rubyduino 0.1.3 → 0.2.1

data/vendor/spinel/lib/sp_core.h

@@ -0,0 +1,37 @@
+/* sp_core.h -- runtime helpers split out of sp_runtime.h into
+ * libspinel_rt.a so they are compiled once rather than re-parsed and
+ * re-codegen'd in every generated translation unit.
+ *
+ * Signatures use intptr_t / double directly (== mrb_int / mrb_float)
+ * to stay decoupled from the runtime's typedefs and the mrb_bool
+ * conflict between sp_runtime.h and mruby_shim.h -- same convention as
+ * sp_time.h. These helpers call sp_raise_cls / sp_sprintf, which live
+ * in the generated TU (sp_runtime.h) and resolve at link time.
+ */
+#ifndef SP_CORE_H
+#define SP_CORE_H
+
+#include <stdint.h>
+
+/* String -> number parsers (cold, I/O-boundary). */
+intptr_t sp_str_to_i_cruby(const char *s);
+intptr_t sp_str_to_i_base(const char *s, intptr_t base);
+intptr_t sp_str_to_i_strict(const char *s);
+intptr_t sp_str_to_i_strict_base(const char *s, intptr_t base);
+double  sp_str_to_f_strict(const char *s);
+
+/* Cold integer-math + String#oct helpers. */
+intptr_t sp_gcd(intptr_t a, intptr_t b);
+intptr_t sp_lcm(intptr_t a, intptr_t b);
+intptr_t sp_powmod(intptr_t base, intptr_t exp, intptr_t mod);
+intptr_t sp_ceildiv(intptr_t a, intptr_t b);
+intptr_t sp_int_clamp(intptr_t v, intptr_t lo, intptr_t hi);
+intptr_t sp_int_sqrt(intptr_t n);
+intptr_t sp_ipow10(intptr_t p);
+intptr_t sp_int_round(intptr_t v, intptr_t nd);
+intptr_t sp_int_ceil(intptr_t v, intptr_t nd);
+intptr_t sp_int_floor(intptr_t v, intptr_t nd);
+intptr_t sp_int_truncate(intptr_t v, intptr_t nd);
+intptr_t sp_str_oct(const char *s);
+
+#endif

data/vendor/spinel/lib/sp_crypto.c

@@ -0,0 +1,583 @@
+/* sp_crypto.c -- SHA-256 / HMAC-SHA256 / PBKDF2 / Base64URL / CSPRNG.
+ *
+ * See sp_crypto.h for the public surface. Pure C, no spinel-runtime
+ * dependency -- archived into libspinel_rt.a alongside sp_bigint.o
+ * so spinel programs can ffi_func against it (or, longer term, have
+ * codegen pick up `Digest::SHA256.hexdigest`-shaped Ruby calls and
+ * lower them to these primitives directly).
+ *
+ * Implementations
+ * ---------------
+ * - SHA-256: compact public-domain implementation; the canonical
+ *   FIPS-180-4 reference (Wikipedia pseudocode + Go's crypto/sha256
+ *   match this byte-for-byte on the standard test vectors).
+ * - HMAC-SHA256: RFC 2104 / RFC 4231 on top of the SHA-256 above.
+ * - PBKDF2-HMAC-SHA256: RFC 8018, dkLen fixed at 32 (one block).
+ * - Base64URL: RFC 4648 §5 (URL/filename-safe alphabet), no padding.
+ * - CSPRNG: arc4random_buf on BSD/macOS, /dev/urandom on Linux.
+ *
+ * State buffers
+ * -------------
+ * Each public function owns a per-function static return buffer.
+ * The next call to the SAME function clobbers it. Distinct functions
+ * use distinct buffers, so chained calls (b64url_encode then hex)
+ * don't trample each other.
+ */
+#include "sp_crypto.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdint.h>
+#include <time.h>
+#if defined(__APPLE__) || defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__NetBSD__)
+#  include <stdlib.h>  /* arc4random_buf */
+#endif
+#if defined(_WIN32) || defined(_WIN64)
+#  include <windows.h>  /* LoadLibraryA / GetProcAddress for BCryptGenRandom */
+#endif
+
+/* ---------- SHA-256 ----------
+ * FIPS-180-4. Compact reference implementation -- public domain.
+ */
+
+static const uint32_t sp_crypto_sha256_k[64] = {
+  0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5,0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5,
+  0xd807aa98,0x12835b01,0x243185be,0x550c7dc3,0x72be5d74,0x80deb1fe,0x9bdc06a7,0xc19bf174,
+  0xe49b69c1,0xefbe4786,0x0fc19dc6,0x240ca1cc,0x2de92c6f,0x4a7484aa,0x5cb0a9dc,0x76f988da,
+  0x983e5152,0xa831c66d,0xb00327c8,0xbf597fc7,0xc6e00bf3,0xd5a79147,0x06ca6351,0x14292967,
+  0x27b70a85,0x2e1b2138,0x4d2c6dfc,0x53380d13,0x650a7354,0x766a0abb,0x81c2c92e,0x92722c85,
+  0xa2bfe8a1,0xa81a664b,0xc24b8b70,0xc76c51a3,0xd192e819,0xd6990624,0xf40e3585,0x106aa070,
+  0x19a4c116,0x1e376c08,0x2748774c,0x34b0bcb5,0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3,
+  0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208,0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2
+};
+
+#define SPC_ROTR(x,n)    (((x) >> (n)) | ((x) << (32 - (n))))
+#define SPC_S0(x)  (SPC_ROTR(x, 2) ^ SPC_ROTR(x,13) ^ SPC_ROTR(x,22))
+#define SPC_S1(x)  (SPC_ROTR(x, 6) ^ SPC_ROTR(x,11) ^ SPC_ROTR(x,25))
+#define SPC_s0(x)  (SPC_ROTR(x, 7) ^ SPC_ROTR(x,18) ^ ((x) >> 3))
+#define SPC_s1(x)  (SPC_ROTR(x,17) ^ SPC_ROTR(x,19) ^ ((x) >> 10))
+#define SPC_CH(x,y,z)  (((x) & (y)) ^ (~(x) & (z)))
+#define SPC_MAJ(x,y,z) (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))
+
+static void sp_crypto_sha256_block(uint32_t H[8], const uint8_t b[64]) {
+    uint32_t w[64], sa, sb, sc, sd, se, sf, sg, sh, t1, t2;
+    int i;
+    for (i = 0; i < 16; i++) {
+        w[i] = ((uint32_t)b[i*4] << 24) | ((uint32_t)b[i*4+1] << 16) |
+               ((uint32_t)b[i*4+2] << 8) |  (uint32_t)b[i*4+3];
+    }
+    for (i = 16; i < 64; i++) {
+        w[i] = SPC_s1(w[i-2]) + w[i-7] + SPC_s0(w[i-15]) + w[i-16];
+    }
+    sa=H[0]; sb=H[1]; sc=H[2]; sd=H[3]; se=H[4]; sf=H[5]; sg=H[6]; sh=H[7];
+    for (i = 0; i < 64; i++) {
+        t1 = sh + SPC_S1(se) + SPC_CH(se,sf,sg) + sp_crypto_sha256_k[i] + w[i];
+        t2 = SPC_S0(sa) + SPC_MAJ(sa,sb,sc);
+        sh = sg; sg = sf; sf = se; se = sd + t1;
+        sd = sc; sc = sb; sb = sa; sa = t1 + t2;
+    }
+    H[0]+=sa; H[1]+=sb; H[2]+=sc; H[3]+=sd;
+    H[4]+=se; H[5]+=sf; H[6]+=sg; H[7]+=sh;
+}
+
+static void sp_crypto_sha256(const uint8_t *msg, size_t len, uint8_t out[32]) {
+    uint32_t H[8] = {
+        0x6a09e667,0xbb67ae85,0x3c6ef372,0xa54ff53a,
+        0x510e527f,0x9b05688c,0x1f83d9ab,0x5be0cd19
+    };
+    uint8_t buf[64];
+    size_t i, full = len & ~((size_t)63);
+    for (i = 0; i < full; i += 64) sp_crypto_sha256_block(H, msg + i);
+    size_t rem = len - full;
+    for (i = 0; i < rem; i++) buf[i] = msg[full + i];
+    buf[rem] = 0x80;
+    if (rem >= 56) {
+        for (i = rem + 1; i < 64; i++) buf[i] = 0;
+        sp_crypto_sha256_block(H, buf);
+        for (i = 0; i < 56; i++) buf[i] = 0;
+    } else {
+        for (i = rem + 1; i < 56; i++) buf[i] = 0;
+    }
+    uint64_t bits = (uint64_t)len * 8;
+    for (i = 0; i < 8; i++) buf[56 + i] = (uint8_t)(bits >> (56 - 8*i));
+    sp_crypto_sha256_block(H, buf);
+    for (i = 0; i < 8; i++) {
+        out[i*4]   = (uint8_t)(H[i] >> 24);
+        out[i*4+1] = (uint8_t)(H[i] >> 16);
+        out[i*4+2] = (uint8_t)(H[i] >> 8);
+        out[i*4+3] = (uint8_t)(H[i]);
+    }
+}
+
+/* ---------- SHA-1 ----------
+ * FIPS-180-4 (legacy hash, kept for WebSocket handshake -- RFC 6455
+ * requires SHA-1 specifically for Sec-WebSocket-Accept). Do not use
+ * for new security designs; SHA-256 is the right primitive for those.
+ * Compact reference implementation -- public domain.
+ */
+
+static void sp_crypto_sha1_block(uint32_t H[5], const uint8_t b[64]) {
+    uint32_t w[80], a, sa, sb, sc, sd, se, f, k;
+    int i;
+    for (i = 0; i < 16; i++) {
+        w[i] = ((uint32_t)b[i*4] << 24) | ((uint32_t)b[i*4+1] << 16) |
+               ((uint32_t)b[i*4+2] << 8) |  (uint32_t)b[i*4+3];
+    }
+    for (i = 16; i < 80; i++) {
+        a = w[i-3] ^ w[i-8] ^ w[i-14] ^ w[i-16];
+        w[i] = (a << 1) | (a >> 31);
+    }
+    sa = H[0]; sb = H[1]; sc = H[2]; sd = H[3]; se = H[4];
+    for (i = 0; i < 80; i++) {
+        if (i < 20)      { f = (sb & sc) | (~sb & sd);         k = 0x5A827999; }
+        else if (i < 40) { f = sb ^ sc ^ sd;                   k = 0x6ED9EBA1; }
+        else if (i < 60) { f = (sb & sc) | (sb & sd) | (sc & sd); k = 0x8F1BBCDC; }
+        else             { f = sb ^ sc ^ sd;                   k = 0xCA62C1D6; }
+        uint32_t t = ((sa << 5) | (sa >> 27)) + f + se + k + w[i];
+        se = sd; sd = sc; sc = (sb << 30) | (sb >> 2); sb = sa; sa = t;
+    }
+    H[0] += sa; H[1] += sb; H[2] += sc; H[3] += sd; H[4] += se;
+}
+
+static void sp_crypto_sha1(const uint8_t *msg, size_t len, uint8_t out[20]) {
+    uint32_t H[5] = {
+        0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476, 0xC3D2E1F0
+    };
+    uint8_t buf[64];
+    size_t i, full = len & ~((size_t)63);
+    for (i = 0; i < full; i += 64) sp_crypto_sha1_block(H, msg + i);
+    size_t rem = len - full;
+    for (i = 0; i < rem; i++) buf[i] = msg[full + i];
+    buf[rem] = 0x80;
+    if (rem >= 56) {
+        for (i = rem + 1; i < 64; i++) buf[i] = 0;
+        sp_crypto_sha1_block(H, buf);
+        for (i = 0; i < 56; i++) buf[i] = 0;
+    } else {
+        for (i = rem + 1; i < 56; i++) buf[i] = 0;
+    }
+    uint64_t bits = (uint64_t)len * 8;
+    for (i = 0; i < 8; i++) buf[56 + i] = (uint8_t)(bits >> (56 - 8*i));
+    sp_crypto_sha1_block(H, buf);
+    for (i = 0; i < 5; i++) {
+        out[i*4]   = (uint8_t)(H[i] >> 24);
+        out[i*4+1] = (uint8_t)(H[i] >> 16);
+        out[i*4+2] = (uint8_t)(H[i] >> 8);
+        out[i*4+3] = (uint8_t)(H[i]);
+    }
+}
+
+static char sp_crypto_sha1_hex_buf[41];
+
+const char *sp_crypto_sha1_hex(const char *msg) {
+    uint8_t out[20];
+    sp_crypto_sha1((const uint8_t *)msg, strlen(msg), out);
+    static const char H[] = "0123456789abcdef";
+    int i;
+    for (i = 0; i < 20; i++) {
+        sp_crypto_sha1_hex_buf[i*2]   = H[(out[i] >> 4) & 0xf];
+        sp_crypto_sha1_hex_buf[i*2+1] = H[out[i] & 0xf];
+    }
+    sp_crypto_sha1_hex_buf[40] = '\0';
+    return sp_crypto_sha1_hex_buf;
+}
+
+/* RFC 6455 §1.3 Sec-WebSocket-Accept:
+ *     base64(SHA-1(client_key + "258EAFA5-E914-47DA-95CA-C5AB0DC85B11"))
+ * Standard Base64 (RFC 4648 §4, `+/` alphabet, `=` padding) -- NOT
+ * the URL-safe variant. 20 bytes of SHA-1 -> 28-char output ("xxx=").
+ * The GUID is the WebSocket protocol's fixed magic string.
+ */
+static const char SPC_B64[64] =
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+static char sp_crypto_websocket_accept_buf[29];
+
+const char *sp_crypto_websocket_accept(const char *client_key) {
+    /* client_key is the 24-char base64 from the request header;
+     * GUID is 36 chars. Total <= 60; cap input at 128 for safety. */
+    char in[128 + 36 + 1];
+    size_t klen = strlen(client_key);
+    if (klen > 128) klen = 128;
+    size_t i;
+    for (i = 0; i < klen; i++) in[i] = client_key[i];
+    static const char guid[] = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
+    for (i = 0; i < 36; i++) in[klen + i] = guid[i];
+    uint8_t digest[20];
+    sp_crypto_sha1((const uint8_t *)in, klen + 36, digest);
+    /* base64(20 bytes) = 28 chars: 6 full triplets + 2 leftover bytes
+     * -> 3 chars + 1 padding `=`. */
+    int j = 0;
+    for (i = 0; i + 3 <= 20; i += 3) {
+        uint32_t v = ((uint32_t)digest[i] << 16)
+                   | ((uint32_t)digest[i+1] << 8)
+                   |  (uint32_t)digest[i+2];
+        sp_crypto_websocket_accept_buf[j++] = SPC_B64[(v >> 18) & 0x3f];
+        sp_crypto_websocket_accept_buf[j++] = SPC_B64[(v >> 12) & 0x3f];
+        sp_crypto_websocket_accept_buf[j++] = SPC_B64[(v >>  6) & 0x3f];
+        sp_crypto_websocket_accept_buf[j++] = SPC_B64[ v        & 0x3f];
+    }
+    /* 2 leftover bytes -> 3 b64 chars + 1 pad */
+    uint32_t v = ((uint32_t)digest[18] << 16) | ((uint32_t)digest[19] << 8);
+    sp_crypto_websocket_accept_buf[j++] = SPC_B64[(v >> 18) & 0x3f];
+    sp_crypto_websocket_accept_buf[j++] = SPC_B64[(v >> 12) & 0x3f];
+    sp_crypto_websocket_accept_buf[j++] = SPC_B64[(v >>  6) & 0x3f];
+    sp_crypto_websocket_accept_buf[j++] = '=';
+    sp_crypto_websocket_accept_buf[j]   = '\0';
+    return sp_crypto_websocket_accept_buf;
+}
+
+/* ---------- HMAC-SHA256 (RFC 2104) ---------- */
+
+static void sp_crypto_hmac_sha256(const uint8_t *key, size_t klen,
+                                  const uint8_t *msg, size_t mlen,
+                                  uint8_t out[32]) {
+    uint8_t kpad[64], ipad[64], opad[64], inner[32];
+    size_t i;
+    if (klen > 64) {
+        sp_crypto_sha256(key, klen, kpad);
+        for (i = 32; i < 64; i++) kpad[i] = 0;
+    } else {
+        for (i = 0; i < klen; i++) kpad[i] = key[i];
+        for (i = klen; i < 64; i++) kpad[i] = 0;
+    }
+    for (i = 0; i < 64; i++) {
+        ipad[i] = kpad[i] ^ 0x36;
+        opad[i] = kpad[i] ^ 0x5c;
+    }
+    /* inner = SHA256(ipad || msg). Stream both segments through the
+     * compression to avoid allocating ipad||msg. */
+    {
+        uint32_t H[8] = {
+            0x6a09e667,0xbb67ae85,0x3c6ef372,0xa54ff53a,
+            0x510e527f,0x9b05688c,0x1f83d9ab,0x5be0cd19
+        };
+        sp_crypto_sha256_block(H, ipad);
+        uint8_t buf[64];
+        size_t full = mlen & ~((size_t)63);
+        for (i = 0; i < full; i += 64) sp_crypto_sha256_block(H, msg + i);
+        size_t rem = mlen - full;
+        for (i = 0; i < rem; i++) buf[i] = msg[full + i];
+        buf[rem] = 0x80;
+        if (rem >= 56) {
+            for (i = rem + 1; i < 64; i++) buf[i] = 0;
+            sp_crypto_sha256_block(H, buf);
+            for (i = 0; i < 56; i++) buf[i] = 0;
+        } else {
+            for (i = rem + 1; i < 56; i++) buf[i] = 0;
+        }
+        uint64_t bits = (uint64_t)(64 + mlen) * 8;
+        for (i = 0; i < 8; i++) buf[56 + i] = (uint8_t)(bits >> (56 - 8*i));
+        sp_crypto_sha256_block(H, buf);
+        for (i = 0; i < 8; i++) {
+            inner[i*4]   = (uint8_t)(H[i] >> 24);
+            inner[i*4+1] = (uint8_t)(H[i] >> 16);
+            inner[i*4+2] = (uint8_t)(H[i] >> 8);
+            inner[i*4+3] = (uint8_t)(H[i]);
+        }
+    }
+    /* outer = SHA256(opad || inner) */
+    {
+        uint32_t H[8] = {
+            0x6a09e667,0xbb67ae85,0x3c6ef372,0xa54ff53a,
+            0x510e527f,0x9b05688c,0x1f83d9ab,0x5be0cd19
+        };
+        sp_crypto_sha256_block(H, opad);
+        uint8_t buf[64];
+        for (i = 0; i < 32; i++) buf[i] = inner[i];
+        buf[32] = 0x80;
+        for (i = 33; i < 56; i++) buf[i] = 0;
+        uint64_t bits = (uint64_t)(64 + 32) * 8;
+        for (i = 0; i < 8; i++) buf[56 + i] = (uint8_t)(bits >> (56 - 8*i));
+        sp_crypto_sha256_block(H, buf);
+        for (i = 0; i < 8; i++) {
+            out[i*4]   = (uint8_t)(H[i] >> 24);
+            out[i*4+1] = (uint8_t)(H[i] >> 16);
+            out[i*4+2] = (uint8_t)(H[i] >> 8);
+            out[i*4+3] = (uint8_t)(H[i]);
+        }
+    }
+}
+
+static char sp_crypto_hmac_hex_buf[65];
+
+const char *sp_crypto_hmac_sha256_hex(const char *key, const char *msg) {
+    uint8_t out[32];
+    sp_crypto_hmac_sha256((const uint8_t *)key, strlen(key),
+                          (const uint8_t *)msg, strlen(msg),
+                          out);
+    static const char H[] = "0123456789abcdef";
+    int i;
+    for (i = 0; i < 32; i++) {
+        sp_crypto_hmac_hex_buf[i*2]   = H[(out[i] >> 4) & 0xf];
+        sp_crypto_hmac_hex_buf[i*2+1] = H[out[i] & 0xf];
+    }
+    sp_crypto_hmac_hex_buf[64] = '\0';
+    return sp_crypto_hmac_hex_buf;
+}
+
+/* ---------- Base64URL (RFC 4648 §5) ---------- */
+
+static const char SPC_B64U[64] =
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+
+static char sp_crypto_hmac_b64url_buf[44];
+
+const char *sp_crypto_hmac_sha256_b64url(const char *key, const char *msg) {
+    uint8_t out[32];
+    sp_crypto_hmac_sha256((const uint8_t *)key, strlen(key),
+                          (const uint8_t *)msg, strlen(msg),
+                          out);
+    int i, j = 0;
+    for (i = 0; i + 3 <= 32; i += 3) {
+        uint32_t v = ((uint32_t)out[i] << 16)
+                   | ((uint32_t)out[i+1] << 8)
+                   | (uint32_t)out[i+2];
+        sp_crypto_hmac_b64url_buf[j++] = SPC_B64U[(v >> 18) & 0x3f];
+        sp_crypto_hmac_b64url_buf[j++] = SPC_B64U[(v >> 12) & 0x3f];
+        sp_crypto_hmac_b64url_buf[j++] = SPC_B64U[(v >> 6)  & 0x3f];
+        sp_crypto_hmac_b64url_buf[j++] = SPC_B64U[v & 0x3f];
+    }
+    if (i < 32) {
+        uint32_t v = ((uint32_t)out[i] << 16)
+                   | (i + 1 < 32 ? ((uint32_t)out[i+1] << 8) : 0);
+        sp_crypto_hmac_b64url_buf[j++] = SPC_B64U[(v >> 18) & 0x3f];
+        sp_crypto_hmac_b64url_buf[j++] = SPC_B64U[(v >> 12) & 0x3f];
+        if (i + 1 < 32) {
+            sp_crypto_hmac_b64url_buf[j++] = SPC_B64U[(v >> 6) & 0x3f];
+        }
+    }
+    sp_crypto_hmac_b64url_buf[j] = '\0';
+    return sp_crypto_hmac_b64url_buf;
+}
+
+#define SPC_B64U_BUFSIZE (16 * 1024)
+static char sp_crypto_b64url_buf[SPC_B64U_BUFSIZE];
+
+const char *sp_crypto_b64url_encode(const char *src) {
+    size_t n = strlen(src);
+    size_t i = 0, j = 0;
+    if (4 * ((n + 2) / 3) + 1 > SPC_B64U_BUFSIZE) {
+        sp_crypto_b64url_buf[0] = '\0';
+        return sp_crypto_b64url_buf;
+    }
+    while (i + 3 <= n) {
+        uint32_t v = ((uint32_t)(uint8_t)src[i]   << 16)
+                   | ((uint32_t)(uint8_t)src[i+1] << 8)
+                   |  (uint32_t)(uint8_t)src[i+2];
+        sp_crypto_b64url_buf[j++] = SPC_B64U[(v >> 18) & 0x3f];
+        sp_crypto_b64url_buf[j++] = SPC_B64U[(v >> 12) & 0x3f];
+        sp_crypto_b64url_buf[j++] = SPC_B64U[(v >>  6) & 0x3f];
+        sp_crypto_b64url_buf[j++] = SPC_B64U[ v        & 0x3f];
+        i += 3;
+    }
+    size_t rem = n - i;
+    if (rem == 1) {
+        uint32_t v = (uint32_t)(uint8_t)src[i] << 16;
+        sp_crypto_b64url_buf[j++] = SPC_B64U[(v >> 18) & 0x3f];
+        sp_crypto_b64url_buf[j++] = SPC_B64U[(v >> 12) & 0x3f];
+    } else if (rem == 2) {
+        uint32_t v = ((uint32_t)(uint8_t)src[i]   << 16)
+                   | ((uint32_t)(uint8_t)src[i+1] << 8);
+        sp_crypto_b64url_buf[j++] = SPC_B64U[(v >> 18) & 0x3f];
+        sp_crypto_b64url_buf[j++] = SPC_B64U[(v >> 12) & 0x3f];
+        sp_crypto_b64url_buf[j++] = SPC_B64U[(v >>  6) & 0x3f];
+    }
+    sp_crypto_b64url_buf[j] = '\0';
+    return sp_crypto_b64url_buf;
+}
+
+static char sp_crypto_b64u_dec_buf[SPC_B64U_BUFSIZE];
+
+static int sp_crypto_b64u_val(char c) {
+    if (c >= 'A' && c <= 'Z') return c - 'A';
+    if (c >= 'a' && c <= 'z') return c - 'a' + 26;
+    if (c >= '0' && c <= '9') return c - '0' + 52;
+    if (c == '-') return 62;
+    if (c == '_') return 63;
+    return -1;
+}
+
+const char *sp_crypto_b64url_decode(const char *src) {
+    size_t n = strlen(src);
+    while (n > 0 && src[n - 1] == '=') n--;  /* tolerate padded input */
+    size_t i = 0, j = 0;
+    if (n / 4 * 3 + 3 > SPC_B64U_BUFSIZE) {
+        sp_crypto_b64u_dec_buf[0] = '\0';
+        return sp_crypto_b64u_dec_buf;
+    }
+    while (i + 4 <= n) {
+        int a = sp_crypto_b64u_val(src[i]);
+        int b = sp_crypto_b64u_val(src[i+1]);
+        int c = sp_crypto_b64u_val(src[i+2]);
+        int d = sp_crypto_b64u_val(src[i+3]);
+        if (a < 0 || b < 0 || c < 0 || d < 0) {
+            sp_crypto_b64u_dec_buf[0] = '\0';
+            return sp_crypto_b64u_dec_buf;
+        }
+        uint32_t v = (uint32_t)a << 18 | (uint32_t)b << 12
+                   | (uint32_t)c <<  6 | (uint32_t)d;
+        sp_crypto_b64u_dec_buf[j++] = (v >> 16) & 0xff;
+        sp_crypto_b64u_dec_buf[j++] = (v >>  8) & 0xff;
+        sp_crypto_b64u_dec_buf[j++] =  v        & 0xff;
+        i += 4;
+    }
+    size_t rem = n - i;
+    if (rem == 2) {
+        int a = sp_crypto_b64u_val(src[i]);
+        int b = sp_crypto_b64u_val(src[i+1]);
+        if (a < 0 || b < 0) { sp_crypto_b64u_dec_buf[0] = '\0'; return sp_crypto_b64u_dec_buf; }
+        sp_crypto_b64u_dec_buf[j++] = (a << 2) | (b >> 4);
+    } else if (rem == 3) {
+        int a = sp_crypto_b64u_val(src[i]);
+        int b = sp_crypto_b64u_val(src[i+1]);
+        int c = sp_crypto_b64u_val(src[i+2]);
+        if (a < 0 || b < 0 || c < 0) { sp_crypto_b64u_dec_buf[0] = '\0'; return sp_crypto_b64u_dec_buf; }
+        sp_crypto_b64u_dec_buf[j++] = (a << 2) | (b >> 4);
+        sp_crypto_b64u_dec_buf[j++] = ((b & 0xf) << 4) | (c >> 2);
+    }
+    sp_crypto_b64u_dec_buf[j] = '\0';
+    return sp_crypto_b64u_dec_buf;
+}
+
+/* ---------- PBKDF2-HMAC-SHA256 (RFC 8018) ----------
+ * dkLen fixed at 32 bytes (one HMAC-SHA256 output block).
+ */
+
+static char sp_crypto_pbkdf2_b64url_buf[44];
+
+const char *sp_crypto_pbkdf2_sha256_b64url(const char *password, const char *salt, int iters) {
+    if (iters < 1) iters = 1;
+    size_t plen = strlen(password);
+    size_t slen = strlen(salt);
+    uint8_t salted[256];
+    if (slen + 4 > sizeof(salted)) {
+        sp_crypto_pbkdf2_b64url_buf[0] = '\0';
+        return sp_crypto_pbkdf2_b64url_buf;
+    }
+    memcpy(salted, salt, slen);
+    salted[slen+0] = 0;
+    salted[slen+1] = 0;
+    salted[slen+2] = 0;
+    salted[slen+3] = 1;  /* INT(1) -- single dkLen=32 block */
+    uint8_t U[32], T[32];
+    sp_crypto_hmac_sha256((const uint8_t *)password, plen, salted, slen + 4, U);
+    memcpy(T, U, 32);
+    int it;
+    for (it = 1; it < iters; it++) {
+        sp_crypto_hmac_sha256((const uint8_t *)password, plen, U, 32, U);
+        int b;
+        for (b = 0; b < 32; b++) T[b] ^= U[b];
+    }
+    int i, j = 0;
+    for (i = 0; i + 3 <= 32; i += 3) {
+        uint32_t v = ((uint32_t)T[i] << 16)
+                   | ((uint32_t)T[i+1] << 8)
+                   | (uint32_t)T[i+2];
+        sp_crypto_pbkdf2_b64url_buf[j++] = SPC_B64U[(v >> 18) & 0x3f];
+        sp_crypto_pbkdf2_b64url_buf[j++] = SPC_B64U[(v >> 12) & 0x3f];
+        sp_crypto_pbkdf2_b64url_buf[j++] = SPC_B64U[(v >> 6)  & 0x3f];
+        sp_crypto_pbkdf2_b64url_buf[j++] = SPC_B64U[v & 0x3f];
+    }
+    if (i < 32) {
+        uint32_t v = ((uint32_t)T[i] << 16)
+                   | (i + 1 < 32 ? ((uint32_t)T[i+1] << 8) : 0);
+        sp_crypto_pbkdf2_b64url_buf[j++] = SPC_B64U[(v >> 18) & 0x3f];
+        sp_crypto_pbkdf2_b64url_buf[j++] = SPC_B64U[(v >> 12) & 0x3f];
+        if (i + 1 < 32) {
+            sp_crypto_pbkdf2_b64url_buf[j++] = SPC_B64U[(v >> 6) & 0x3f];
+        }
+    }
+    sp_crypto_pbkdf2_b64url_buf[j] = '\0';
+    return sp_crypto_pbkdf2_b64url_buf;
+}
+
+/* ---------- CSPRNG ---------- */
+
+static char sp_crypto_random_b64url_buf[90];
+
+const char *sp_crypto_random_b64url(int nbytes) {
+    if (nbytes < 1) nbytes = 16;
+    if (nbytes > 64) nbytes = 64;
+    uint8_t r[64];
+#if defined(__APPLE__) || defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__NetBSD__)
+    arc4random_buf(r, nbytes);
+#elif defined(_WIN32) || defined(_WIN64)
+    /* Windows: BCryptGenRandom via runtime LoadLibrary so no
+     * link-time -lbcrypt is needed. Cached function pointer.
+     * Fall through to the time-mixed path if loading fails
+     * (rare; only on pre-Vista where bcrypt.dll isn't present). */
+    {
+        typedef long (__stdcall *sp_BCryptGenRandom_fn)(void *, unsigned char *, unsigned long, unsigned long);
+        static sp_BCryptGenRandom_fn sp_bcrypt_gen_random = NULL;
+        static int sp_bcrypt_resolved = 0;
+        if (!sp_bcrypt_resolved) {
+            sp_bcrypt_resolved = 1;
+            void *h = (void *)LoadLibraryA("bcrypt.dll");
+            if (h) sp_bcrypt_gen_random = (sp_BCryptGenRandom_fn)GetProcAddress((HMODULE)h, "BCryptGenRandom");
+        }
+        int ok = 0;
+        if (sp_bcrypt_gen_random) {
+            if (sp_bcrypt_gen_random(NULL, r, (unsigned long)nbytes, 0x00000002UL /* BCRYPT_USE_SYSTEM_PREFERRED_RNG */) == 0) {
+                ok = 1;
+            }
+        }
+        if (!ok) {
+            /* Counter-mixed time fallback so the test's "two calls
+             * must differ" invariant holds even when BCrypt is
+             * unavailable. NOT cryptographically secure. */
+            static uint64_t sp_crypto_fallback_ctr = 0;
+            sp_crypto_fallback_ctr++;
+            uint64_t mix = (uint64_t)time(NULL) ^ (sp_crypto_fallback_ctr * 0x9e3779b97f4a7c15ULL);
+            for (int k = 0; k < nbytes; k++) {
+                mix ^= mix << 13; mix ^= mix >> 7; mix ^= mix << 17;
+                r[k] = (uint8_t)mix;
+            }
+        }
+    }
+#else
+    FILE *f = fopen("/dev/urandom", "rb");
+    if (f) {
+        size_t got = fread(r, 1, nbytes, f);
+        (void)got;  /* short read is rare for urandom; fall through */
+        fclose(f);
+    } else {
+        /* Last-ditch: counter-mixed time -- NOT cryptographically
+         * secure. Modern systems never reach this path. The
+         * counter guarantees distinct outputs across calls within
+         * the same second. */
+        static uint64_t sp_crypto_fallback_ctr = 0;
+        sp_crypto_fallback_ctr++;
+        uint64_t mix = (uint64_t)time(NULL) ^ (sp_crypto_fallback_ctr * 0x9e3779b97f4a7c15ULL);
+        for (int k = 0; k < nbytes; k++) {
+            mix ^= mix << 13; mix ^= mix >> 7; mix ^= mix << 17;
+            r[k] = (uint8_t)mix;
+        }
+    }
+#endif
+    int i, j = 0;
+    for (i = 0; i + 3 <= nbytes; i += 3) {
+        uint32_t v = ((uint32_t)r[i] << 16)
+                   | ((uint32_t)r[i+1] << 8)
+                   | (uint32_t)r[i+2];
+        sp_crypto_random_b64url_buf[j++] = SPC_B64U[(v >> 18) & 0x3f];
+        sp_crypto_random_b64url_buf[j++] = SPC_B64U[(v >> 12) & 0x3f];
+        sp_crypto_random_b64url_buf[j++] = SPC_B64U[(v >> 6)  & 0x3f];
+        sp_crypto_random_b64url_buf[j++] = SPC_B64U[v & 0x3f];
+    }
+    int rem = nbytes - i;
+    if (rem == 1) {
+        uint32_t v = (uint32_t)r[i] << 16;
+        sp_crypto_random_b64url_buf[j++] = SPC_B64U[(v >> 18) & 0x3f];
+        sp_crypto_random_b64url_buf[j++] = SPC_B64U[(v >> 12) & 0x3f];
+    } else if (rem == 2) {
+        uint32_t v = ((uint32_t)r[i] << 16)
+                   | ((uint32_t)r[i+1] << 8);
+        sp_crypto_random_b64url_buf[j++] = SPC_B64U[(v >> 18) & 0x3f];
+        sp_crypto_random_b64url_buf[j++] = SPC_B64U[(v >> 12) & 0x3f];
+        sp_crypto_random_b64url_buf[j++] = SPC_B64U[(v >> 6) & 0x3f];
+    }
+    sp_crypto_random_b64url_buf[j] = '\0';
+    return sp_crypto_random_b64url_buf;
+}