[Kshot3000]

Problem

blake2b() in @fleet-sdk/crypto converted the key, salt, and personalization fields of the caller's options object in place:

if (options?.key) options.key = ensureBytes(options.key);
if (options?.salt) options.salt = ensureBytes(options.salt);
if (options?.personalization) options.personalization = ensureBytes(options.personalization);

Consequences for callers:

• An options object passed with hex-string fields comes back with those fields silently replaced by Uint8Arrays — surprising if the caller reuses, logs, or serializes it.
• A frozen options object (Object.freeze({...})) throws TypeError: Cannot assign to read only property 'key', because ES modules run in strict mode.

The in-place writes were also pure redundancy: the very next block converts the same fields again with ensureBytes() when building the options object for @noble/hashes.

Fix

Remove the in-place assignments. The conversion now happens only in the fresh options object built for the underlying hash call, so the caller's object is left exactly as passed. Hash outputs are byte-identical — all existing test vectors pass unchanged.

Tests

Two new cases in hashes.spec.ts, both failing on pristine master:

• Should not mutate the caller's options object — hex-string key/salt/personalization fields keep their values and types after the call, and the digest matches hashing with pre-decoded byte options.
• Should accept a frozen options object — previously threw TypeError; now returns the same digest as the byte-options form.

Results: crypto spec 7/7; full monorepo suite 1134/1134 (66 files); biome clean on the changed files. Changeset included (@fleet-sdk/crypto: patch).

---

Independent community contribution — @Kshot9000 (https://x.com/kshot9000). If this work is useful, tips are welcome: ERG 9fcM5RWnAjmP4vx5bnW6yohB6H9bLq8sJbaPLHtwZLtQPB32Pvy

[changeset-bot]

🦋 Changeset detected

Latest commit: f6e4252

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@fleet-sdk/crypto	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR