@suveren/gateway 0.40.0 → 0.41.0

package/node_modules/@hap/core/src/verifier-policy.ts

@@ -0,0 +1,178 @@
+/**
+ * Verifier policy — `HAP-verifier-policy` (protocol.md → *Owner Signatures*
+ * → *Verifier policy*, new in v0.8, specification-led).
+ *
+ * The relying party's own, declarative statement of what it demands of a
+ * ticket (or projection) before acting on or trusting it. Every present
+ * line is a conjunct; an unmet line is a refusal naming the line and its
+ * code; absent lines impose nothing. The policy is never sent to the
+ * Authority Server.
+ */
+
+import { HapError, type HapErrorCode } from './errors';
+import type { Mandate, OwnerSignatureBinding } from './types';
+import type { TicketPayload } from './ticket';
+import { verifyTicketSignature, verifyTicketApprovals, approvalsSufficient } from './ticket';
+import { verifyTicketProjection, verifyProjectionOwner, type TicketProjection } from './ticket-projection';
+import { verifyMandateSignature } from './mandate';
+import { verifyOwnerSignatures, bindingRank, BINDING_RANK } from './owner-signature';
+
+export interface VerifierPolicy {
+  typ: 'HAP-verifier-policy';
+  version: string;
+  trusted_issuers?: string[];
+  min_binding?: OwnerSignatureBinding | string;
+  required_owners?: string[];
+  profile_hashes?: Record<string, string>;
+  action_types?: string[];
+  freshness_seconds?: number;
+  required_fields?: string[];
+  require_approval_signature?: boolean;
+}
+
+/** A refusal naming the policy line that failed. */
+export class PolicyError extends HapError {
+  constructor(public readonly line: keyof VerifierPolicy, code: HapErrorCode, message: string) {
+    super(code, `${line}: ${message}`);
+    this.name = 'PolicyError';
+  }
+}
+
+export interface PolicyInput {
+  /** The complete ticket, where the relying party holds it. */
+  ticket?: TicketPayload;
+  /** Or the projection, where only the public view was served. */
+  projection?: TicketProjection;
+  /** The mandate the artifact chains to, where the policy needs it
+   * (`min_binding`, `required_owners`, `profile_hashes`, `require_approval_signature`). */
+  mandate?: Mandate;
+  now?: number;
+  /** The relying party acts on the artifact (freshness applies to `valid_until`). */
+  asAuthorization?: boolean;
+  /** Whether the ticket's action exceeded an approval-kind cap — known to a
+   * party that holds the mandate's caps and the execution context. */
+  aboveCap?: boolean;
+}
+
+/**
+ * Evaluate a policy (protocol.md → *Verifier policy*, "Evaluation"). The
+ * artifact's own signature is verified first under `trusted_issuers` where
+ * present, else under any resolvable issuer.
+ * @throws PolicyError with the line and the code the table assigns.
+ */
+export async function evaluateVerifierPolicy(policy: VerifierPolicy, input: PolicyInput): Promise<void> {
+  if (policy.typ !== 'HAP-verifier-policy') {
+    throw new HapError('POLICY_UNMET', 'policy document must carry typ "HAP-verifier-policy"');
+  }
+  const artifact = input.ticket ?? input.projection;
+  if (!artifact) throw new HapError('POLICY_UNMET', 'no ticket or projection to evaluate');
+  const now = input.now ?? Math.floor(Date.now() / 1000);
+
+  // trusted_issuers — an unlisted issuer, or a signature that does not verify
+  // under the listed key, is reported as INVALID_SIGNATURE on purpose.
+  try {
+    if (input.ticket) {
+      await verifyTicketSignature(input.ticket, { trustedIssuers: policy.trusted_issuers });
+    } else if (input.projection) {
+      await verifyTicketProjection(input.projection, { trustedIssuers: policy.trusted_issuers, now, asAuthorization: input.asAuthorization });
+    }
+    if (input.mandate) {
+      await verifyMandateSignature(input.mandate, { trustedIssuers: policy.trusted_issuers });
+    }
+  } catch (err) {
+    const code = err instanceof HapError ? err.code : 'INVALID_SIGNATURE';
+    throw new PolicyError(code === 'POLICY_UNMET' ? 'freshness_seconds' : 'trusted_issuers', code, (err as Error).message);
+  }
+
+  // Owner signatures on the mandate — verified once, used by two lines.
+  let verifiedOwnerDids: Map<string, string> | undefined; // did → binding
+  const needOwners = policy.min_binding !== undefined || policy.required_owners !== undefined;
+  if (needOwners) {
+    verifiedOwnerDids = new Map();
+    if (input.mandate) {
+      try {
+        const entries = await verifyOwnerSignatures(input.mandate);
+        for (const e of entries) verifiedOwnerDids.set(e.did, e.binding ?? 'raw');
+        if (input.projection?.owner) await verifyProjectionOwner(input.projection, input.mandate);
+      } catch (err) {
+        throw new PolicyError('min_binding', 'OWNER_SIGNATURE_REQUIRED', `no verifiable owner signature: ${(err as Error).message}`);
+      }
+    }
+  }
+
+  if (policy.min_binding !== undefined) {
+    const minRank = BINDING_RANK[policy.min_binding as OwnerSignatureBinding];
+    if (minRank === undefined) {
+      throw new PolicyError('min_binding', 'OWNER_SIGNATURE_REQUIRED', `unknown binding "${policy.min_binding}" — satisfies no minimum`);
+    }
+    const best = Math.max(-1, ...[...verifiedOwnerDids!.values()].map(bindingRank));
+    if (best < minRank) {
+      throw new PolicyError('min_binding', 'OWNER_SIGNATURE_REQUIRED', `no verified owner signature at binding >= "${policy.min_binding}"`);
+    }
+  }
+
+  if (policy.required_owners !== undefined) {
+    for (const did of policy.required_owners) {
+      if (!verifiedOwnerDids!.has(did)) {
+        throw new PolicyError('required_owners', 'OWNER_SIGNATURE_REQUIRED', `no verified owner signature by ${did}`);
+      }
+    }
+  }
+
+  if (policy.profile_hashes !== undefined) {
+    const mandate = input.mandate;
+    if (!mandate) throw new PolicyError('profile_hashes', 'PROFILE_HASH_MISMATCH', 'the mandate is needed to check profile_hashes');
+    const expected = policy.profile_hashes[mandate.payload.profile_id];
+    if (expected === undefined) {
+      throw new PolicyError('profile_hashes', 'PROFILE_HASH_MISMATCH', `profile ${mandate.payload.profile_id} is not listed`);
+    }
+    if (expected !== mandate.payload.profile_hash) {
+      throw new PolicyError('profile_hashes', 'PROFILE_HASH_MISMATCH', `profile_hash differs from the listed one for ${mandate.payload.profile_id}`);
+    }
+    if (mandate.payload.mandate_id !== artifact.mandateId) {
+      throw new PolicyError('profile_hashes', 'PROFILE_HASH_MISMATCH', 'the mandate supplied is not the one the artifact names');
+    }
+  }
+
+  if (policy.action_types !== undefined && !policy.action_types.includes(artifact.actionType)) {
+    throw new PolicyError('action_types', 'POLICY_UNMET', `actionType ${artifact.actionType} is not in the listed set`);
+  }
+
+  if (policy.freshness_seconds !== undefined) {
+    if (now - artifact.timestamp > policy.freshness_seconds) {
+      throw new PolicyError('freshness_seconds', 'POLICY_UNMET', `ticket is ${now - artifact.timestamp}s old, policy allows ${policy.freshness_seconds}s`);
+    }
+    if (input.projection && input.asAuthorization && now > input.projection.valid_until) {
+      throw new PolicyError('freshness_seconds', 'POLICY_UNMET', 'projection presented after valid_until');
+    }
+  }
+
+  if (policy.required_fields !== undefined) {
+    const ctx = input.ticket?.executionContext ?? input.projection?.executionContext ?? {};
+    for (const f of policy.required_fields) {
+      if (ctx[f] === undefined) {
+        throw new PolicyError('required_fields', 'POLICY_UNMET', `execution-context field ${f} is not ${input.ticket ? 'present' : 'disclosed'}`);
+      }
+    }
+  }
+
+  if (policy.require_approval_signature) {
+    const ticket = input.ticket;
+    const mandate = input.mandate;
+    if (!ticket || !mandate) {
+      throw new PolicyError('require_approval_signature', 'APPROVAL_SIGNATURE_REQUIRED', 'the complete ticket and its mandate are needed to verify approvals');
+    }
+    if (ticket.proposalId !== undefined) {
+      let verified;
+      try {
+        verified = await verifyTicketApprovals(ticket, mandate);
+      } catch (err) {
+        throw new PolicyError('require_approval_signature', 'APPROVAL_SIGNATURE_REQUIRED', (err as Error).message);
+      }
+      const aboveCap = input.aboveCap ?? (ticket.approvalSignatures !== undefined && ticket.approvalSignatures.length > 0);
+      if (!approvalsSufficient(mandate, verified, aboveCap)) {
+        throw new PolicyError('require_approval_signature', 'APPROVAL_SIGNATURE_REQUIRED', 'the ticket lacks a verifiable signature for each decision it rests on');
+      }
+    }
+  }
+}

package/node_modules/@hap/core/src/versions.ts

@@ -1,36 +1,52 @@
 /**
- * Version negotiation — protocol.md → *Version negotiation (v0.7)*.
+ * Version negotiation — protocol.md → *Version negotiation (v0.7)* and the
+ * v0.7 → v0.8 exception (*Migration from v0.7*).
  *
- * "Gatekeepers and Authority Servers MUST reject unknown or untrusted
- * versions" is a safety rule, not a transition plan; this module is the
- * transition plan. A mandate request carries `supported_versions`; the AS
- * issues at the highest version both sides support, or refuses with
- * `VERSION_UNSUPPORTED` where there is none. A request without the field is
- * read as `["0.6"]` (rule 1) — but this package issues and verifies `0.7`
- * only (CLAUDE.md "Decided by the owner": no backward verify path), so that
- * default exists to make the refusal message honest, not to accept the
- * mandate.
+ * Two sets, because v0.8 is a re-grant release:
+ *
+ * - {@link PROTOCOL_VERSION} — the one version this package ISSUES. A v0.8
+ *   Authority Server issues `version: "0.8"` only, and refuses a mandate
+ *   request that does not support it (rule 3, exception).
+ * - {@link SUPPORTED_VERSIONS} — the versions this package can VERIFY and
+ *   ENFORCE, each under its own rules (rule 4). A Gatekeeper sends this list
+ *   as `supported_versions`; a verifier accepts an artifact of any of them.
+ *   v0.7 is kept so that a Gatekeeper upgraded before its Authority Server
+ *   keeps working, and so that v0.7 artifacts remain verifiable as evidence.
+ *
+ * `negotiateVersion` picks what an Authority Server issues. Its default is
+ * the strict v0.8 set; an AS that bridges the transition passes the wider
+ * set explicitly, behind its own switch.
  */
 import { HapError } from './errors';
 
-/** The protocol version this package issues and verifies. */
-export const PROTOCOL_VERSION = '0.7';
+/** The protocol version this package issues. */
+export const PROTOCOL_VERSION = '0.8';
+
+/** Every version this package verifies and enforces, newest first. */
+export const SUPPORTED_VERSIONS: readonly string[] = ['0.8', '0.7'];
+
+/** The versions an Authority Server built on this package issues. */
+export const ISSUABLE_VERSIONS: readonly string[] = [PROTOCOL_VERSION];
 
-/** The protocol versions this package can verify and enforce. */
-export const SUPPORTED_VERSIONS: readonly string[] = ['0.7'];
+/** A protocol version this package knows the rules of. */
+export type SupportedVersion = '0.8' | '0.7';
+
+export function isSupportedVersion(v: unknown): v is SupportedVersion {
+  return typeof v === 'string' && SUPPORTED_VERSIONS.includes(v);
+}
 
 /**
- * The highest version both the requester and this implementation support.
+ * The highest version both the requester and the issuer support.
  *
  * @param requested `supported_versions` from the mandate request. Absent →
- * read as `["0.6"]` (protocol.md rule 1) — which, against this package's
- * `SUPPORTED_VERSIONS`, has no overlap and refuses honestly rather than
- * silently assuming `0.7`.
+ * read as `["0.6"]` (protocol.md rule 1), which no issuer here supports, so
+ * the refusal is honest rather than a silent assumption.
+ * @param supported What the issuer is willing to issue. Default: v0.8 only.
  * @throws HapError `VERSION_UNSUPPORTED` when no version is common to both.
  */
 export function negotiateVersion(
   requested: readonly string[] | undefined,
-  supported: readonly string[] = SUPPORTED_VERSIONS,
+  supported: readonly string[] = ISSUABLE_VERSIONS,
 ): string {
   const requestedVersions = requested ?? ['0.6'];
   // Highest-first so a requester offering several supported versions gets the
@@ -45,3 +61,18 @@ export function negotiateVersion(
   }
   return common[0];
 }
+
+/**
+ * Refuse an artifact of a version this package cannot verify (rule 4: an
+ * artifact is read under its own version, never re-interpreted).
+ * @throws HapError `VERSION_UNSUPPORTED`
+ */
+export function assertSupportedVersion(version: unknown, what: string): asserts version is SupportedVersion {
+  if (!isSupportedVersion(version)) {
+    throw new HapError(
+      'VERSION_UNSUPPORTED',
+      `${what} version ${JSON.stringify(version)} is not verifiable by this implementation ` +
+        `(verifies [${SUPPORTED_VERSIONS.join(', ')}])`,
+    );
+  }
+}

package/node_modules/@hono/node-server/dist/index.cjs

@@ -169,16 +169,27 @@ const newHeadersFromIncoming = (incoming) => globalThis.Headers === GlobalHeader
 const reValidRequestUrl = /^\/[!#$&-;=?-\[\]_a-z~]*$/;
 const reDotSegment = /\/\.\.?(?:[/?#]|$)/;
 const reValidHost = /^[a-z0-9._-]+(?::(?:[1-5]\d{3,4}|[6-9]\d{3}))?$/;
+const validateRequestTarget = (target) => {
+	const backslash = target.indexOf("\\");
+	if (backslash !== -1) {
+		const query = target.indexOf("?");
+		if (query === -1 || backslash < query) throw new RequestError("Backslash in request path");
+	}
+};
 const buildUrl = (scheme, host, incomingUrl) => {
 	const url = `${scheme}://${host}${incomingUrl}`;
 	if (!reValidHost.test(host)) {
+		validateRequestTarget(incomingUrl);
 		const urlObj = new URL(url);
 		if (urlObj.hostname.length !== host.length && urlObj.hostname !== (host.includes(":") ? host.replace(/:\d+$/, "") : host).toLowerCase()) throw new RequestError("Invalid host header");
 		return urlObj.href;
 	} else if (incomingUrl.length === 0) return url + "/";
 	else {
 		if (incomingUrl.charCodeAt(0) !== 47) throw new RequestError("Invalid URL");
-		if (!reValidRequestUrl.test(incomingUrl) || reDotSegment.test(incomingUrl)) return new URL(url).href;
+		if (!reValidRequestUrl.test(incomingUrl) || reDotSegment.test(incomingUrl)) {
+			validateRequestTarget(incomingUrl);
+			return new URL(url).href;
+		}
 		return url;
 	}
 };
@@ -591,6 +602,7 @@ const newRequest = (incoming, defaultHostname) => {
 	if (incomingUrl[0] !== "/" && (incomingUrl.startsWith("http://") || incomingUrl.startsWith("https://"))) {
 		if (incoming instanceof node_http2.Http2ServerRequest) throw new RequestError("Absolute URL for :path is not allowed in HTTP/2");
 		try {
+			validateRequestTarget(incomingUrl);
 			req[urlKey] = new URL(incomingUrl).href;
 		} catch (e) {
 			throw new RequestError("Invalid absolute URL", { cause: e });
@@ -1143,6 +1155,7 @@ const appendResponseHeaders = (headers, responseHeaders) => {
 	});
 };
 const rejectUpgradeRequest = (socket, status, responseHeaders) => {
+	if (socket.destroyed) return;
 	const responseLines = ["Connection: close", "Content-Length: 0"];
 	appendResponseHeaders(responseLines, responseHeaders);
 	socket.end(`HTTP/1.1 ${status.toString()} ${node_http.STATUS_CODES[status] ?? ""}\r\n${responseLines.join("\r\n")}\r\n\r
@@ -1150,7 +1163,12 @@ const rejectUpgradeRequest = (socket, status, responseHeaders) => {
 };
 const createUpgradeRequest = (request) => {
 	const protocol = request.socket.encrypted ? "https" : "http";
-	const url = new URL(request.url ?? "/", `${protocol}://${request.headers.host ?? "localhost"}`);
+	const incomingUrl = request.url ?? "/";
+	let url;
+	if (incomingUrl[0] !== "/" && (incomingUrl.startsWith("http://") || incomingUrl.startsWith("https://"))) {
+		validateRequestTarget(incomingUrl);
+		url = new URL(incomingUrl).href;
+	} else url = buildUrl(protocol, request.headers.host ?? "localhost", incomingUrl);
 	const headers = new Headers();
 	for (const key in request.headers) {
 		const value = request.headers[key];
@@ -1187,6 +1205,10 @@ const setupWebSocket = (options) => {
 	};
 	server.on("upgrade", async (request, socket, head) => {
 		if (request.headers.upgrade?.toLowerCase() !== "websocket") return;
+		const ignoreSocketError = () => {};
+		const reclaimWaiterOnClose = () => rejectWaiter(request);
+		socket.on("error", ignoreSocketError);
+		socket.once("close", reclaimWaiterOnClose);
 		const env = {
 			incoming: request,
 			outgoing: void 0,
@@ -1201,8 +1223,12 @@ const setupWebSocket = (options) => {
 				status = response.status;
 				responseHeaders = response.headers;
 			}
-		} catch {
-			if (server.listenerCount("upgrade") === 1) rejectUpgradeRequest(socket, 500);
+		} catch (error) {
+			if (server.listenerCount("upgrade") === 1) rejectUpgradeRequest(socket, error instanceof RequestError ? 400 : 500);
+			return;
+		}
+		if (socket.destroyed) {
+			rejectWaiter(request);
 			return;
 		}
 		const waiter = waiterMap.get(request);
@@ -1214,12 +1240,11 @@ const setupWebSocket = (options) => {
 		const addResponseHeaders = (headers) => {
 			appendResponseHeaders(headers, responseHeaders);
 		};
-		const reclaimWaiterOnClose = () => rejectWaiter(request);
-		socket.once("close", reclaimWaiterOnClose);
 		wss.on("headers", addResponseHeaders);
 		try {
 			wss.handleUpgrade(request, socket, head, (ws) => {
 				socket.off("close", reclaimWaiterOnClose);
+				socket.off("error", ignoreSocketError);
 				wss.emit("connection", ws, request);
 			});
 		} finally {

package/node_modules/@hono/node-server/dist/index.mjs

@@ -168,16 +168,27 @@ const newHeadersFromIncoming = (incoming) => globalThis.Headers === GlobalHeader
 const reValidRequestUrl = /^\/[!#$&-;=?-\[\]_a-z~]*$/;
 const reDotSegment = /\/\.\.?(?:[/?#]|$)/;
 const reValidHost = /^[a-z0-9._-]+(?::(?:[1-5]\d{3,4}|[6-9]\d{3}))?$/;
+const validateRequestTarget = (target) => {
+	const backslash = target.indexOf("\\");
+	if (backslash !== -1) {
+		const query = target.indexOf("?");
+		if (query === -1 || backslash < query) throw new RequestError("Backslash in request path");
+	}
+};
 const buildUrl = (scheme, host, incomingUrl) => {
 	const url = `${scheme}://${host}${incomingUrl}`;
 	if (!reValidHost.test(host)) {
+		validateRequestTarget(incomingUrl);
 		const urlObj = new URL(url);
 		if (urlObj.hostname.length !== host.length && urlObj.hostname !== (host.includes(":") ? host.replace(/:\d+$/, "") : host).toLowerCase()) throw new RequestError("Invalid host header");
 		return urlObj.href;
 	} else if (incomingUrl.length === 0) return url + "/";
 	else {
 		if (incomingUrl.charCodeAt(0) !== 47) throw new RequestError("Invalid URL");
-		if (!reValidRequestUrl.test(incomingUrl) || reDotSegment.test(incomingUrl)) return new URL(url).href;
+		if (!reValidRequestUrl.test(incomingUrl) || reDotSegment.test(incomingUrl)) {
+			validateRequestTarget(incomingUrl);
+			return new URL(url).href;
+		}
 		return url;
 	}
 };
@@ -590,6 +601,7 @@ const newRequest = (incoming, defaultHostname) => {
 	if (incomingUrl[0] !== "/" && (incomingUrl.startsWith("http://") || incomingUrl.startsWith("https://"))) {
 		if (incoming instanceof Http2ServerRequest) throw new RequestError("Absolute URL for :path is not allowed in HTTP/2");
 		try {
+			validateRequestTarget(incomingUrl);
 			req[urlKey] = new URL(incomingUrl).href;
 		} catch (e) {
 			throw new RequestError("Invalid absolute URL", { cause: e });
@@ -1142,6 +1154,7 @@ const appendResponseHeaders = (headers, responseHeaders) => {
 	});
 };
 const rejectUpgradeRequest = (socket, status, responseHeaders) => {
+	if (socket.destroyed) return;
 	const responseLines = ["Connection: close", "Content-Length: 0"];
 	appendResponseHeaders(responseLines, responseHeaders);
 	socket.end(`HTTP/1.1 ${status.toString()} ${STATUS_CODES[status] ?? ""}\r\n${responseLines.join("\r\n")}\r\n\r
@@ -1149,7 +1162,12 @@ const rejectUpgradeRequest = (socket, status, responseHeaders) => {
 };
 const createUpgradeRequest = (request) => {
 	const protocol = request.socket.encrypted ? "https" : "http";
-	const url = new URL(request.url ?? "/", `${protocol}://${request.headers.host ?? "localhost"}`);
+	const incomingUrl = request.url ?? "/";
+	let url;
+	if (incomingUrl[0] !== "/" && (incomingUrl.startsWith("http://") || incomingUrl.startsWith("https://"))) {
+		validateRequestTarget(incomingUrl);
+		url = new URL(incomingUrl).href;
+	} else url = buildUrl(protocol, request.headers.host ?? "localhost", incomingUrl);
 	const headers = new Headers();
 	for (const key in request.headers) {
 		const value = request.headers[key];
@@ -1186,6 +1204,10 @@ const setupWebSocket = (options) => {
 	};
 	server.on("upgrade", async (request, socket, head) => {
 		if (request.headers.upgrade?.toLowerCase() !== "websocket") return;
+		const ignoreSocketError = () => {};
+		const reclaimWaiterOnClose = () => rejectWaiter(request);
+		socket.on("error", ignoreSocketError);
+		socket.once("close", reclaimWaiterOnClose);
 		const env = {
 			incoming: request,
 			outgoing: void 0,
@@ -1200,8 +1222,12 @@ const setupWebSocket = (options) => {
 				status = response.status;
 				responseHeaders = response.headers;
 			}
-		} catch {
-			if (server.listenerCount("upgrade") === 1) rejectUpgradeRequest(socket, 500);
+		} catch (error) {
+			if (server.listenerCount("upgrade") === 1) rejectUpgradeRequest(socket, error instanceof RequestError ? 400 : 500);
+			return;
+		}
+		if (socket.destroyed) {
+			rejectWaiter(request);
 			return;
 		}
 		const waiter = waiterMap.get(request);
@@ -1213,12 +1239,11 @@ const setupWebSocket = (options) => {
 		const addResponseHeaders = (headers) => {
 			appendResponseHeaders(headers, responseHeaders);
 		};
-		const reclaimWaiterOnClose = () => rejectWaiter(request);
-		socket.once("close", reclaimWaiterOnClose);
 		wss.on("headers", addResponseHeaders);
 		try {
 			wss.handleUpgrade(request, socket, head, (ws) => {
 				socket.off("close", reclaimWaiterOnClose);
+				socket.off("error", ignoreSocketError);
 				wss.emit("connection", ws, request);
 			});
 		} finally {

package/node_modules/@hono/node-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hono/node-server",
-  "version": "2.1.5",
+  "version": "2.1.6",
   "description": "Node.js Adapter for Hono",
   "main": "dist/index.mjs",
   "type": "module",

package/node_modules/@hpke/common/esm/package.json

@@ -1,3 +1,7 @@
 {
-  "type": "module"
+  "type": "module",
+  "sideEffects": false,
+  "browser": {
+    "crypto": false
+  }
 }

package/node_modules/@hpke/common/esm/src/curve/montgomery.d.ts

@@ -12,7 +12,7 @@ export type CurveType = {
     type: "x25519" | "x448";
     adjustScalarBytes: (bytes: Uint8Array) => Uint8Array;
     powPminus2: (x: bigint) => bigint;
-    randomBytes?: (bytesLength?: number) => Promise<Uint8Array>;
+    randomBytes?: (bytesLength?: number) => Uint8Array;
 };
 export type MontgomeryECDH = {
     scalarMult: (scalar: Uint8Array, u: Uint8Array) => Uint8Array;
@@ -20,7 +20,7 @@ export type MontgomeryECDH = {
     getSharedSecret: (secretKeyA: Uint8Array, publicKeyB: Uint8Array) => Uint8Array;
     getPublicKey: (secretKey: Uint8Array) => Uint8Array;
     utils: {
-        randomSecretKey: (seed?: Uint8Array) => Promise<Uint8Array>;
+        randomSecretKey: (seed?: Uint8Array) => Uint8Array;
     };
     GuBytes: Uint8Array;
     lengths: CurveLengths;

package/node_modules/@hpke/common/esm/src/curve/montgomery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"montgomery.d.ts","sourceRoot":"","sources":["../../../src/src/curve/montgomery.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAmBH,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAI7D,MAAM,MAAM,SAAS,GAAG;IACtB,CAAC,EAAE,MAAM,CAAC;IACV,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IACxB,iBAAiB,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,UAAU,CAAC;IACrD,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAClC,WAAW,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;CAC7D,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,KAAK,UAAU,CAAC;IAC9D,cAAc,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,UAAU,CAAC;IACnD,eAAe,EAAE,CACf,UAAU,EAAE,UAAU,EACtB,UAAU,EAAE,UAAU,KACnB,UAAU,CAAC;IAChB,YAAY,EAAE,CAAC,SAAS,EAAE,UAAU,KAAK,UAAU,CAAC;IACpD,KAAK,EAAE;QACL,eAAe,EAAE,CAAC,IAAI,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;KAC7D,CAAC;IACF,OAAO,EAAE,UAAU,CAAC;IACpB,OAAO,EAAE,YAAY,CAAC;IACtB,MAAM,EAAE,CACN,IAAI,CAAC,EAAE,UAAU,KACd;QAAE,SAAS,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,UAAU,CAAA;KAAE,CAAC;CACvD,CAAC;AAUF,wBAAgB,UAAU,CAAC,QAAQ,EAAE,SAAS,GAAG,cAAc,CA4I9D"}
+{"version":3,"file":"montgomery.d.ts","sourceRoot":"","sources":["../../../src/src/curve/montgomery.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAmBH,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAI7D,MAAM,MAAM,SAAS,GAAG;IACtB,CAAC,EAAE,MAAM,CAAC;IACV,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IACxB,iBAAiB,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,UAAU,CAAC;IACrD,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAClC,WAAW,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,MAAM,KAAK,UAAU,CAAC;CACpD,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,KAAK,UAAU,CAAC;IAC9D,cAAc,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,UAAU,CAAC;IACnD,eAAe,EAAE,CACf,UAAU,EAAE,UAAU,EACtB,UAAU,EAAE,UAAU,KACnB,UAAU,CAAC;IAChB,YAAY,EAAE,CAAC,SAAS,EAAE,UAAU,KAAK,UAAU,CAAC;IACpD,KAAK,EAAE;QACL,eAAe,EAAE,CAAC,IAAI,CAAC,EAAE,UAAU,KAAK,UAAU,CAAC;KACpD,CAAC;IACF,OAAO,EAAE,UAAU,CAAC;IACpB,OAAO,EAAE,YAAY,CAAC;IACtB,MAAM,EAAE,CACN,IAAI,CAAC,EAAE,UAAU,KACd;QAAE,SAAS,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,UAAU,CAAA;KAAE,CAAC;CACvD,CAAC;AAUF,wBAAgB,UAAU,CAAC,QAAQ,EAAE,SAAS,GAAG,cAAc,CAqJ9D"}

package/node_modules/@hpke/common/esm/src/curve/montgomery.js

@@ -13,7 +13,7 @@
  * @module
  */
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-import { abytes, aInRange, bytesToNumberLE, copyBytes, numberToBytesLE, randomBytesAsync, validateObject, } from "../utils/noble.js";
+import { abytes, aInRange, bytesToNumberLE, copyBytes, numberToBytesLE, randomBytes, validateObject, } from "../utils/noble.js";
 import { createKeygen } from "./curve.js";
 import { mod } from "./modular.js";
 import { N_0, N_1, N_2 } from "../consts.js";
@@ -30,8 +30,8 @@ export function montgomery(curveDef) {
     const is25519 = type === "x25519";
     if (!is25519 && type !== "x448")
         throw new Error("invalid type");
-    const randomBytes_ = rand || randomBytesAsync;
-    const montgomeryBits = is25519 ? 255n : 448n;
+    const randomBytes_ = rand || randomBytes;
+    const montgomeryBits = is25519 ? 255 : 448;
     const fieldLen = is25519 ? 32 : 56;
     const Gu = is25519 ? 9n : 5n;
     // RFC 7748 #5:
@@ -50,17 +50,20 @@ export function montgomery(curveDef) {
     function encodeU(u) {
         return numberToBytesLE(modP(u), fieldLen);
     }
+    // Mask for clearing bit 255 (x25519): (1n << 255n) - 1n
+    const uMask = is25519 ? (N_1 << 255n) - N_1 : N_0;
     function decodeU(u) {
-        const _u = copyBytes(abytes(u, fieldLen, "uCoordinate"));
+        abytes(u, fieldLen, "uCoordinate");
+        let n = bytesToNumberLE(u);
         // RFC: When receiving such an array, implementations of X25519
         // (but not X448) MUST mask the most significant bit in the final byte.
         if (is25519)
-            _u[31] &= 127; // 0b0111_1111
+            n &= uMask;
         // RFC: Implementations MUST accept non-canonical values and process them as
         // if they had been reduced modulo the field prime.  The non-canonical
         // values are 2^255 - 19 through 2^255 - 1 for X25519 and 2^448 - 2^224
         // - 1 through 2^448 - 1 for X448.
-        return modP(bytesToNumberLE(_u));
+        return modP(n);
     }
     function decodeScalar(scalar) {
         return bytesToNumberLE(adjustScalarBytes(copyBytes(abytes(scalar, fieldLen, "scalar"))));
@@ -74,24 +77,21 @@ export function montgomery(curveDef) {
             throw new Error("invalid private or public key received");
         return encodeU(pu);
     }
+    // Pre-decoded base point u-coordinate (avoids redundant decode on every call)
+    const GuDecoded = modP(Gu);
     // Computes public key from private. By doing scalar multiplication of base point.
     function scalarMultBase(scalar) {
-        return scalarMult(scalar, GuBytes);
+        const pu = montgomeryLadder(GuDecoded, decodeScalar(scalar));
+        if (pu === N_0)
+            throw new Error("invalid private or public key received");
+        return encodeU(pu);
     }
     const getPublicKey = scalarMultBase;
     const getSharedSecret = scalarMult;
-    // cswap from RFC7748 "example code"
-    function cswap(swap, x_2, x_3) {
-        // dummy = mask(swap) AND (x_2 XOR x_3)
-        // Where mask(swap) is the all-1 or all-0 word of the same length as x_2
-        // and x_3, computed, e.g., as mask(swap) = 0 - swap.
-        const dummy = modP(swap * (x_2 - x_3));
-        x_2 = modP(x_2 - dummy); // x_2 = x_2 XOR dummy
-        x_3 = modP(x_3 + dummy); // x_3 = x_3 XOR dummy
-        return { x_2, x_3 };
-    }
     /**
      * Montgomery x-only multiplication ladder.
+     * cswap is inlined to avoid per-iteration object allocations.
+     * Loop counter uses number instead of bigint to avoid BigInt arithmetic overhead.
      * @param pointU u coordinate (x) on Montgomery Curve 25519
      * @param scalar by which the point would be multiplied
      * @returns new Point on Montgomery curve
@@ -106,11 +106,19 @@ export function montgomery(curveDef) {
         let x_3 = u;
         let z_3 = N_1;
         let swap = N_0;
-        for (let t = montgomeryBits - 1n; t >= N_0; t--) {
-            const k_t = (k >> t) & N_1;
+        let dummy;
+        for (let t = montgomeryBits - 1; t >= 0; t--) {
+            const k_t = (k >> BigInt(t)) & N_1;
             swap ^= k_t;
-            ({ x_2, x_3 } = cswap(swap, x_2, x_3));
-            ({ x_2: z_2, x_3: z_3 } = cswap(swap, z_2, z_3));
+            // Masked cswap (best-effort constant-time for BigInt).
+            // Only dummy needs modP; x/z reductions are deferred to the
+            // subsequent multiplications in the ladder body.
+            dummy = modP(swap * (x_2 - x_3));
+            x_2 -= dummy;
+            x_3 += dummy;
+            dummy = modP(swap * (z_2 - z_3));
+            z_2 -= dummy;
+            z_3 += dummy;
             swap = k_t;
             const A = x_2 + z_2;
             const AA = modP(A * A);
@@ -126,10 +134,17 @@ export function montgomery(curveDef) {
             x_3 = modP(dacb * dacb);
             z_3 = modP(x_1 * modP(da_cb * da_cb));
             x_2 = modP(AA * BB);
-            z_2 = modP(E * (AA + modP(a24 * E)));
+            // a24 is small (17-bit for x25519, 16-bit for x448), so a24 * E adds
+            // only ~17 bits beyond P — negligible impact on the outer multiplication.
+            z_2 = modP(E * (AA + a24 * E));
         }
-        ({ x_2, x_3 } = cswap(swap, x_2, x_3));
-        ({ x_2: z_2, x_3: z_3 } = cswap(swap, z_2, z_3));
+        // Final masked cswap
+        dummy = modP(swap * (x_2 - x_3));
+        x_2 -= dummy;
+        x_3 += dummy;
+        dummy = modP(swap * (z_2 - z_3));
+        z_2 -= dummy;
+        z_3 += dummy;
         const z2 = powPminus2(z_2); // `Fp.pow(x, P - N_2)` is much slower equivalent
         return modP(x_2 * z2); // Return x_2 * (z_2^(p - 2))
     }
@@ -138,9 +153,9 @@ export function montgomery(curveDef) {
         publicKey: fieldLen,
         seed: fieldLen,
     };
-    const randomSecretKey = async (seed) => {
+    const randomSecretKey = (seed) => {
         if (seed === undefined) {
-            seed = await randomBytes_(fieldLen);
+            seed = randomBytes_(fieldLen);
         }
         abytes(seed, lengths.seed, "seed");
         return seed;

package/node_modules/@hpke/common/esm/src/hash/sha3.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sha3.d.ts","sourceRoot":"","sources":["../../../src/src/hash/sha3.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAwBH,OAAO,EACL,KAAK,KAAK,EACV,KAAK,QAAQ,EAEb,KAAK,IAAI,EAET,KAAK,OAAO,EACb,MAAM,WAAW,CAAC;AA4CnB,kFAAkF;AAClF,wBAAgB,OAAO,CACrB,CAAC,EAAE,WAAW,EACd,MAAM,GAAE,MAAW,EACnB,CAAC,CAAC,EAAE,WAAW,GACd,IAAI,CAySN;AAED,8BAA8B;AAC9B,qBAAa,MAAO,YAAW,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC;IAC1D,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC;IAC5B,SAAS,CAAC,GAAG,SAAK;IAClB,SAAS,CAAC,MAAM,SAAK;IACrB,SAAS,CAAC,QAAQ,UAAS;IAC3B,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC;IAC/B,SAAS,CAAC,SAAS,UAAS;IAC5B,OAAO,CAAC,EAAE,CAAuB;IAE1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,SAAS,UAAS;IAC5B,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;gBAIvB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,UAAQ,EACjB,MAAM,GAAE,MAAW;IAiBrB,KAAK,IAAI,MAAM;IAGf,0DAA0D;IAC1D,KAAK,IAAI,IAAI;IAOb,SAAS,CAAC,MAAM,IAAI,IAAI;IAOxB,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI;IAK9B,qFAAqF;IACrF,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI;IAUpC,SAAS,CAAC,MAAM,IAAI,IAAI;IAUxB,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU;IAKhD,yFAAyF;IACzF,eAAe,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU;IAa5C,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU;IAOpC,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU;IAI9B,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU;IAOvC,MAAM,IAAI,UAAU;IAGpB,OAAO,IAAI,IAAI;IAIf,UAAU,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM;CAehC;AAiBD,yDAAyD;AACzD,eAAO,MAAM,QAAQ,EAAE,KAKtB,CAAC;AAEF,8BAA8B;AAC9B,eAAO,MAAM,QAAQ,EAAE,KAKtB,CAAC;AAEF,8BAA8B;AAC9B,eAAO,MAAM,QAAQ,EAAE,KAKtB,CAAC;AAEF,gCAAgC;AAChC,eAAO,MAAM,UAAU,EAAE,KAAgD,CAAC;AAC1E,yDAAyD;AACzD,eAAO,MAAM,UAAU,EAAE,KAAgD,CAAC;AAC1E,gCAAgC;AAChC,eAAO,MAAM,UAAU,EAAE,KAAgD,CAAC;AAC1E,gCAAgC;AAChC,eAAO,MAAM,UAAU,EAAE,KAA+C,CAAC;AAEzE,MAAM,MAAM,SAAS,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAmB3C,0CAA0C;AAC1C,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAEO,CAAC;AACzD,0CAA0C;AAC1C,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAEO,CAAC"}
+{"version":3,"file":"sha3.d.ts","sourceRoot":"","sources":["../../../src/src/hash/sha3.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAwBH,OAAO,EACL,KAAK,KAAK,EACV,KAAK,QAAQ,EAEb,KAAK,IAAI,EAET,KAAK,OAAO,EACb,MAAM,WAAW,CAAC;AA4CnB,kFAAkF;AAClF,wBAAgB,OAAO,CACrB,CAAC,EAAE,WAAW,EACd,MAAM,GAAE,MAAW,EACnB,CAAC,CAAC,EAAE,WAAW,GACd,IAAI,CAySN;AAED,8BAA8B;AAC9B,qBAAa,MAAO,YAAW,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC;IAC1D,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC;IAC5B,SAAS,CAAC,GAAG,SAAK;IAClB,SAAS,CAAC,MAAM,SAAK;IACrB,SAAS,CAAC,QAAQ,UAAS;IAC3B,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC;IAC/B,SAAS,CAAC,SAAS,UAAS;IAC5B,OAAO,CAAC,EAAE,CAAuB;IAE1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,SAAS,UAAS;IAC5B,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;gBAIvB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,UAAQ,EACjB,MAAM,GAAE,MAAW;IAiBrB,KAAK,IAAI,MAAM;IAGf,0DAA0D;IAC1D,KAAK,IAAI,IAAI;IAOb,SAAS,CAAC,MAAM,IAAI,IAAI;IAOxB,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI;IAK9B,qFAAqF;IACrF,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI;IAUpC,SAAS,CAAC,MAAM,IAAI,IAAI;IAUxB,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU;IAKhD,yFAAyF;IACzF,eAAe,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU;IAa5C,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU;IAOpC,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU;IAI9B,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU;IAOvC,MAAM,IAAI,UAAU;IAGpB,OAAO,IAAI,IAAI;IAIf,UAAU,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM;CAehC;AASD,yDAAyD;AACzD,eAAO,MAAM,QAAQ,EAAE,KAKtB,CAAC;AAEF,8BAA8B;AAC9B,eAAO,MAAM,QAAQ,EAAE,KAKtB,CAAC;AAEF,8BAA8B;AAC9B,eAAO,MAAM,QAAQ,EAAE,KAKtB,CAAC;AAEF,gCAAgC;AAChC,eAAO,MAAM,UAAU,EAAE,KAAgD,CAAC;AAC1E,yDAAyD;AACzD,eAAO,MAAM,UAAU,EAAE,KAAgD,CAAC;AAC1E,gCAAgC;AAChC,eAAO,MAAM,UAAU,EAAE,KAAgD,CAAC;AAC1E,gCAAgC;AAChC,eAAO,MAAM,UAAU,EAAE,KAA+C,CAAC;AAEzE,MAAM,MAAM,SAAS,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAmB3C,0CAA0C;AAC1C,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAEO,CAAC;AACzD,0CAA0C;AAC1C,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAEO,CAAC"}