ox 1.0.5 → 1.1.2

package/src/wasm/internal/instantiate.ts

@@ -0,0 +1,135 @@
+import * as Errors from '../../core/Errors.js'
+
+/**
+ * Shared WASM instantiation and memory plumbing.
+ *
+ * @internal
+ */
+
+/** An instantiated WASM module, with helpers for moving bytes across. */
+export type Module<exports extends Record<string, unknown>> = {
+  /** The module's exported functions. */
+  exports: exports
+  /** Address of the first byte we may write to. */
+  heapBase: number
+  /**
+   * Grows linear memory so `bytes` are available above `heapBase`.
+   *
+   * @throws {@link MemoryError} when the runtime refuses to grow.
+   */
+  reserve(bytes: number): void
+  /**
+   * A view over the module's current memory.
+   *
+   * Must be called after {@link Module.reserve} and again after anything that
+   * could grow memory: `WebAssembly.Memory.grow` detaches the previous
+   * `ArrayBuffer`, which silently turns any retained view into a zero-length one.
+   */
+  view(): Uint8Array
+}
+
+const pageSize = 65_536
+
+function decode(base64: string): Uint8Array {
+  // `Uint8Array.fromBase64` where available, then Node/Bun, then browsers and
+  // edge runtimes.
+  const fromBase64 = (
+    Uint8Array as unknown as {
+      fromBase64?: ((value: string) => Uint8Array) | undefined
+    }
+  ).fromBase64
+  if (fromBase64) return fromBase64(base64)
+  if (typeof Buffer !== 'undefined')
+    return new Uint8Array(Buffer.from(base64, 'base64'))
+  const binary = atob(base64)
+  const bytes = new Uint8Array(binary.length)
+  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i)
+  return bytes
+}
+
+/**
+ * Instantiates a base64-encoded WASM module.
+ *
+ * Always asynchronous: browsers refuse to compile modules larger than a few
+ * kilobytes synchronously on the main thread, so there is no synchronous path to
+ * fall back to. Callers await this once and then call the module synchronously.
+ *
+ * @internal
+ */
+export async function instantiate<exports extends Record<string, unknown>>(
+  base64: string,
+): Promise<Module<exports>> {
+  const { instance } = await WebAssembly.instantiate(decode(base64), {})
+  const exports = instance.exports as {
+    heap_base(): number
+    memory: WebAssembly.Memory
+  } & exports
+
+  const { memory } = exports
+  const heapBase = exports.heap_base()
+
+  let cached = new Uint8Array(memory.buffer)
+
+  return {
+    exports,
+    heapBase,
+    reserve(bytes) {
+      const required = heapBase + bytes
+      if (memory.buffer.byteLength >= required) return
+      const pages = Math.ceil((required - memory.buffer.byteLength) / pageSize)
+      try {
+        memory.grow(pages)
+      } catch (cause) {
+        throw new MemoryError({ bytes: required, cause: cause as Error })
+      }
+      cached = new Uint8Array(memory.buffer)
+    },
+    view() {
+      // `grow` detaches the old buffer, so compare identity rather than trusting
+      // the cached view.
+      if (cached.buffer !== memory.buffer)
+        cached = new Uint8Array(memory.buffer)
+      return cached
+    },
+  }
+}
+
+/**
+ * Memoizes a loader so concurrent callers compile the module once.
+ *
+ * The promise is memoized rather than its result, so a second call made while
+ * the first is still compiling awaits the same compilation. A rejected attempt
+ * is discarded, so a later call can try again.
+ *
+ * @internal
+ */
+export function memoize<value>(
+  load: () => Promise<value>,
+): () => Promise<value> {
+  let cached: Promise<value> | undefined
+  return () => {
+    // Only success is memoized. Compilation can fail for reasons that pass --
+    // a runtime briefly out of memory, say -- and caching the rejection would
+    // make one bad moment permanent for the life of the process.
+    cached ??= load().catch((error) => {
+      cached = undefined
+      throw error
+    })
+    return cached
+  }
+}
+
+/** Thrown when a WASM module cannot grow its memory to the required size. */
+export class MemoryError extends Errors.BaseError<Error> {
+  override readonly name = 'Wasm.MemoryError'
+
+  constructor({ bytes, cause }: { bytes: number; cause: Error }) {
+    super('WASM memory could not be grown to the required size.', {
+      cause,
+      metaMessages: [
+        `Required: ${bytes} bytes`,
+        'The input may be too large for this runtime. Reset the engine slot with `Engine.reset` to fall back to the default implementation.',
+      ],
+    })
+  }
+}

package/src/wasm/internal/mnemonic.ts

@@ -0,0 +1,56 @@
+import type { Module } from './crypto25519.js'
+
+const encoder = new TextEncoder()
+const seedSize = 64
+const wordCounts = [12, 15, 18, 21, 24]
+
+/** Derives a BIP-39 seed and clears encoded and staged secret material. */
+export function toSeed(
+  module: Module,
+  mnemonic: string,
+  passphrase = '',
+): Uint8Array {
+  const password = encoder.encode(normalize(mnemonic))
+  try {
+    const salt = encoder.encode(normalizeSalt(passphrase))
+    try {
+      const size = password.length + salt.length + seedSize
+      module.reserve(size)
+      const passwordPtr = module.heapBase
+      const saltPtr = passwordPtr + password.length
+      const seedPtr = saltPtr + salt.length
+      try {
+        const memory = module.view()
+        memory.set(password, passwordPtr)
+        memory.set(salt, saltPtr)
+        module.exports.mnemonic_to_seed(
+          passwordPtr,
+          password.length,
+          saltPtr,
+          salt.length,
+          seedPtr,
+        )
+        return module.view().slice(seedPtr, seedPtr + seedSize)
+      } finally {
+        module.exports.zero(passwordPtr, size)
+      }
+    } finally {
+      salt.fill(0)
+    }
+  } finally {
+    password.fill(0)
+  }
+}
+
+function normalize(mnemonic: string): string {
+  if (typeof mnemonic !== 'string')
+    throw new TypeError(`invalid mnemonic type: ${typeof mnemonic}`)
+  const normalized = mnemonic.normalize('NFKD')
+  if (!wordCounts.includes(normalized.split(' ').length))
+    throw new Error('Invalid mnemonic')
+  return normalized
+}
+
+function normalizeSalt(passphrase: string): string {
+  return `mnemonic${passphrase}`.normalize('NFKD')
+}

package/src/wasm/internal/pbkdf2.ts

@@ -0,0 +1,86 @@
+import { pbkdf2Sha256ScratchSize } from './hashes.wasm.js'
+import { MemoryError, type Module } from './instantiate.js'
+
+/** WASM exports used by the PBKDF2-HMAC-SHA256 loader. @internal */
+export type Exports = {
+  pbkdf2_sha256(
+    password: number,
+    passwordLength: number,
+    salt: number,
+    saltLength: number,
+    iterations: number,
+    out: number,
+    outLength: number,
+    scratch: number,
+  ): void
+  zero(ptr: number, length: number): void
+}
+
+const maximumUint32 = 0xffff_ffff
+const wasm32Size = 0x1_0000_0000
+
+/** Calls PBKDF2-HMAC-SHA256 and clears its complete linear-memory region. */
+export function pbkdf2Sha256(
+  module: Module<Exports>,
+  password: Uint8Array,
+  salt: Uint8Array,
+  options: { c: number; dkLen: number },
+): Uint8Array {
+  const { c, dkLen } = options
+  assertPositiveUint32(c, 'c')
+  assertPositiveUint32(dkLen, 'dkLen')
+
+  const passwordLength = password.length
+  const saltLength = salt.length
+  if (saltLength > maximumUint32 - 4)
+    throw new RangeError(
+      `"salt" length must be <= ${maximumUint32 - 4}, got ${saltLength}`,
+    )
+
+  const passwordPtr = module.heapBase
+  const saltPtr = passwordPtr + passwordLength
+  const outPtr = saltPtr + saltLength + 4
+  const scratchPtr = align4(outPtr + dkLen)
+  const end = scratchPtr + pbkdf2Sha256ScratchSize
+  if (!Number.isSafeInteger(end) || end > wasm32Size)
+    throw new MemoryError({
+      bytes: end,
+      cause: new RangeError('PBKDF2 workspace exceeds wasm32 memory.'),
+    })
+
+  module.reserve(end - passwordPtr)
+  const view = module.view()
+  try {
+    view.set(password, passwordPtr)
+    view.set(salt, saltPtr)
+    module.exports.pbkdf2_sha256(
+      passwordPtr,
+      passwordLength,
+      saltPtr,
+      saltLength,
+      c,
+      outPtr,
+      dkLen,
+      scratchPtr,
+    )
+    return module.view().slice(outPtr, outPtr + dkLen)
+  } finally {
+    // This includes the password, salt and counter, staged output, alignment
+    // padding, and every byte of PBKDF2/HMAC working state.
+    module.exports.zero(passwordPtr, end - passwordPtr)
+  }
+}
+
+function align4(value: number) {
+  return Math.ceil(value / 4) * 4
+}
+
+function assertPositiveUint32(value: number, name: string) {
+  if (typeof value !== 'number')
+    throw new TypeError(`"${name}" expected number, got ${typeof value}`)
+  if (!Number.isSafeInteger(value) || value < 0)
+    throw new RangeError(`"${name}" expected integer >= 0, got ${value}`)
+  if (value < 1) throw new Error(`"${name}" must be >= 1`)
+  if (value > maximumUint32)
+    throw new RangeError(`"${name}" must be <= ${maximumUint32}, got ${value}`)
+}

package/src/wasm/internal/x25519.ts

@@ -0,0 +1,29 @@
+import type { Module } from './crypto25519.js'
+
+const keySize = 32
+
+/** Derives a shared secret and clears both keys and the staged result. */
+export function getSharedSecret(
+  module: Module,
+  privateKey: Uint8Array,
+  publicKey: Uint8Array,
+): Uint8Array {
+  module.reserve(keySize * 3)
+  const privateKeyPtr = module.heapBase
+  const publicKeyPtr = privateKeyPtr + keySize
+  const sharedSecretPtr = publicKeyPtr + keySize
+  try {
+    const memory = module.view()
+    memory.set(privateKey, privateKeyPtr)
+    memory.set(publicKey, publicKeyPtr)
+    const valid = module.exports.x25519_get_shared_secret(
+      privateKeyPtr,
+      publicKeyPtr,
+      sharedSecretPtr,
+    )
+    if (valid !== 1) throw new Error('invalid private or public key received')
+    return module.view().slice(sharedSecretPtr, sharedSecretPtr + keySize)
+  } finally {
+    module.exports.zero(privateKeyPtr, keySize * 3)
+  }
+}

package/src/tempo/internal/mine.c

@@ -1,182 +0,0 @@
-// TIP-1022 salt mining — isomorphic WASM (Node + browser).
-// Specialized single-block keccak256 for 52-byte input.
-//
-// Memory layout at offset 1024:
-//   [0..19]   address   (set by JS)
-//   [20..51]  salt      (set by JS, incremented in-place)
-//   [52..83]  hash out  (written on match)
-
-typedef unsigned char      uint8_t;
-typedef unsigned int       uint32_t;
-typedef unsigned long long uint64_t;
-
-#define DATA_OFFSET 1024
-
-// ---------------------------------------------------------------------------
-// Keccak-f[1600] — fully unrolled, native uint64_t → wasm i64.
-// Based on XKCP / hash-wasm structure.
-// ---------------------------------------------------------------------------
-
-#define ROTL64(x, n) (((x) << (n)) | ((x) >> (64 - (n))))
-
-static const uint64_t RC[24] = {
-    0x0000000000000001ULL, 0x0000000000008082ULL, 0x800000000000808aULL,
-    0x8000000080008000ULL, 0x000000000000808bULL, 0x0000000080000001ULL,
-    0x8000000080008081ULL, 0x8000000000008009ULL, 0x000000000000008aULL,
-    0x0000000000000088ULL, 0x0000000080008009ULL, 0x000000008000000aULL,
-    0x000000008000808bULL, 0x800000000000008bULL, 0x8000000000008089ULL,
-    0x8000000000008003ULL, 0x8000000000008002ULL, 0x8000000000000080ULL,
-    0x000000000000800aULL, 0x800000008000000aULL, 0x8000000080008081ULL,
-    0x8000000000008080ULL, 0x0000000080000001ULL, 0x8000000080008008ULL,
-};
-
-// Theta — fully unrolled column parity + diffusion
-#define XORED(i) (A[(i)] ^ A[(i)+5] ^ A[(i)+10] ^ A[(i)+15] ^ A[(i)+20])
-
-static inline void theta(uint64_t *A) {
-    uint64_t D[5];
-    D[0] = ROTL64(XORED(1), 1) ^ XORED(4);
-    D[1] = ROTL64(XORED(2), 1) ^ XORED(0);
-    D[2] = ROTL64(XORED(3), 1) ^ XORED(1);
-    D[3] = ROTL64(XORED(4), 1) ^ XORED(2);
-    D[4] = ROTL64(XORED(0), 1) ^ XORED(3);
-    A[ 0]^=D[0]; A[ 1]^=D[1]; A[ 2]^=D[2]; A[ 3]^=D[3]; A[ 4]^=D[4];
-    A[ 5]^=D[0]; A[ 6]^=D[1]; A[ 7]^=D[2]; A[ 8]^=D[3]; A[ 9]^=D[4];
-    A[10]^=D[0]; A[11]^=D[1]; A[12]^=D[2]; A[13]^=D[3]; A[14]^=D[4];
-    A[15]^=D[0]; A[16]^=D[1]; A[17]^=D[2]; A[18]^=D[3]; A[19]^=D[4];
-    A[20]^=D[0]; A[21]^=D[1]; A[22]^=D[2]; A[23]^=D[3]; A[24]^=D[4];
-}
-
-// Rho — explicit per-lane rotations with compile-time constants
-static inline void rho(uint64_t *A) {
-    A[ 1] = ROTL64(A[ 1],  1); A[ 2] = ROTL64(A[ 2], 62);
-    A[ 3] = ROTL64(A[ 3], 28); A[ 4] = ROTL64(A[ 4], 27);
-    A[ 5] = ROTL64(A[ 5], 36); A[ 6] = ROTL64(A[ 6], 44);
-    A[ 7] = ROTL64(A[ 7],  6); A[ 8] = ROTL64(A[ 8], 55);
-    A[ 9] = ROTL64(A[ 9], 20); A[10] = ROTL64(A[10],  3);
-    A[11] = ROTL64(A[11], 10); A[12] = ROTL64(A[12], 43);
-    A[13] = ROTL64(A[13], 25); A[14] = ROTL64(A[14], 39);
-    A[15] = ROTL64(A[15], 41); A[16] = ROTL64(A[16], 45);
-    A[17] = ROTL64(A[17], 15); A[18] = ROTL64(A[18], 21);
-    A[19] = ROTL64(A[19],  8); A[20] = ROTL64(A[20], 18);
-    A[21] = ROTL64(A[21],  2); A[22] = ROTL64(A[22], 61);
-    A[23] = ROTL64(A[23], 56); A[24] = ROTL64(A[24], 14);
-}
-
-// Pi — single-temporary rotation chain (no scratch buffer)
-static inline void pi(uint64_t *A) {
-    uint64_t A1 = A[1];
-    A[ 1]=A[ 6]; A[ 6]=A[ 9]; A[ 9]=A[22]; A[22]=A[14]; A[14]=A[20];
-    A[20]=A[ 2]; A[ 2]=A[12]; A[12]=A[13]; A[13]=A[19]; A[19]=A[23];
-    A[23]=A[15]; A[15]=A[ 4]; A[ 4]=A[24]; A[24]=A[21]; A[21]=A[ 8];
-    A[ 8]=A[16]; A[16]=A[ 5]; A[ 5]=A[ 3]; A[ 3]=A[18]; A[18]=A[17];
-    A[17]=A[11]; A[11]=A[ 7]; A[ 7]=A[10]; A[10]=A1;
-}
-
-// Chi — unrolled nonlinear step
-#define CHI_ROW(i) { \
-    uint64_t a0 = A[(i)], a1 = A[(i)+1]; \
-    A[(i)  ] ^= ~a1        & A[(i)+2]; \
-    A[(i)+1] ^= ~A[(i)+2]  & A[(i)+3]; \
-    A[(i)+2] ^= ~A[(i)+3]  & A[(i)+4]; \
-    A[(i)+3] ^= ~A[(i)+4]  & a0;       \
-    A[(i)+4] ^= ~a0        & a1;       \
-}
-
-static inline void chi(uint64_t *A) {
-    CHI_ROW(0); CHI_ROW(5); CHI_ROW(10); CHI_ROW(15); CHI_ROW(20);
-}
-
-static void keccak_f1600(uint64_t *A) {
-    for (int r = 0; r < 24; r++) {
-        theta(A); rho(A); pi(A); chi(A);
-        A[0] ^= RC[r];
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-static inline uint64_t load64_le(const uint8_t *p) {
-    return (uint64_t)p[0]       | ((uint64_t)p[1] << 8)  |
-           ((uint64_t)p[2] <<16)| ((uint64_t)p[3] << 24) |
-           ((uint64_t)p[4] <<32)| ((uint64_t)p[5] << 40) |
-           ((uint64_t)p[6] <<48)| ((uint64_t)p[7] << 56);
-}
-
-static inline void store64_le(uint8_t *p, uint64_t v) {
-    p[0]=(uint8_t)v; p[1]=(uint8_t)(v>>8); p[2]=(uint8_t)(v>>16); p[3]=(uint8_t)(v>>24);
-    p[4]=(uint8_t)(v>>32); p[5]=(uint8_t)(v>>40); p[6]=(uint8_t)(v>>48); p[7]=(uint8_t)(v>>56);
-}
-
-static inline uint32_t load32_le(const uint8_t *p) {
-    return (uint32_t)p[0] | ((uint32_t)p[1]<<8) | ((uint32_t)p[2]<<16) | ((uint32_t)p[3]<<24);
-}
-
-// ---------------------------------------------------------------------------
-// Mining entry point
-// ---------------------------------------------------------------------------
-
-__attribute__((export_name("mine")))
-int mine(int count) {
-    uint8_t *mem   = (uint8_t *)DATA_OFFSET;
-    uint8_t *addr  = mem;       // 20 bytes
-    uint8_t *salt  = mem + 20;  // 32 bytes
-    uint8_t *hout  = mem + 52;  // 32 bytes
-
-    // Pre-build base state for 52-byte keccak256 (one block, rate=136).
-    // Block = [address(20) | salt(32) | 0x01 | zeros | 0x80]
-    // Only lanes 0..6 are non-zero from the message, plus padding in lanes 6 & 16.
-    uint64_t base[25];
-    for (int i = 0; i < 25; i++) base[i] = 0;
-
-    // Load address into lanes 0..2 (bytes 0..23, only 0..19 used)
-    uint8_t buf[24];
-    for (int i = 0; i < 20; i++) buf[i] = addr[i];
-    for (int i = 20; i < 24; i++) buf[i] = 0;
-    base[0] = load64_le(buf);
-    base[1] = load64_le(buf + 8);
-    base[2] = load64_le(buf + 16);
-
-    // Keccak padding: byte 52 = 0x01, byte 135 = 0x80
-    // Lane 6 (bytes 48..55): byte 52 = lane offset 4 → bit 32
-    base[6] = (uint64_t)0x01 << 32;
-    // Lane 16 (bytes 128..135): byte 135 = lane offset 7 → bit 56
-    base[16] = (uint64_t)0x80 << 56;
-
-    for (int iter = 0; iter < count; iter++) {
-        // Copy base, XOR salt.
-        // Salt occupies bytes 20..51 → lanes 2..6.
-        uint64_t A[25];
-        for (int i = 0; i < 25; i++) A[i] = base[i];
-
-        // Lane 2 (bytes 16..23): upper 4 bytes = salt[0..3]
-        A[2] ^= (uint64_t)load32_le(salt) << 32;
-        // Lane 3 (bytes 24..31): salt[4..11]
-        A[3] ^= load64_le(salt + 4);
-        // Lane 4 (bytes 32..39): salt[12..19]
-        A[4] ^= load64_le(salt + 12);
-        // Lane 5 (bytes 40..47): salt[20..27]
-        A[5] ^= load64_le(salt + 20);
-        // Lane 6 (bytes 48..55): lower 4 bytes = salt[28..31]
-        A[6] ^= (uint64_t)load32_le(salt + 28);
-
-        keccak_f1600(A);
-
-        // PoW check: first 4 bytes = low 32 bits of lane 0 must be zero.
-        if ((uint32_t)A[0] == 0) {
-            for (int i = 0; i < 4; i++)
-                store64_le(hout + i * 8, A[i]);
-            return 1;
-        }
-
-        // Increment big-endian salt.
-        for (int i = 31; i >= 0; i--) {
-            if (salt[i] < 0xFF) { salt[i]++; break; }
-            salt[i] = 0;
-        }
-    }
-
-    return 0;
-}