return a5 instanceof Uint8Array || ArrayBuffer.isView(a5) && a5.constructor.name === "Uint8Array";
+      return a5 instanceof Uint8Array || ArrayBuffer.isView(a5) && a5.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a5 && a5.BYTES_PER_ELEMENT === 1;
     }
     function anumber(n5, title = "") {
+      if (typeof n5 !== "number") {
+        const prefix2 = title && `"${title}" `;
+        throw new TypeError(`${prefix2}expected number, got ${typeof n5}`);
+      }
       if (!Number.isSafeInteger(n5) || n5 < 0) {
         const prefix2 = title && `"${title}" `;
-        throw new Error(`${prefix2}expected integer >= 0, got ${n5}`);
+        throw new RangeError(`${prefix2}expected integer >= 0, got ${n5}`);
       }
     }
     function abytes(value, length, title = "") {
@@ -83,15 +87,22 @@ var require_age_encryption = __commonJS({
         const prefix2 = title && `"${title}" `;
         const ofLen = needsLen ? ` of length ${length}` : "";
         const got = bytes ? `length=${len}` : `type=${typeof value}`;
-        throw new Error(prefix2 + "expected Uint8Array" + ofLen + ", got " + got);
+        const message = prefix2 + "expected Uint8Array" + ofLen + ", got " + got;
+        if (!bytes)
+          throw new TypeError(message);
+        throw new RangeError(message);
       }
       return value;
     }
     function ahash(h5) {
       if (typeof h5 !== "function" || typeof h5.create !== "function")
-        throw new Error("Hash must wrapped by utils.createHasher");
+        throw new TypeError("Hash must wrapped by utils.createHasher");
       anumber(h5.outputLen);
       anumber(h5.blockLen);
+      if (h5.outputLen < 1)
+        throw new Error('"outputLen" must be >= 1');
+      if (h5.blockLen < 1)
+        throw new Error('"blockLen" must be >= 1');
     }
     function aexists(instance, checkFinished = true) {
       if (instance.destroyed)
@@ -103,7 +114,7 @@ var require_age_encryption = __commonJS({
       abytes(out, void 0, "digestInto() output");
       const min = instance.outputLen;
       if (out.length < min) {
-        throw new Error('"digestInto() output" expected to be of length >=' + min);
+        throw new RangeError('"digestInto() output" expected to be of length >=' + min);
       }
     }
     function u32(arr) {
@@ -136,7 +147,7 @@ var require_age_encryption = __commonJS({
     var swap32IfBE = isLE ? (u5) => u5 : byteSwap32;
     function utf8ToBytes(str) {
       if (typeof str !== "string")
-        throw new Error("string expected");
+        throw new TypeError("string expected");
       return new Uint8Array(new TextEncoder().encode(str));
     }
     function kdfInputToBytes(data2, errorTitle = "") {
@@ -146,7 +157,7 @@ var require_age_encryption = __commonJS({
     }
     function checkOpts(defaults, opts2) {
       if (opts2 !== void 0 && {}.toString.call(opts2) !== "[object Object]")
-        throw new Error("options must be object or undefined");
+        throw new TypeError("options must be object or undefined");
       const merged = Object.assign(defaults, opts2);
       return merged;
     }
@@ -155,17 +166,23 @@ var require_age_encryption = __commonJS({
       const tmp = hashCons(void 0);
       hashC.outputLen = tmp.outputLen;
       hashC.blockLen = tmp.blockLen;
+      hashC.canXOF = tmp.canXOF;
       hashC.create = (opts2) => hashCons(opts2);
       Object.assign(hashC, info);
       return Object.freeze(hashC);
     }
     function randomBytes4(bytesLength = 32) {
+      anumber(bytesLength, "bytesLength");
       const cr = typeof globalThis === "object" ? globalThis.crypto : null;
       if (typeof cr?.getRandomValues !== "function")
         throw new Error("crypto.getRandomValues must be defined");
+      if (bytesLength > 65536)
+        throw new RangeError(`"bytesLength" expected <= 65536, got ${bytesLength}`);
       return cr.getRandomValues(new Uint8Array(bytesLength));
     }
     var oidNist = (suffix) => ({
+      // Current NIST hashAlgs suffixes used here fit in one DER subidentifier octet.
+      // Larger suffix values would need base-128 OID encoding and a different length byte.
       oid: Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2, suffix])
     });
     var _HMAC = class {
@@ -173,6 +190,7 @@ var require_age_encryption = __commonJS({
       iHash;
       blockLen;
       outputLen;
+      canXOF = false;
       finished = false;
       destroyed = false;
       constructor(hash, key) {
@@ -202,11 +220,12 @@ var require_age_encryption = __commonJS({
       }
       digestInto(out) {
         aexists(this);
-        abytes(out, this.outputLen, "output");
+        aoutput(out, this);
         this.finished = true;
-        this.iHash.digestInto(out);
-        this.oHash.update(out);
-        this.oHash.digestInto(out);
+        const buf = out.subarray(0, this.outputLen);
+        this.iHash.digestInto(buf);
+        this.oHash.update(buf);
+        this.oHash.digestInto(buf);
         this.destroy();
       }
       digest() {
@@ -235,8 +254,11 @@ var require_age_encryption = __commonJS({
         this.iHash.destroy();
       }
     };
-    var hmac = (hash, key, message) => new _HMAC(hash, key).update(message).digest();
-    hmac.create = (hash, key) => new _HMAC(hash, key);
+    var hmac = /* @__PURE__ */ (() => {
+      const hmac_ = ((hash, key, message) => new _HMAC(hash, key).update(message).digest());
+      hmac_.create = (hash, key) => new _HMAC(hash, key);
+      return hmac_;
+    })();
     function extract(hash, ikm, salt) {
       ahash(hash);
       if (salt === void 0)
@@ -248,7 +270,10 @@ var require_age_encryption = __commonJS({
     function expand(hash, prk, info, length = 32) {
       ahash(hash);
       anumber(length, "length");
+      abytes(prk, void 0, "prk");
       const olen = hash.outputLen;
+      if (prk.length < olen)
+        throw new Error('"prk" must be at least HashLen octets');
       if (length > 255 * olen)
         throw new Error("Length must be <= 255*HashLen");
       const blocks = Math.ceil(length / olen);
@@ -281,6 +306,7 @@ var require_age_encryption = __commonJS({
     var HashMD = class {
       blockLen;
       outputLen;
+      canXOF = false;
       padOffset;
       isLE;
       // For partial updates less than block size
@@ -508,6 +534,7 @@ var require_age_encryption = __commonJS({
         clean(SHA256_W);
       }
       destroy() {
+        this.destroyed = true;
         this.set(0, 0, 0, 0, 0, 0, 0, 0);
         clean(this.buffer);
       }
@@ -845,6 +872,10 @@ var require_age_encryption = __commonJS({
       anumber(asyncTick, "asyncTick");
       if (c5 < 1)
         throw new Error("iterations (c) must be >= 1");
+      if (dkLen < 1)
+        throw new Error('"dkLen" must be >= 1');
+      if (dkLen > (2 ** 32 - 1) * hash.outputLen)
+        throw new Error("derived key too long");
       const password = kdfInputToBytes(_password, "password");
       const salt = kdfInputToBytes(_salt, "salt");
       const DK = new Uint8Array(dkLen);
@@ -976,9 +1007,9 @@ var require_age_encryption = __commonJS({
         throw new Error('"p" expected integer 1..((2^32 - 1) * 32) / (128 * r)');
       if (dkLen < 1 || dkLen > (pow32 - 1) * 32)
         throw new Error('"dkLen" expected integer 1..(2^32 - 1) * 32');
-      const memUsed = blockSize * (N2 + p5);
+      const memUsed = blockSize * (N2 + p5 + 1);
       if (memUsed > maxmem)
-        throw new Error('"maxmem" limit was hit, expected 128*r*(N+p) <= "maxmem"=' + maxmem);
+        throw new Error('"maxmem" limit was hit: memUsed(128*r*(N+p+1))=' + memUsed + ", maxmem=" + maxmem);
       const B2 = pbkdf2(sha256, password, salt, { c: 1, dkLen: blockSize * p5 });
       const B32 = u32(B2);
       const V = u32(new Uint8Array(blockSize * N2));
@@ -210332,7 +210363,7 @@ async function initialFetch(poller, jitMode, encryptedStore, cache5, sourceDesc)
 }
 
 // package.json
-var version5 = "0.1.16";
+var version5 = "0.1.18";
 
 // src/main.ts
 var isLambda = !!process.env.AWS_LAMBDA_RUNTIME_API;
@@ -210458,17 +210489,16 @@ main().catch((err) => {
 });
 /*! Bundled license information:
 
-@noble/hashes/utils.js:
-@noble/hashes/utils.js:
-@noble/hashes/utils.js:
-  (*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
-
 @scure/base/index.js:
   (*! scure-base - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
 
 @noble/ciphers/utils.js:
   (*! noble-ciphers - MIT License (c) 2023 Paul Miller (paulmillr.com) *)
 
+@noble/hashes/utils.js:
+@noble/hashes/utils.js:
+  (*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
+
 @noble/curves/utils.js:
 @noble/curves/abstract/modular.js:
 @noble/curves/abstract/curve.js: