@fgv/ts-extras-argon2 5.1.0-47 → 5.1.0-49

package/dist/test/unit/argon2/nodeArgon2Provider.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"nodeArgon2Provider.test.js","sourceRoot":"","sources":["../../../../src/test/unit/argon2/nodeArgon2Provider.test.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAClC,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,2DAA2D;AAC3D,EAAE;AACF,iFAAiF;AACjF,kDAAkD;AAClD,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,yEAAyE;AACzE,gFAAgF;AAChF,gFAAgF;AAChF,YAAY;AAEZ,OAAO,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAG9D,2FAA2F;AAC3F,4EAA4E;AAC5E,MAAM,UAAU,GAAgC;IAC9C,SAAS,EAAE,EAAE;IACb,UAAU,EAAE,CAAC;IACb,WAAW,EAAE,CAAC;IACd,WAAW,EAAE,EAAE;CAChB,CAAC;AACF,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnD,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAE/C,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,IAAI,QAA4B,CAAC;IAEjC,UAAU,CAAC,GAAG,EAAE;QACd,QAAQ,GAAG,kBAAkB,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;QACxB,IAAI,CAAC,6BAA6B,EAAE,GAAG,EAAE;YACvC,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC5D,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;QAC1B,IAAI,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACxD,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,KAAK,EAAE,EAAE;gBAChG,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;gBACzC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC9F,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;gBACzC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;YACxE,MAAM,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACnF,MAAM,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACnF,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACnG,MAAM,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACnG,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACvG,MAAM,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACvG,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,CACJ,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,kCAAO,UAAU,KAAE,WAAW,EAAE,EAAE,IAAG,CACpF,CAAC,mBAAmB,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC9B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;YAClF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,6BAA6B;YAC5E,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC/E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACvD,mDAAmD;QACnD,8DAA8D;QAC9D,yEAAyE;QACzE,4BAA4B;QAC5B,oFAAoF;QACpF,MAAM,UAAU,GAAgC;YAC9C,SAAS,EAAE,EAAE;YACb,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,EAAE;SAChB,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,gBAAgB,GAAG,kEAAkE,CAAC;QAE5F,IAAI,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;YAC/F,MAAM,CACJ,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE;gBAC1D,MAAM,EAAE,UAAU;gBAClB,cAAc,EAAE,MAAM;aACvB,CAAC,CACH,CAAC,mBAAmB,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACpE,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,aAAa,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAC9F,MAAM,UAAU,GAAG,CACjB,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CACpF,CAAC,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;YACnE,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1F,MAAM,MAAM,GAAG,CACb,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CACxF,CAAC,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;YAChG,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACzF,MAAM,YAAY,GAAG,CACnB,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE;gBAC1D,MAAM,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;gBACzB,cAAc,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;aAClC,CAAC,CACH,CAAC,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;QACpC,IAAI,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,kCAAO,UAAU,KAAE,SAAS,EAAE,CAAC,IAAG,CAAC,CAAC,UAAU,CACjG,yBAAyB,CAC1B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;YAC3C,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,kCAAO,UAAU,KAAE,UAAU,EAAE,CAAC,IAAG,CAAC,CAAC,UAAU,CAClG,0BAA0B,CAC3B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,kCAAO,UAAU,KAAE,WAAW,EAAE,CAAC,IAAG,CAAC,CAAC,UAAU,CACnG,+BAA+B,CAChC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC9C,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,kCAAO,UAAU,KAAE,WAAW,EAAE,GAAG,IAAG,CAAC,CAAC,UAAU,CACrG,+BAA+B,CAChC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,kCAAO,UAAU,KAAE,WAAW,EAAE,CAAC,IAAG,CAAC,CAAC,UAAU,CACnG,2BAA2B,CAC5B,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// Copyright (c) 2026 Erik Fortune\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal\n// in the Software without restriction, including without limitation the rights\n// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n// copies of the Software, and to permit persons to whom the Software is\n// furnished to do so, subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in all\n// copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n// SOFTWARE.\n\nimport '@fgv/ts-utils-jest';\nimport { NodeArgon2Provider } from '../../../packlets/argon2';\nimport { CryptoUtils } from '@fgv/ts-extras';\n\n// RFC 9106 §B.3 parameter set (no secret/AD — our interface does not expose those fields).\n// t=3, m=32, p=4, tag=32. Used for determinism and cross-runtime agreement.\nconst RFC_PARAMS: CryptoUtils.IArgon2idParams = {\n  memoryKiB: 32,\n  iterations: 3,\n  parallelism: 4,\n  outputBytes: 32\n};\nconst RFC_PASSWORD = new Uint8Array(32).fill(0x01);\nconst RFC_SALT = new Uint8Array(16).fill(0x02);\n\ndescribe('NodeArgon2Provider', () => {\n  let provider: NodeArgon2Provider;\n\n  beforeEach(() => {\n    provider = NodeArgon2Provider.create().orThrow();\n  });\n\n  describe('create()', () => {\n    test('returns a provider instance', () => {\n      expect(NodeArgon2Provider.create()).toSucceedAndSatisfy((p) => {\n        expect(p).toBeInstanceOf(NodeArgon2Provider);\n      });\n    });\n  });\n\n  describe('argon2id()', () => {\n    test('derives a key with Uint8Array password', async () => {\n      expect(await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS)).toSucceedAndSatisfy((bytes) => {\n        expect(bytes).toBeInstanceOf(Uint8Array);\n        expect(bytes.length).toBe(RFC_PARAMS.outputBytes);\n      });\n    });\n\n    test('derives a key with string password', async () => {\n      expect(await provider.argon2id('password', RFC_SALT, RFC_PARAMS)).toSucceedAndSatisfy((bytes) => {\n        expect(bytes).toBeInstanceOf(Uint8Array);\n        expect(bytes.length).toBe(RFC_PARAMS.outputBytes);\n      });\n    });\n\n    test('is deterministic — same inputs produce identical bytes', async () => {\n      const r1 = (await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS)).orThrow();\n      const r2 = (await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS)).orThrow();\n      expect(r1).toEqual(r2);\n    });\n\n    test('different passwords produce different bytes', async () => {\n      const a = (await provider.argon2id(new Uint8Array(32).fill(0x01), RFC_SALT, RFC_PARAMS)).orThrow();\n      const b = (await provider.argon2id(new Uint8Array(32).fill(0x02), RFC_SALT, RFC_PARAMS)).orThrow();\n      expect(a).not.toEqual(b);\n    });\n\n    test('different salts produce different bytes', async () => {\n      const a = (await provider.argon2id(RFC_PASSWORD, new Uint8Array(16).fill(0x02), RFC_PARAMS)).orThrow();\n      const b = (await provider.argon2id(RFC_PASSWORD, new Uint8Array(16).fill(0x03), RFC_PARAMS)).orThrow();\n      expect(a).not.toEqual(b);\n    });\n\n    test('respects outputBytes', async () => {\n      expect(\n        await provider.argon2id(RFC_PASSWORD, RFC_SALT, { ...RFC_PARAMS, outputBytes: 64 })\n      ).toSucceedAndSatisfy((bytes) => {\n        expect(bytes.length).toBe(64);\n      });\n    });\n\n    test('returns failure when underlying library rejects (salt too short)', async () => {\n      const tinySalt = new Uint8Array(1).fill(0x02); // argon2 requires >= 8 bytes\n      expect(await provider.argon2id(RFC_PASSWORD, tinySalt, RFC_PARAMS)).toFail();\n    });\n  });\n\n  describe('keyed hashing (secret / associatedData)', () => {\n    // RFC 9106 §5.3 Argon2id known-answer test vector:\n    //   password P = 32 bytes of 0x01, salt S = 16 bytes of 0x02,\n    //   secret   K =  8 bytes of 0x03, associated data X = 12 bytes of 0x04,\n    //   t=3, m=32, p=4, tag=32.\n    //   expected tag = 0d640df58d78766c08c037a34a8b53c9d01ef0452d75b65eb52520e96b01e659\n    const KAT_PARAMS: CryptoUtils.IArgon2idParams = {\n      memoryKiB: 32,\n      iterations: 3,\n      parallelism: 4,\n      outputBytes: 32\n    };\n    const KAT_PASSWORD = new Uint8Array(32).fill(0x01);\n    const KAT_SALT = new Uint8Array(16).fill(0x02);\n    const KAT_SECRET = new Uint8Array(8).fill(0x03);\n    const KAT_AD = new Uint8Array(12).fill(0x04);\n    const KAT_EXPECTED_HEX = '0d640df58d78766c08c037a34a8b53c9d01ef0452d75b65eb52520e96b01e659';\n\n    test('reproduces the RFC 9106 §5.3 known-answer vector with secret + associatedData', async () => {\n      expect(\n        await provider.argon2id(KAT_PASSWORD, KAT_SALT, KAT_PARAMS, {\n          secret: KAT_SECRET,\n          associatedData: KAT_AD\n        })\n      ).toSucceedAndSatisfy((bytes) => {\n        expect(Buffer.from(bytes).toString('hex')).toBe(KAT_EXPECTED_HEX);\n      });\n    });\n\n    test('adding a secret changes the derived output', async () => {\n      const withoutSecret = (await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS)).orThrow();\n      const withSecret = (\n        await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS, { secret: KAT_SECRET })\n      ).orThrow();\n      expect(withSecret).not.toEqual(withoutSecret);\n    });\n\n    test('adding associated data changes the derived output', async () => {\n      const withoutAd = (await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS)).orThrow();\n      const withAd = (\n        await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS, { associatedData: KAT_AD })\n      ).orThrow();\n      expect(withAd).not.toEqual(withoutAd);\n    });\n\n    test('empty secret / associatedData are a no-op (byte-identical to omitting options)', async () => {\n      const baseline = (await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS)).orThrow();\n      const emptyOptions = (\n        await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS, {\n          secret: new Uint8Array(0),\n          associatedData: new Uint8Array(0)\n        })\n      ).orThrow();\n      expect(emptyOptions).toEqual(baseline);\n    });\n  });\n\n  describe('parameter validation', () => {\n    test('fails when memoryKiB < 8', async () => {\n      expect(await provider.argon2id(RFC_PASSWORD, RFC_SALT, { ...RFC_PARAMS, memoryKiB: 7 })).toFailWith(\n        /memoryKiB must be >= 8/i\n      );\n    });\n\n    test('fails when iterations < 1', async () => {\n      expect(await provider.argon2id(RFC_PASSWORD, RFC_SALT, { ...RFC_PARAMS, iterations: 0 })).toFailWith(\n        /iterations must be >= 1/i\n      );\n    });\n\n    test('fails when parallelism < 1', async () => {\n      expect(await provider.argon2id(RFC_PASSWORD, RFC_SALT, { ...RFC_PARAMS, parallelism: 0 })).toFailWith(\n        /parallelism must be 1\\.\\.255/i\n      );\n    });\n\n    test('fails when parallelism > 255', async () => {\n      expect(await provider.argon2id(RFC_PASSWORD, RFC_SALT, { ...RFC_PARAMS, parallelism: 256 })).toFailWith(\n        /parallelism must be 1\\.\\.255/i\n      );\n    });\n\n    test('fails when outputBytes < 4', async () => {\n      expect(await provider.argon2id(RFC_PASSWORD, RFC_SALT, { ...RFC_PARAMS, outputBytes: 3 })).toFailWith(\n        /outputBytes must be >= 4/i\n      );\n    });\n  });\n});\n"]}

package/eslint.config.js

@@ -1,15 +0,0 @@
-// ESLint 9 flat config
-const nodeProfile = require('@rushstack/eslint-config/flat/profile/node');
-const packletsPlugin = require('@rushstack/eslint-config/flat/mixins/packlets');
-const tsdocPlugin = require('@rushstack/eslint-config/flat/mixins/tsdoc');
-
-module.exports = [
-  ...nodeProfile,
-  packletsPlugin,
-  ...tsdocPlugin,
-  {
-    rules: {
-      '@rushstack/packlets/mechanics': 'warn'
-    }
-  }
-];

package/etc/ts-extras-argon2.api.md

@@ -1,20 +0,0 @@
-## API Report File for "@fgv/ts-extras-argon2"
-
-> Do not edit this file. It is a report generated by [API Extractor](https://api-extractor.com/).
-
-```ts
-
-import { CryptoUtils } from '@fgv/ts-extras';
-import { Result } from '@fgv/ts-utils';
-
-export { CryptoUtils }
-
-// @public
-export class NodeArgon2Provider implements CryptoUtils.IArgon2idProvider {
-    argon2id(password: Uint8Array | string, salt: Uint8Array, params: CryptoUtils.IArgon2idParams, options?: CryptoUtils.IArgon2idKeyingOptions): Promise<Result<Uint8Array>>;
-    static create(): Result<NodeArgon2Provider>;
-}
-
-// (No @packageDocumentation comment for this package)
-
-```

package/lib/test/unit/argon2/crossRuntime.test.d.ts

@@ -1,2 +0,0 @@
-import '@fgv/ts-utils-jest';
-//# sourceMappingURL=crossRuntime.test.d.ts.map

package/lib/test/unit/argon2/crossRuntime.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"crossRuntime.test.d.ts","sourceRoot":"","sources":["../../../../src/test/unit/argon2/crossRuntime.test.ts"],"names":[],"mappings":"AAoBA,OAAO,oBAAoB,CAAC"}

package/lib/test/unit/argon2/crossRuntime.test.js

@@ -1,119 +0,0 @@
-"use strict";
-// Copyright (c) 2026 Erik Fortune
-//
-// Permission is hereby granted, free of charge, to any person obtaining a copy
-// of this software and associated documentation files (the "Software"), to deal
-// in the Software without restriction, including without limitation the rights
-// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-// copies of the Software, and to permit persons to whom the Software is
-// furnished to do so, subject to the following conditions:
-//
-// The above copyright notice and this permission notice shall be included in all
-// copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-// SOFTWARE.
-Object.defineProperty(exports, "__esModule", { value: true });
-require("@fgv/ts-utils-jest");
-const argon2_1 = require("../../../packlets/argon2");
-const ts_web_extras_argon2_1 = require("@fgv/ts-web-extras-argon2");
-// RFC 9106 §B.3 parameter set (no secret/AD — our IArgon2idParams interface does not expose
-// those optional Argon2 fields). Both implementations must agree on this exact output.
-const RFC_PARAMS = {
-    memoryKiB: 32,
-    iterations: 3,
-    parallelism: 4,
-    outputBytes: 32
-};
-const RFC_PASSWORD = new Uint8Array(32).fill(0x01);
-const RFC_SALT = new Uint8Array(16).fill(0x02);
-// Verified independently against both argon2 (kelektiv) and hash-wasm.
-const RFC_EXPECTED_HEX = '03aab965c12001c9d7d0d2de33192c0494b684bb148196d73c1df1acaf6d0c2e';
-const SWEEP = [
-    {
-        label: 'RFC §B.3 base case',
-        password: RFC_PASSWORD,
-        salt: RFC_SALT,
-        params: RFC_PARAMS
-    },
-    {
-        label: 'string password',
-        password: 'correct horse battery staple',
-        salt: RFC_SALT,
-        params: RFC_PARAMS
-    },
-    {
-        label: 'higher memoryKiB',
-        password: RFC_PASSWORD,
-        salt: RFC_SALT,
-        params: Object.assign(Object.assign({}, RFC_PARAMS), { memoryKiB: 64 })
-    },
-    {
-        label: 'more iterations',
-        password: RFC_PASSWORD,
-        salt: RFC_SALT,
-        params: Object.assign(Object.assign({}, RFC_PARAMS), { iterations: 5 })
-    },
-    {
-        label: 'parallelism=1',
-        password: RFC_PASSWORD,
-        salt: RFC_SALT,
-        params: Object.assign(Object.assign({}, RFC_PARAMS), { parallelism: 1 })
-    },
-    {
-        label: 'longer output (64 bytes)',
-        password: RFC_PASSWORD,
-        salt: RFC_SALT,
-        params: Object.assign(Object.assign({}, RFC_PARAMS), { outputBytes: 64 })
-    },
-    {
-        label: 'different salt',
-        password: RFC_PASSWORD,
-        salt: new Uint8Array(16).fill(0x07),
-        params: RFC_PARAMS
-    }
-];
-describe('cross-runtime equivalence: NodeArgon2Provider vs BrowserArgon2Provider', () => {
-    let node;
-    let browser;
-    beforeEach(() => {
-        node = argon2_1.NodeArgon2Provider.create().orThrow();
-        browser = ts_web_extras_argon2_1.BrowserArgon2Provider.create().orThrow();
-    });
-    test('RFC §B.3 parameter set matches known-good hex output', async () => {
-        const nodeBytes = (await node.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS)).orThrow();
-        expect(Buffer.from(nodeBytes).toString('hex')).toBe(RFC_EXPECTED_HEX);
-    });
-    test.each(SWEEP)('$label: outputs are byte-identical', async ({ password, salt, params }) => {
-        const nodeBytes = (await node.argon2id(password, salt, params)).orThrow();
-        const browserBytes = (await browser.argon2id(password, salt, params)).orThrow();
-        expect(nodeBytes).toEqual(browserBytes);
-    });
-    // A secret (RFC 9106 keyed hashing) is supported by both backends and must
-    // stay byte-identical across them. Small params keep this fast.
-    test('secret-only keyed hashing is byte-identical across runtimes', async () => {
-        const params = {
-            memoryKiB: 8,
-            iterations: 1,
-            parallelism: 1,
-            outputBytes: 32
-        };
-        const secret = new Uint8Array(8).fill(0x03);
-        const nodeBytes = (await node.argon2id(RFC_PASSWORD, RFC_SALT, params, { secret })).orThrow();
-        const browserBytes = (await browser.argon2id(RFC_PASSWORD, RFC_SALT, params, { secret })).orThrow();
-        expect(nodeBytes).toEqual(browserBytes);
-    });
-    // Associated data is Node-only: Node honors it, the WASM browser backend
-    // rejects it loudly rather than silently dropping it (which would diverge).
-    test('associatedData is Node-only: Node succeeds, browser rejects', async () => {
-        const associatedData = new Uint8Array(12).fill(0x04);
-        expect(await node.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS, { associatedData })).toSucceed();
-        expect(await browser.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS, { associatedData })).toFailWith(/associatedData is not supported.*node-only/i);
-    });
-});
-//# sourceMappingURL=crossRuntime.test.js.map

package/lib/test/unit/argon2/crossRuntime.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"crossRuntime.test.js","sourceRoot":"","sources":["../../../../src/test/unit/argon2/crossRuntime.test.ts"],"names":[],"mappings":";AAAA,kCAAkC;AAClC,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,2DAA2D;AAC3D,EAAE;AACF,iFAAiF;AACjF,kDAAkD;AAClD,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,yEAAyE;AACzE,gFAAgF;AAChF,gFAAgF;AAChF,YAAY;;AAEZ,8BAA4B;AAC5B,qDAA8D;AAC9D,oEAAkE;AAGlE,4FAA4F;AAC5F,uFAAuF;AACvF,MAAM,UAAU,GAAgC;IAC9C,SAAS,EAAE,EAAE;IACb,UAAU,EAAE,CAAC;IACb,WAAW,EAAE,CAAC;IACd,WAAW,EAAE,EAAE;CAChB,CAAC;AACF,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnD,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAE/C,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,kEAAkE,CAAC;AAU5F,MAAM,KAAK,GAAgB;IACzB;QACE,KAAK,EAAE,oBAAoB;QAC3B,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,UAAU;KACnB;IACD;QACE,KAAK,EAAE,iBAAiB;QACxB,QAAQ,EAAE,8BAA8B;QACxC,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,UAAU;KACnB;IACD;QACE,KAAK,EAAE,kBAAkB;QACzB,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,QAAQ;QACd,MAAM,kCAAO,UAAU,KAAE,SAAS,EAAE,EAAE,GAAE;KACzC;IACD;QACE,KAAK,EAAE,iBAAiB;QACxB,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,QAAQ;QACd,MAAM,kCAAO,UAAU,KAAE,UAAU,EAAE,CAAC,GAAE;KACzC;IACD;QACE,KAAK,EAAE,eAAe;QACtB,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,QAAQ;QACd,MAAM,kCAAO,UAAU,KAAE,WAAW,EAAE,CAAC,GAAE;KAC1C;IACD;QACE,KAAK,EAAE,0BAA0B;QACjC,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,QAAQ;QACd,MAAM,kCAAO,UAAU,KAAE,WAAW,EAAE,EAAE,GAAE;KAC3C;IACD;QACE,KAAK,EAAE,gBAAgB;QACvB,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACnC,MAAM,EAAE,UAAU;KACnB;CACF,CAAC;AAEF,QAAQ,CAAC,wEAAwE,EAAE,GAAG,EAAE;IACtF,IAAI,IAAwB,CAAC;IAC7B,IAAI,OAA8B,CAAC;IAEnC,UAAU,CAAC,GAAG,EAAE;QACd,IAAI,GAAG,2BAAkB,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;QAC7C,OAAO,GAAG,4CAAqB,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACtF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,oCAAoC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1F,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1E,MAAM,YAAY,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAChF,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,gEAAgE;IAChE,IAAI,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,MAAM,GAAgC;YAC1C,SAAS,EAAE,CAAC;YACZ,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,EAAE;SAChB,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAC9F,MAAM,YAAY,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACpG,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,4EAA4E;IAC5E,IAAI,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAChG,MAAM,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,UAAU,CAC/F,6CAA6C,CAC9C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// Copyright (c) 2026 Erik Fortune\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal\n// in the Software without restriction, including without limitation the rights\n// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n// copies of the Software, and to permit persons to whom the Software is\n// furnished to do so, subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in all\n// copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n// SOFTWARE.\n\nimport '@fgv/ts-utils-jest';\nimport { NodeArgon2Provider } from '../../../packlets/argon2';\nimport { BrowserArgon2Provider } from '@fgv/ts-web-extras-argon2';\nimport { CryptoUtils } from '@fgv/ts-extras';\n\n// RFC 9106 §B.3 parameter set (no secret/AD — our IArgon2idParams interface does not expose\n// those optional Argon2 fields). Both implementations must agree on this exact output.\nconst RFC_PARAMS: CryptoUtils.IArgon2idParams = {\n  memoryKiB: 32,\n  iterations: 3,\n  parallelism: 4,\n  outputBytes: 32\n};\nconst RFC_PASSWORD = new Uint8Array(32).fill(0x01);\nconst RFC_SALT = new Uint8Array(16).fill(0x02);\n\n// Verified independently against both argon2 (kelektiv) and hash-wasm.\nconst RFC_EXPECTED_HEX = '03aab965c12001c9d7d0d2de33192c0494b684bb148196d73c1df1acaf6d0c2e';\n\n// Parameter sweep — covers variation in each dimension independently.\ninterface ITestCase {\n  label: string;\n  password: Uint8Array | string;\n  salt: Uint8Array;\n  params: CryptoUtils.IArgon2idParams;\n}\n\nconst SWEEP: ITestCase[] = [\n  {\n    label: 'RFC §B.3 base case',\n    password: RFC_PASSWORD,\n    salt: RFC_SALT,\n    params: RFC_PARAMS\n  },\n  {\n    label: 'string password',\n    password: 'correct horse battery staple',\n    salt: RFC_SALT,\n    params: RFC_PARAMS\n  },\n  {\n    label: 'higher memoryKiB',\n    password: RFC_PASSWORD,\n    salt: RFC_SALT,\n    params: { ...RFC_PARAMS, memoryKiB: 64 }\n  },\n  {\n    label: 'more iterations',\n    password: RFC_PASSWORD,\n    salt: RFC_SALT,\n    params: { ...RFC_PARAMS, iterations: 5 }\n  },\n  {\n    label: 'parallelism=1',\n    password: RFC_PASSWORD,\n    salt: RFC_SALT,\n    params: { ...RFC_PARAMS, parallelism: 1 }\n  },\n  {\n    label: 'longer output (64 bytes)',\n    password: RFC_PASSWORD,\n    salt: RFC_SALT,\n    params: { ...RFC_PARAMS, outputBytes: 64 }\n  },\n  {\n    label: 'different salt',\n    password: RFC_PASSWORD,\n    salt: new Uint8Array(16).fill(0x07),\n    params: RFC_PARAMS\n  }\n];\n\ndescribe('cross-runtime equivalence: NodeArgon2Provider vs BrowserArgon2Provider', () => {\n  let node: NodeArgon2Provider;\n  let browser: BrowserArgon2Provider;\n\n  beforeEach(() => {\n    node = NodeArgon2Provider.create().orThrow();\n    browser = BrowserArgon2Provider.create().orThrow();\n  });\n\n  test('RFC §B.3 parameter set matches known-good hex output', async () => {\n    const nodeBytes = (await node.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS)).orThrow();\n    expect(Buffer.from(nodeBytes).toString('hex')).toBe(RFC_EXPECTED_HEX);\n  });\n\n  test.each(SWEEP)('$label: outputs are byte-identical', async ({ password, salt, params }) => {\n    const nodeBytes = (await node.argon2id(password, salt, params)).orThrow();\n    const browserBytes = (await browser.argon2id(password, salt, params)).orThrow();\n    expect(nodeBytes).toEqual(browserBytes);\n  });\n\n  // A secret (RFC 9106 keyed hashing) is supported by both backends and must\n  // stay byte-identical across them. Small params keep this fast.\n  test('secret-only keyed hashing is byte-identical across runtimes', async () => {\n    const params: CryptoUtils.IArgon2idParams = {\n      memoryKiB: 8,\n      iterations: 1,\n      parallelism: 1,\n      outputBytes: 32\n    };\n    const secret = new Uint8Array(8).fill(0x03);\n    const nodeBytes = (await node.argon2id(RFC_PASSWORD, RFC_SALT, params, { secret })).orThrow();\n    const browserBytes = (await browser.argon2id(RFC_PASSWORD, RFC_SALT, params, { secret })).orThrow();\n    expect(nodeBytes).toEqual(browserBytes);\n  });\n\n  // Associated data is Node-only: Node honors it, the WASM browser backend\n  // rejects it loudly rather than silently dropping it (which would diverge).\n  test('associatedData is Node-only: Node succeeds, browser rejects', async () => {\n    const associatedData = new Uint8Array(12).fill(0x04);\n    expect(await node.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS, { associatedData })).toSucceed();\n    expect(await browser.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS, { associatedData })).toFailWith(\n      /associatedData is not supported.*node-only/i\n    );\n  });\n});\n"]}

package/lib/test/unit/argon2/nodeArgon2Provider.test.d.ts

@@ -1,2 +0,0 @@
-import '@fgv/ts-utils-jest';
-//# sourceMappingURL=nodeArgon2Provider.test.d.ts.map

package/lib/test/unit/argon2/nodeArgon2Provider.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"nodeArgon2Provider.test.d.ts","sourceRoot":"","sources":["../../../../src/test/unit/argon2/nodeArgon2Provider.test.ts"],"names":[],"mappings":"AAoBA,OAAO,oBAAoB,CAAC"}

package/lib/test/unit/argon2/nodeArgon2Provider.test.js

@@ -1,146 +0,0 @@
-"use strict";
-// Copyright (c) 2026 Erik Fortune
-//
-// Permission is hereby granted, free of charge, to any person obtaining a copy
-// of this software and associated documentation files (the "Software"), to deal
-// in the Software without restriction, including without limitation the rights
-// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-// copies of the Software, and to permit persons to whom the Software is
-// furnished to do so, subject to the following conditions:
-//
-// The above copyright notice and this permission notice shall be included in all
-// copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-// SOFTWARE.
-Object.defineProperty(exports, "__esModule", { value: true });
-require("@fgv/ts-utils-jest");
-const argon2_1 = require("../../../packlets/argon2");
-// RFC 9106 §B.3 parameter set (no secret/AD — our interface does not expose those fields).
-// t=3, m=32, p=4, tag=32. Used for determinism and cross-runtime agreement.
-const RFC_PARAMS = {
-    memoryKiB: 32,
-    iterations: 3,
-    parallelism: 4,
-    outputBytes: 32
-};
-const RFC_PASSWORD = new Uint8Array(32).fill(0x01);
-const RFC_SALT = new Uint8Array(16).fill(0x02);
-describe('NodeArgon2Provider', () => {
-    let provider;
-    beforeEach(() => {
-        provider = argon2_1.NodeArgon2Provider.create().orThrow();
-    });
-    describe('create()', () => {
-        test('returns a provider instance', () => {
-            expect(argon2_1.NodeArgon2Provider.create()).toSucceedAndSatisfy((p) => {
-                expect(p).toBeInstanceOf(argon2_1.NodeArgon2Provider);
-            });
-        });
-    });
-    describe('argon2id()', () => {
-        test('derives a key with Uint8Array password', async () => {
-            expect(await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS)).toSucceedAndSatisfy((bytes) => {
-                expect(bytes).toBeInstanceOf(Uint8Array);
-                expect(bytes.length).toBe(RFC_PARAMS.outputBytes);
-            });
-        });
-        test('derives a key with string password', async () => {
-            expect(await provider.argon2id('password', RFC_SALT, RFC_PARAMS)).toSucceedAndSatisfy((bytes) => {
-                expect(bytes).toBeInstanceOf(Uint8Array);
-                expect(bytes.length).toBe(RFC_PARAMS.outputBytes);
-            });
-        });
-        test('is deterministic — same inputs produce identical bytes', async () => {
-            const r1 = (await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS)).orThrow();
-            const r2 = (await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS)).orThrow();
-            expect(r1).toEqual(r2);
-        });
-        test('different passwords produce different bytes', async () => {
-            const a = (await provider.argon2id(new Uint8Array(32).fill(0x01), RFC_SALT, RFC_PARAMS)).orThrow();
-            const b = (await provider.argon2id(new Uint8Array(32).fill(0x02), RFC_SALT, RFC_PARAMS)).orThrow();
-            expect(a).not.toEqual(b);
-        });
-        test('different salts produce different bytes', async () => {
-            const a = (await provider.argon2id(RFC_PASSWORD, new Uint8Array(16).fill(0x02), RFC_PARAMS)).orThrow();
-            const b = (await provider.argon2id(RFC_PASSWORD, new Uint8Array(16).fill(0x03), RFC_PARAMS)).orThrow();
-            expect(a).not.toEqual(b);
-        });
-        test('respects outputBytes', async () => {
-            expect(await provider.argon2id(RFC_PASSWORD, RFC_SALT, Object.assign(Object.assign({}, RFC_PARAMS), { outputBytes: 64 }))).toSucceedAndSatisfy((bytes) => {
-                expect(bytes.length).toBe(64);
-            });
-        });
-        test('returns failure when underlying library rejects (salt too short)', async () => {
-            const tinySalt = new Uint8Array(1).fill(0x02); // argon2 requires >= 8 bytes
-            expect(await provider.argon2id(RFC_PASSWORD, tinySalt, RFC_PARAMS)).toFail();
-        });
-    });
-    describe('keyed hashing (secret / associatedData)', () => {
-        // RFC 9106 §5.3 Argon2id known-answer test vector:
-        //   password P = 32 bytes of 0x01, salt S = 16 bytes of 0x02,
-        //   secret   K =  8 bytes of 0x03, associated data X = 12 bytes of 0x04,
-        //   t=3, m=32, p=4, tag=32.
-        //   expected tag = 0d640df58d78766c08c037a34a8b53c9d01ef0452d75b65eb52520e96b01e659
-        const KAT_PARAMS = {
-            memoryKiB: 32,
-            iterations: 3,
-            parallelism: 4,
-            outputBytes: 32
-        };
-        const KAT_PASSWORD = new Uint8Array(32).fill(0x01);
-        const KAT_SALT = new Uint8Array(16).fill(0x02);
-        const KAT_SECRET = new Uint8Array(8).fill(0x03);
-        const KAT_AD = new Uint8Array(12).fill(0x04);
-        const KAT_EXPECTED_HEX = '0d640df58d78766c08c037a34a8b53c9d01ef0452d75b65eb52520e96b01e659';
-        test('reproduces the RFC 9106 §5.3 known-answer vector with secret + associatedData', async () => {
-            expect(await provider.argon2id(KAT_PASSWORD, KAT_SALT, KAT_PARAMS, {
-                secret: KAT_SECRET,
-                associatedData: KAT_AD
-            })).toSucceedAndSatisfy((bytes) => {
-                expect(Buffer.from(bytes).toString('hex')).toBe(KAT_EXPECTED_HEX);
-            });
-        });
-        test('adding a secret changes the derived output', async () => {
-            const withoutSecret = (await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS)).orThrow();
-            const withSecret = (await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS, { secret: KAT_SECRET })).orThrow();
-            expect(withSecret).not.toEqual(withoutSecret);
-        });
-        test('adding associated data changes the derived output', async () => {
-            const withoutAd = (await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS)).orThrow();
-            const withAd = (await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS, { associatedData: KAT_AD })).orThrow();
-            expect(withAd).not.toEqual(withoutAd);
-        });
-        test('empty secret / associatedData are a no-op (byte-identical to omitting options)', async () => {
-            const baseline = (await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS)).orThrow();
-            const emptyOptions = (await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS, {
-                secret: new Uint8Array(0),
-                associatedData: new Uint8Array(0)
-            })).orThrow();
-            expect(emptyOptions).toEqual(baseline);
-        });
-    });
-    describe('parameter validation', () => {
-        test('fails when memoryKiB < 8', async () => {
-            expect(await provider.argon2id(RFC_PASSWORD, RFC_SALT, Object.assign(Object.assign({}, RFC_PARAMS), { memoryKiB: 7 }))).toFailWith(/memoryKiB must be >= 8/i);
-        });
-        test('fails when iterations < 1', async () => {
-            expect(await provider.argon2id(RFC_PASSWORD, RFC_SALT, Object.assign(Object.assign({}, RFC_PARAMS), { iterations: 0 }))).toFailWith(/iterations must be >= 1/i);
-        });
-        test('fails when parallelism < 1', async () => {
-            expect(await provider.argon2id(RFC_PASSWORD, RFC_SALT, Object.assign(Object.assign({}, RFC_PARAMS), { parallelism: 0 }))).toFailWith(/parallelism must be 1\.\.255/i);
-        });
-        test('fails when parallelism > 255', async () => {
-            expect(await provider.argon2id(RFC_PASSWORD, RFC_SALT, Object.assign(Object.assign({}, RFC_PARAMS), { parallelism: 256 }))).toFailWith(/parallelism must be 1\.\.255/i);
-        });
-        test('fails when outputBytes < 4', async () => {
-            expect(await provider.argon2id(RFC_PASSWORD, RFC_SALT, Object.assign(Object.assign({}, RFC_PARAMS), { outputBytes: 3 }))).toFailWith(/outputBytes must be >= 4/i);
-        });
-    });
-});
-//# sourceMappingURL=nodeArgon2Provider.test.js.map

package/lib/test/unit/argon2/nodeArgon2Provider.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"nodeArgon2Provider.test.js","sourceRoot":"","sources":["../../../../src/test/unit/argon2/nodeArgon2Provider.test.ts"],"names":[],"mappings":";AAAA,kCAAkC;AAClC,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,2DAA2D;AAC3D,EAAE;AACF,iFAAiF;AACjF,kDAAkD;AAClD,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,yEAAyE;AACzE,gFAAgF;AAChF,gFAAgF;AAChF,YAAY;;AAEZ,8BAA4B;AAC5B,qDAA8D;AAG9D,2FAA2F;AAC3F,4EAA4E;AAC5E,MAAM,UAAU,GAAgC;IAC9C,SAAS,EAAE,EAAE;IACb,UAAU,EAAE,CAAC;IACb,WAAW,EAAE,CAAC;IACd,WAAW,EAAE,EAAE;CAChB,CAAC;AACF,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnD,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAE/C,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,IAAI,QAA4B,CAAC;IAEjC,UAAU,CAAC,GAAG,EAAE;QACd,QAAQ,GAAG,2BAAkB,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;QACxB,IAAI,CAAC,6BAA6B,EAAE,GAAG,EAAE;YACvC,MAAM,CAAC,2BAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC5D,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,2BAAkB,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;QAC1B,IAAI,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACxD,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,KAAK,EAAE,EAAE;gBAChG,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;gBACzC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC9F,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;gBACzC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;YACxE,MAAM,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACnF,MAAM,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACnF,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACnG,MAAM,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACnG,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACvG,MAAM,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACvG,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,CACJ,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,kCAAO,UAAU,KAAE,WAAW,EAAE,EAAE,IAAG,CACpF,CAAC,mBAAmB,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC9B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;YAClF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,6BAA6B;YAC5E,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC/E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACvD,mDAAmD;QACnD,8DAA8D;QAC9D,yEAAyE;QACzE,4BAA4B;QAC5B,oFAAoF;QACpF,MAAM,UAAU,GAAgC;YAC9C,SAAS,EAAE,EAAE;YACb,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,EAAE;SAChB,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,gBAAgB,GAAG,kEAAkE,CAAC;QAE5F,IAAI,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;YAC/F,MAAM,CACJ,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE;gBAC1D,MAAM,EAAE,UAAU;gBAClB,cAAc,EAAE,MAAM;aACvB,CAAC,CACH,CAAC,mBAAmB,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACpE,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,aAAa,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAC9F,MAAM,UAAU,GAAG,CACjB,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CACpF,CAAC,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;YACnE,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1F,MAAM,MAAM,GAAG,CACb,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CACxF,CAAC,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;YAChG,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACzF,MAAM,YAAY,GAAG,CACnB,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE;gBAC1D,MAAM,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;gBACzB,cAAc,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;aAClC,CAAC,CACH,CAAC,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;QACpC,IAAI,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,kCAAO,UAAU,KAAE,SAAS,EAAE,CAAC,IAAG,CAAC,CAAC,UAAU,CACjG,yBAAyB,CAC1B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;YAC3C,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,kCAAO,UAAU,KAAE,UAAU,EAAE,CAAC,IAAG,CAAC,CAAC,UAAU,CAClG,0BAA0B,CAC3B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,kCAAO,UAAU,KAAE,WAAW,EAAE,CAAC,IAAG,CAAC,CAAC,UAAU,CACnG,+BAA+B,CAChC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC9C,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,kCAAO,UAAU,KAAE,WAAW,EAAE,GAAG,IAAG,CAAC,CAAC,UAAU,CACrG,+BAA+B,CAChC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,kCAAO,UAAU,KAAE,WAAW,EAAE,CAAC,IAAG,CAAC,CAAC,UAAU,CACnG,2BAA2B,CAC5B,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// Copyright (c) 2026 Erik Fortune\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal\n// in the Software without restriction, including without limitation the rights\n// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n// copies of the Software, and to permit persons to whom the Software is\n// furnished to do so, subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in all\n// copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n// SOFTWARE.\n\nimport '@fgv/ts-utils-jest';\nimport { NodeArgon2Provider } from '../../../packlets/argon2';\nimport { CryptoUtils } from '@fgv/ts-extras';\n\n// RFC 9106 §B.3 parameter set (no secret/AD — our interface does not expose those fields).\n// t=3, m=32, p=4, tag=32. Used for determinism and cross-runtime agreement.\nconst RFC_PARAMS: CryptoUtils.IArgon2idParams = {\n  memoryKiB: 32,\n  iterations: 3,\n  parallelism: 4,\n  outputBytes: 32\n};\nconst RFC_PASSWORD = new Uint8Array(32).fill(0x01);\nconst RFC_SALT = new Uint8Array(16).fill(0x02);\n\ndescribe('NodeArgon2Provider', () => {\n  let provider: NodeArgon2Provider;\n\n  beforeEach(() => {\n    provider = NodeArgon2Provider.create().orThrow();\n  });\n\n  describe('create()', () => {\n    test('returns a provider instance', () => {\n      expect(NodeArgon2Provider.create()).toSucceedAndSatisfy((p) => {\n        expect(p).toBeInstanceOf(NodeArgon2Provider);\n      });\n    });\n  });\n\n  describe('argon2id()', () => {\n    test('derives a key with Uint8Array password', async () => {\n      expect(await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS)).toSucceedAndSatisfy((bytes) => {\n        expect(bytes).toBeInstanceOf(Uint8Array);\n        expect(bytes.length).toBe(RFC_PARAMS.outputBytes);\n      });\n    });\n\n    test('derives a key with string password', async () => {\n      expect(await provider.argon2id('password', RFC_SALT, RFC_PARAMS)).toSucceedAndSatisfy((bytes) => {\n        expect(bytes).toBeInstanceOf(Uint8Array);\n        expect(bytes.length).toBe(RFC_PARAMS.outputBytes);\n      });\n    });\n\n    test('is deterministic — same inputs produce identical bytes', async () => {\n      const r1 = (await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS)).orThrow();\n      const r2 = (await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS)).orThrow();\n      expect(r1).toEqual(r2);\n    });\n\n    test('different passwords produce different bytes', async () => {\n      const a = (await provider.argon2id(new Uint8Array(32).fill(0x01), RFC_SALT, RFC_PARAMS)).orThrow();\n      const b = (await provider.argon2id(new Uint8Array(32).fill(0x02), RFC_SALT, RFC_PARAMS)).orThrow();\n      expect(a).not.toEqual(b);\n    });\n\n    test('different salts produce different bytes', async () => {\n      const a = (await provider.argon2id(RFC_PASSWORD, new Uint8Array(16).fill(0x02), RFC_PARAMS)).orThrow();\n      const b = (await provider.argon2id(RFC_PASSWORD, new Uint8Array(16).fill(0x03), RFC_PARAMS)).orThrow();\n      expect(a).not.toEqual(b);\n    });\n\n    test('respects outputBytes', async () => {\n      expect(\n        await provider.argon2id(RFC_PASSWORD, RFC_SALT, { ...RFC_PARAMS, outputBytes: 64 })\n      ).toSucceedAndSatisfy((bytes) => {\n        expect(bytes.length).toBe(64);\n      });\n    });\n\n    test('returns failure when underlying library rejects (salt too short)', async () => {\n      const tinySalt = new Uint8Array(1).fill(0x02); // argon2 requires >= 8 bytes\n      expect(await provider.argon2id(RFC_PASSWORD, tinySalt, RFC_PARAMS)).toFail();\n    });\n  });\n\n  describe('keyed hashing (secret / associatedData)', () => {\n    // RFC 9106 §5.3 Argon2id known-answer test vector:\n    //   password P = 32 bytes of 0x01, salt S = 16 bytes of 0x02,\n    //   secret   K =  8 bytes of 0x03, associated data X = 12 bytes of 0x04,\n    //   t=3, m=32, p=4, tag=32.\n    //   expected tag = 0d640df58d78766c08c037a34a8b53c9d01ef0452d75b65eb52520e96b01e659\n    const KAT_PARAMS: CryptoUtils.IArgon2idParams = {\n      memoryKiB: 32,\n      iterations: 3,\n      parallelism: 4,\n      outputBytes: 32\n    };\n    const KAT_PASSWORD = new Uint8Array(32).fill(0x01);\n    const KAT_SALT = new Uint8Array(16).fill(0x02);\n    const KAT_SECRET = new Uint8Array(8).fill(0x03);\n    const KAT_AD = new Uint8Array(12).fill(0x04);\n    const KAT_EXPECTED_HEX = '0d640df58d78766c08c037a34a8b53c9d01ef0452d75b65eb52520e96b01e659';\n\n    test('reproduces the RFC 9106 §5.3 known-answer vector with secret + associatedData', async () => {\n      expect(\n        await provider.argon2id(KAT_PASSWORD, KAT_SALT, KAT_PARAMS, {\n          secret: KAT_SECRET,\n          associatedData: KAT_AD\n        })\n      ).toSucceedAndSatisfy((bytes) => {\n        expect(Buffer.from(bytes).toString('hex')).toBe(KAT_EXPECTED_HEX);\n      });\n    });\n\n    test('adding a secret changes the derived output', async () => {\n      const withoutSecret = (await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS)).orThrow();\n      const withSecret = (\n        await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS, { secret: KAT_SECRET })\n      ).orThrow();\n      expect(withSecret).not.toEqual(withoutSecret);\n    });\n\n    test('adding associated data changes the derived output', async () => {\n      const withoutAd = (await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS)).orThrow();\n      const withAd = (\n        await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS, { associatedData: KAT_AD })\n      ).orThrow();\n      expect(withAd).not.toEqual(withoutAd);\n    });\n\n    test('empty secret / associatedData are a no-op (byte-identical to omitting options)', async () => {\n      const baseline = (await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS)).orThrow();\n      const emptyOptions = (\n        await provider.argon2id(RFC_PASSWORD, RFC_SALT, RFC_PARAMS, {\n          secret: new Uint8Array(0),\n          associatedData: new Uint8Array(0)\n        })\n      ).orThrow();\n      expect(emptyOptions).toEqual(baseline);\n    });\n  });\n\n  describe('parameter validation', () => {\n    test('fails when memoryKiB < 8', async () => {\n      expect(await provider.argon2id(RFC_PASSWORD, RFC_SALT, { ...RFC_PARAMS, memoryKiB: 7 })).toFailWith(\n        /memoryKiB must be >= 8/i\n      );\n    });\n\n    test('fails when iterations < 1', async () => {\n      expect(await provider.argon2id(RFC_PASSWORD, RFC_SALT, { ...RFC_PARAMS, iterations: 0 })).toFailWith(\n        /iterations must be >= 1/i\n      );\n    });\n\n    test('fails when parallelism < 1', async () => {\n      expect(await provider.argon2id(RFC_PASSWORD, RFC_SALT, { ...RFC_PARAMS, parallelism: 0 })).toFailWith(\n        /parallelism must be 1\\.\\.255/i\n      );\n    });\n\n    test('fails when parallelism > 255', async () => {\n      expect(await provider.argon2id(RFC_PASSWORD, RFC_SALT, { ...RFC_PARAMS, parallelism: 256 })).toFailWith(\n        /parallelism must be 1\\.\\.255/i\n      );\n    });\n\n    test('fails when outputBytes < 4', async () => {\n      expect(await provider.argon2id(RFC_PASSWORD, RFC_SALT, { ...RFC_PARAMS, outputBytes: 3 })).toFailWith(\n        /outputBytes must be >= 4/i\n      );\n    });\n  });\n});\n"]}

package/rush-logs/ts-extras-argon2.build.cache.log

@@ -1,3 +0,0 @@
-Caching build output folders: dist, lib, temp, .rush/temp/operation/build
-Successfully set cache entry.
-Cache key: eb061fb1c7e3a355a03b204add873a27586efa0d

package/rush-logs/ts-extras-argon2.build.log

@@ -1,9 +0,0 @@
-Invoking: heft build --clean 
- ---- build started ---- 
-[build:typescript] The TypeScript compiler version 5.9.3 is newer than the latest version that was tested with Heft (5.8); it may not work correctly.
-[build:typescript] Using TypeScript version 5.9.3
-[build:lint] Using ESLint version 9.39.5
-[build:api-extractor] Using API Extractor version 7.58.9
-[build:api-extractor] Analysis will use the bundled TypeScript version 5.9.3
- ---- build finished (14.490s) ---- 
--------------------- Finished (14.497s) --------------------

package/src/index.ts

@@ -1,21 +0,0 @@
-// Copyright (c) 2026 Erik Fortune
-//
-// Permission is hereby granted, free of charge, to any person obtaining a copy
-// of this software and associated documentation files (the "Software"), to deal
-// in the Software without restriction, including without limitation the rights
-// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-// copies of the Software, and to permit persons to whom the Software is
-// furnished to do so, subject to the following conditions:
-//
-// The above copyright notice and this permission notice shall be included in all
-// copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-// SOFTWARE.
-
-export { NodeArgon2Provider, CryptoUtils } from './packlets/argon2';

package/src/packlets/argon2/index.ts

@@ -1,25 +0,0 @@
-// Copyright (c) 2026 Erik Fortune
-//
-// Permission is hereby granted, free of charge, to any person obtaining a copy
-// of this software and associated documentation files (the "Software"), to deal
-// in the Software without restriction, including without limitation the rights
-// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-// copies of the Software, and to permit persons to whom the Software is
-// furnished to do so, subject to the following conditions:
-//
-// The above copyright notice and this permission notice shall be included in all
-// copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-// SOFTWARE.
-
-export { NodeArgon2Provider } from './nodeArgon2Provider';
-
-// Re-export CryptoUtils namespace from ts-extras for consumer convenience
-// (provides IArgon2idProvider, IArgon2idParams, ARGON2ID_OWASP_MIN, ARGON2ID_PASSPHRASE).
-export { CryptoUtils } from '@fgv/ts-extras';

package/src/packlets/argon2/nodeArgon2Provider.ts

@@ -1,101 +0,0 @@
-// Copyright (c) 2026 Erik Fortune
-//
-// Permission is hereby granted, free of charge, to any person obtaining a copy
-// of this software and associated documentation files (the "Software"), to deal
-// in the Software without restriction, including without limitation the rights
-// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-// copies of the Software, and to permit persons to whom the Software is
-// furnished to do so, subject to the following conditions:
-//
-// The above copyright notice and this permission notice shall be included in all
-// copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-// SOFTWARE.
-
-import * as argon2 from 'argon2';
-import { Result, captureAsyncResult, fail, succeed } from '@fgv/ts-utils';
-import { CryptoUtils } from '@fgv/ts-extras';
-
-/**
- * Node.js implementation of {@link @fgv/ts-extras#IArgon2idProvider} backed by the
- * `argon2` (kelektiv) native binding.
- * @public
- */
-export class NodeArgon2Provider implements CryptoUtils.IArgon2idProvider {
-  private constructor() {}
-
-  /**
-   * Creates a new {@link NodeArgon2Provider} instance.
-   * @returns Success with a new provider instance.
-   * @public
-   */
-  public static create(): Result<NodeArgon2Provider> {
-    return succeed(new NodeArgon2Provider());
-  }
-
-  /**
-   * Derives a key using Argon2id.
-   *
-   * @param password - The password or passphrase (string or raw bytes).
-   * @param salt - The salt (must be at least 8 bytes; 16+ bytes recommended).
-   * @param params - Argon2id parameters. All values are validated before derivation.
-   * @param options - Optional {@link @fgv/ts-extras#CryptoUtils.IArgon2idKeyingOptions | keyed-hashing inputs}
-   * (RFC 9106 secret K and/or associated data X). Both are wired through to the
-   * underlying `argon2` binding when present and non-empty; omitting them (or
-   * passing empty arrays) leaves the output byte-identical to prior behavior.
-   * @returns Success with the derived key bytes, or Failure with a descriptive message.
-   * @public
-   */
-  public async argon2id(
-    password: Uint8Array | string,
-    salt: Uint8Array,
-    params: CryptoUtils.IArgon2idParams,
-    options?: CryptoUtils.IArgon2idKeyingOptions
-  ): Promise<Result<Uint8Array>> {
-    const error = NodeArgon2Provider._validateParams(params);
-    if (error !== undefined) {
-      return fail(error);
-    }
-
-    return captureAsyncResult(async () => {
-      const result = await argon2.hash(password instanceof Uint8Array ? Buffer.from(password) : password, {
-        type: argon2.argon2id,
-        salt: Buffer.from(salt),
-        memoryCost: params.memoryKiB,
-        timeCost: params.iterations,
-        parallelism: params.parallelism,
-        hashLength: params.outputBytes,
-        raw: true,
-        // Only pass secret/associatedData when present and non-empty so that
-        // existing callers (and empty options) produce byte-identical output.
-        ...(options?.secret && options.secret.length > 0 ? { secret: Buffer.from(options.secret) } : {}),
-        ...(options?.associatedData && options.associatedData.length > 0
-          ? { associatedData: Buffer.from(options.associatedData) }
-          : {})
-      });
-      return Uint8Array.from(result);
-    });
-  }
-
-  private static _validateParams(params: CryptoUtils.IArgon2idParams): string | undefined {
-    if (params.memoryKiB < 8) {
-      return `argon2id: memoryKiB must be >= 8, got ${params.memoryKiB}`;
-    }
-    if (params.iterations < 1) {
-      return `argon2id: iterations must be >= 1, got ${params.iterations}`;
-    }
-    if (params.parallelism < 1 || params.parallelism > 255) {
-      return `argon2id: parallelism must be 1..255, got ${params.parallelism}`;
-    }
-    if (params.outputBytes < 4) {
-      return `argon2id: outputBytes must be >= 4, got ${params.outputBytes}`;
-    }
-    return undefined;
-  }
-}