@scriptc/compiler 0.3.2 → 0.3.4

package/dist/frontend/lowering/builtins/crypto.js

@@ -1,8 +1,10 @@
-import { lowerBuiltinByteInput, errorFirstBytesCallback } from "./arguments.js";
-import { dynUndefinedExpr } from "../../../ir/build.js";
+import { lowerBuiltinByteInput, errorFirstBytesCallback, errorFirstCallback } from "./arguments.js";
+import { isKeyObjectValue } from "./key-object.js";
+import { boolLit, dynUndefinedExpr, varRef } from "../../../ir/build.js";
 import * as ts from "../../ts7/adapter.js";
 import { own } from "../lowerer.js";
 import { locOf } from "../../program.js";
+import { CIPHER_TYPE_NAMES } from "../../type-mapper.js";
 import { CRYPTO_CIPHERS, CRYPTO_CURVES, CRYPTO_HASHES } from "../crypto-tables.js";
 import { BOOL, BYTES_U8, CRYPTOHASH_T, CRYPTOHMAC_T, DYN, F64, STRING, VOID, arrayOf, } from "../../../ir/ir.js";
 /** The composed crypto pattern: `randomBytes(n).toString(enc)` lowers
@@ -95,7 +97,7 @@ function lowerHashDigestChain(lowerer, call, access) {
     const dataNode = updateCall.arguments[0];
     const dataIr = lowerer.mapTypeOf(lowerer.typeOf(dataNode));
     if (dataIr?.kind === "bytes") {
-        const data = lowerer.lowerExpr(dataNode);
+        const data = cryptoByteView(lowerer, dataNode, lowerer.lowerExpr(dataNode));
         const enc = lowerer.lowerExprExpecting(call.arguments[0], STRING);
         return {
             kind: "libCall",
@@ -118,19 +120,83 @@ function lowerHashDigestChain(lowerer, call, access) {
     }
     return null;
 }
-function cryptoEncoding(lowerer, node, use) {
-    const type = lowerer.typeOf(node);
-    if (!type.isStringLiteralType() || (type.value !== "hex" && type.value !== "base64")) {
-        lowerer.noLowering(`${use} with this encoding`, node, 'the lowered output encodings are "hex" and "base64"');
+/** Node's normalizeEncoding(): the canonical name of a Buffer encoding,
+ * compared case-insensitively, or undefined for a name Node does not know. */
+function cryptoEncodingName(value) {
+    switch (value.toLowerCase()) {
+        case "hex":
+            return "hex";
+        case "base64":
+            return "base64";
+        case "base64url":
+            return "base64url";
+        case "":
+        case "utf8":
+        case "utf-8":
+            return "utf8";
+        case "latin1":
+        case "binary":
+            return "latin1";
+        case "ascii":
+            return "ascii";
+        case "utf16le":
+        case "utf-16le":
+        case "ucs2":
+        case "ucs-2":
+            return "utf16le";
+        default:
+            return undefined;
     }
-    return lowerer.lowerExprExpecting(node, STRING);
 }
-function cryptoAlgorithm(lowerer, node, use) {
-    const type = lowerer.typeOf(node);
-    if (type.isStringLiteralType() &&
-        !["md5", "sha1", "sha224", "sha256", "sha384", "sha512"].includes(type.value.toLowerCase())) {
-        lowerer.noLowering(`${use} with algorithm '${type.value}'`, node, "md5, sha1, sha224, sha256, sha384, and sha512 are the lowered digest algorithms");
+/** The values of a string literal type or a union of them; undefined when
+ * the type allows other values. */
+function stringLiteralValues(type) {
+    if (type.isStringLiteralType())
+        return [type.value];
+    if (!type.isUnionType())
+        return undefined;
+    const values = [];
+    for (const member of ts.constituentTypes(type)) {
+        if (!member.isStringLiteralType())
+            return undefined;
+        values.push(member.value);
     }
+    return values;
+}
+/** Whether every value the node's type allows is an encoding that gives a
+ * string digest: a Buffer encoding Node knows. Hash.digest() treats ""
+ * as no encoding and returns a Buffer; crypto.hash() reads it as UTF-8. */
+function isStringDigestEncoding(lowerer, node, emptyIsString) {
+    const values = stringLiteralValues(lowerer.typeOf(node));
+    return (!!values &&
+        values.every((value) => (value !== "" || emptyIsString) && cryptoEncodingName(value) !== undefined));
+}
+/** Whether every offset/size argument is statically a number; other
+ * values take the runtime checks, which throw Node's errors or apply its
+ * defaults. */
+function cryptoNumberArgs(lowerer, nodes) {
+    return nodes.every((node) => lowerer.mapTypeOf(lowerer.typeOf(node))?.kind === "f64");
+}
+/** A view's bytes as the Uint8Array the byte-input libCalls take: other
+ * TypedArrays and DataViews become a u8 view of the same memory. */
+function cryptoByteView(lowerer, node, value) {
+    if (value.type.kind !== "bytes" || value.type.elem === "u8")
+        return value;
+    return {
+        kind: "libCall",
+        fn: "bytes.bufferSource",
+        args: [lowerer.coerceInto(node, value, DYN)],
+        type: BYTES_U8,
+        loc: locOf(node),
+    };
+}
+function dynArg(lowerer, node, loc) {
+    return node ? lowerer.lowerExprExpecting(node, DYN) : dynUndefinedExpr(loc);
+}
+/** A digest name. The runtime resolves every name and alias Node 24
+ * accepts and throws Node's error for the others, so literals are not
+ * checked here. */
+function cryptoAlgorithm(lowerer, node) {
     return lowerer.lowerExprExpecting(node, STRING);
 }
 function cryptoKdfInput(lowerer, node) {
@@ -144,7 +210,7 @@ function cryptoKdfInput(lowerer, node) {
         const value = lowerer.coerceInto(node, lowerer.lowerExpr(node), DYN);
         return { kind: "libCall", fn: "bytes.bufferSource", args: [value], type: BYTES_U8, loc };
     }
-    lowerer.noLowering("crypto key derivation with this input", node, "strings, Buffers, numeric typed arrays, DataViews, and fixed-length ArrayBuffers are supported; KeyObjects are not yet lowered");
+    lowerer.noLowering("crypto key derivation with this input", node, "strings, Buffers, numeric typed arrays, DataViews, and fixed-length ArrayBuffers are supported; KeyObjects are accepted only as hkdf's key, as in Node");
 }
 export function lowerCryptoModuleCall(lowerer, expr, bi, loc) {
     if (bi.module !== "crypto")
@@ -182,7 +248,7 @@ export function lowerCryptoModuleCall(lowerer, expr, bi, loc) {
                 lowerBuiltinByteInput(lowerer, args[1], locOf(args[1]), "crypto"),
                 lowerer.lowerExprExpecting(args[2], F64),
                 lowerer.lowerExprExpecting(args[3], F64),
-                cryptoAlgorithm(lowerer, args[4], "crypto.pbkdf2"),
+                cryptoAlgorithm(lowerer, args[4]),
                 errorFirstBytesCallback(lowerer, args[5], "crypto"),
             ],
             type: VOID,
@@ -194,8 +260,16 @@ export function lowerCryptoModuleCall(lowerer, expr, bi, loc) {
         if (args.length !== (async ? 6 : 5))
             lowerer.noLowering(`crypto.${bi.member} with ${args.length} arguments`, expr);
         const values = [
-            cryptoAlgorithm(lowerer, args[0], `crypto.${bi.member}`),
-            cryptoKdfInput(lowerer, args[1]),
+            cryptoAlgorithm(lowerer, args[0]),
+            isKeyObjectValue(lowerer, args[1])
+                ? {
+                    kind: "libCall",
+                    fn: "crypto.keyObjectInput",
+                    args: [lowerer.lowerExprExpecting(args[1], DYN)],
+                    type: BYTES_U8,
+                    loc,
+                }
+                : cryptoKdfInput(lowerer, args[1]),
             cryptoKdfInput(lowerer, args[2]),
             cryptoKdfInput(lowerer, args[3]),
             lowerer.lowerExprExpecting(args[4], F64),
@@ -235,121 +309,349 @@ export function lowerCryptoModuleCall(lowerer, expr, bi, loc) {
         };
     }
     if (bi.member === "createHash") {
-        if (args.length !== 1) {
-            lowerer.noLowering(`crypto.createHash with ${args.length} arguments`, expr, "createHash(algorithm) is supported; options are not yet lowered");
+        if (args.length < 1 || args.length > 2 || args.some(ts.isSpreadElement)) {
+            lowerer.noLowering(`crypto.createHash with ${args.length} arguments`, expr, "createHash(algorithm[, options]) is supported");
+        }
+        const algorithm = cryptoAlgorithm(lowerer, args[0]);
+        if (args.length === 1) {
+            return { kind: "libCall", fn: "crypto.hashNew", args: [algorithm], type: CRYPTOHASH_T, loc };
         }
         return {
             kind: "libCall",
-            fn: "crypto.hashNew",
-            args: [cryptoAlgorithm(lowerer, args[0], "crypto.createHash")],
+            fn: "crypto.hashNewOpts",
+            args: [algorithm, lowerer.lowerExprExpecting(args[1], DYN)],
             type: CRYPTOHASH_T,
             loc,
         };
     }
+    if (bi.member === "createCipheriv" || bi.member === "createDecipheriv") {
+        const algorithm = args[0];
+        if (algorithm)
+            checkCipherName(lowerer, algorithm, `crypto.${bi.member}`);
+        const stmts = [];
+        const values = [boolLit(bi.member === "createDecipheriv", loc)];
+        // Every argument is evaluated, left to right, before the runtime
+        // checks them; surplus arguments are evaluated and dropped.
+        for (let i = 0; i < 4; i++) {
+            const input = args[i]
+                ? lowerer.lowerExprExpecting(args[i], DYN)
+                : dynUndefinedExpr(loc);
+            const saved = lowerer.declareHiddenLocal("%cipherInput", DYN);
+            stmts.push({ kind: "varDecl", localId: saved.id, init: input, loc });
+            values.push(varRef(saved.id, DYN, loc));
+        }
+        for (const arg of args.slice(4))
+            stmts.push({ kind: "exprStmt", expr: lowerer.lowerExpr(arg), loc });
+        return {
+            kind: "seqExpr",
+            stmts,
+            result: { kind: "libCall", fn: "crypto.cipherNew", args: values, type: DYN, loc },
+            type: DYN,
+            loc,
+        };
+    }
     if (bi.member === "createHmac") {
-        if (args.length !== 2) {
-            lowerer.noLowering(`crypto.createHmac with ${args.length} arguments`, expr, "createHmac(algorithm, stringOrBufferKey) is supported; options and KeyObject keys are not yet lowered");
+        if (args.length < 2 || args.length > 3 || args.some(ts.isSpreadElement)) {
+            lowerer.noLowering(`crypto.createHmac with ${args.length} arguments`, expr, "createHmac(algorithm, key[, options]) is supported");
         }
-        const algorithm = cryptoAlgorithm(lowerer, args[0], "crypto.createHmac");
+        const algorithm = cryptoAlgorithm(lowerer, args[0]);
         const key = lowerer.lowerExpr(args[1]);
-        if (key.type.kind === "string") {
+        if (args.length === 3 || (key.type.kind !== "string" && key.type.kind !== "bytes")) {
+            // Views, ArrayBuffers, options.encoding and values of other types
+            // take Node's prepareSecretKey checks at run time.
             return {
                 kind: "libCall",
-                fn: "crypto.hmacNewStr",
-                args: [algorithm, key],
+                fn: "crypto.hmacNewDyn",
+                args: [algorithm, lowerer.coerceInto(args[1], key, DYN), dynArg(lowerer, args[2], loc)],
                 type: CRYPTOHMAC_T,
                 loc,
             };
         }
-        if (key.type.kind === "bytes" && key.type.elem === "u8") {
+        if (key.type.kind === "string") {
             return {
                 kind: "libCall",
-                fn: "crypto.hmacNewBytes",
+                fn: "crypto.hmacNewStr",
                 args: [algorithm, key],
                 type: CRYPTOHMAC_T,
                 loc,
             };
         }
-        lowerer.noLowering(`crypto.createHmac with a '${lowerer.fmt(key.type)}' key`, args[1], "string and Buffer/Uint8Array keys are supported");
+        return {
+            kind: "libCall",
+            fn: "crypto.hmacNewBytes",
+            args: [algorithm, cryptoByteView(lowerer, args[1], key)],
+            type: CRYPTOHMAC_T,
+            loc,
+        };
     }
     if (bi.member === "hash") {
-        if (args.length < 2 || args.length > 3) {
-            lowerer.noLowering(`crypto.hash with ${args.length} arguments`, expr, 'hash(algorithm, stringOrBuffer[, "hex" | "base64"]) is supported');
+        if (args.length < 2 || args.length > 3 || args.some(ts.isSpreadElement)) {
+            lowerer.noLowering(`crypto.hash with ${args.length} arguments`, expr, "hash(algorithm, data[, outputEncodingOrOptions]) is supported");
         }
-        const algorithm = cryptoAlgorithm(lowerer, args[0], "crypto.hash");
+        const algorithm = cryptoAlgorithm(lowerer, args[0]);
         const data = lowerer.lowerExpr(args[1]);
-        const encoding = args[2]
-            ? cryptoEncoding(lowerer, args[2], "crypto.hash")
-            : { kind: "strLit", value: "hex", type: STRING, loc };
-        if (data.type.kind === "string") {
+        let options = args[2];
+        // An options literal holding only a literal string-digest
+        // outputEncoding is that encoding; evaluating it observes nothing.
+        if (options && ts.isObjectLiteralExpression(options) && options.properties.length === 1) {
+            const property = options.properties[0];
+            if (ts.isPropertyAssignment(property) &&
+                ts.isIdentifier(property.name) &&
+                property.name.text === "outputEncoding" &&
+                ts.isStringLiteral(property.initializer) &&
+                isStringDigestEncoding(lowerer, property.initializer, true)) {
+                options = property.initializer;
+            }
+        }
+        // String data or a view with no options or a string-digest encoding
+        // has a string result; every other form takes Node's checks at run
+        // time and returns the string or Buffer it produces.
+        if ((data.type.kind === "string" || data.type.kind === "bytes") &&
+            (options === undefined || isStringDigestEncoding(lowerer, options, true))) {
+            const encoding = options
+                ? lowerer.lowerExprExpecting(options, STRING)
+                : { kind: "strLit", value: "hex", type: STRING, loc };
             return {
                 kind: "libCall",
-                fn: "crypto.hashDigestStr",
-                args: [algorithm, data, encoding],
+                fn: data.type.kind === "string" ? "crypto.hashDigestStr" : "crypto.hashDigestBytes",
+                args: [algorithm, cryptoByteView(lowerer, args[1], data), encoding],
                 type: STRING,
                 loc,
             };
         }
-        if (data.type.kind === "bytes" && data.type.elem === "u8") {
+        return {
+            kind: "libCall",
+            fn: "crypto.hashOneshot",
+            args: [algorithm, lowerer.coerceInto(args[1], data, DYN), dynArg(lowerer, options, loc)],
+            type: DYN,
+            loc,
+        };
+    }
+    if (bi.member === "timingSafeEqual") {
+        if (args.length < 1 || args.length > 2 || args.some(ts.isSpreadElement))
+            lowerer.noLowering(`crypto.timingSafeEqual with ${args.length} arguments`, expr);
+        const left = lowerer.lowerExpr(args[0]);
+        const right = args[1] ? lowerer.lowerExpr(args[1]) : undefined;
+        // Views of every element kind compare their bytes; ArrayBuffers and
+        // other values take Node's checks at run time.
+        if (left.type.kind === "bytes" && right?.type.kind === "bytes") {
             return {
                 kind: "libCall",
-                fn: "crypto.hashDigestBytes",
-                args: [algorithm, data, encoding],
-                type: STRING,
+                fn: "crypto.timingSafeEqual",
+                args: [left, right],
+                type: BOOL,
                 loc,
             };
         }
-        lowerer.noLowering(`crypto.hash of '${lowerer.fmt(data.type)}' data`, args[1], "string and Buffer/Uint8Array data are supported");
-    }
-    if (bi.member === "timingSafeEqual") {
-        if (args.length !== 2)
-            lowerer.noLowering(`crypto.timingSafeEqual with ${args.length} arguments`, expr);
         return {
             kind: "libCall",
-            fn: "crypto.timingSafeEqual",
+            fn: "crypto.timingSafeEqualDyn",
             args: [
-                lowerer.lowerExprExpecting(args[0], BYTES_U8),
-                lowerer.lowerExprExpecting(args[1], BYTES_U8),
+                lowerer.coerceInto(args[0], left, DYN),
+                right ? lowerer.coerceInto(args[1], right, DYN) : dynUndefinedExpr(loc),
             ],
             type: BOOL,
             loc,
         };
     }
     if (bi.member === "randomFillSync") {
-        if (args.length < 1 || args.length > 3) {
+        if (args.length < 1 || args.length > 3 || args.some(ts.isSpreadElement)) {
             lowerer.noLowering(`crypto.randomFillSync with ${args.length} arguments`, expr, "randomFillSync(buffer[, offset[, size]]) is supported");
         }
-        const buffer = lowerer.lowerExprExpecting(args[0], BYTES_U8);
-        const offset = args[1]
-            ? lowerer.lowerExprExpecting(args[1], F64)
-            : { kind: "numLit", value: 0, type: F64, loc };
-        if (args[2]) {
-            const size = lowerer.lowerExprExpecting(args[2], F64);
+        const buffer = lowerer.lowerExpr(args[0]);
+        if (buffer.type.kind === "bytes" && cryptoNumberArgs(lowerer, args.slice(1))) {
+            // A view returns itself, at its own type.
+            const offset = args[1]
+                ? lowerer.lowerExprExpecting(args[1], F64)
+                : { kind: "numLit", value: 0, type: F64, loc };
+            if (args[2]) {
+                return {
+                    kind: "libCall",
+                    fn: "crypto.randomFillView",
+                    args: [buffer, offset, lowerer.lowerExprExpecting(args[2], F64)],
+                    type: buffer.type,
+                    loc,
+                };
+            }
             return {
                 kind: "libCall",
-                fn: "crypto.randomFill",
-                args: [buffer, offset, size],
-                type: BYTES_U8,
+                fn: "crypto.randomFillViewRest",
+                args: [buffer, offset],
+                type: buffer.type,
                 loc,
             };
         }
+        // ArrayBuffers and other values take Node's checks at run time.
         return {
             kind: "libCall",
-            fn: "crypto.randomFillRest",
-            args: [buffer, offset],
-            type: BYTES_U8,
+            fn: "crypto.randomFillSyncDyn",
+            args: [
+                lowerer.coerceInto(args[0], buffer, DYN),
+                dynArg(lowerer, args[1], loc),
+                dynArg(lowerer, args[2], loc),
+            ],
+            type: DYN,
+            loc,
+        };
+    }
+    if (bi.member === "randomFill") {
+        if (args.length < 2 || args.length > 4 || args.some(ts.isSpreadElement)) {
+            lowerer.noLowering(`crypto.randomFill with ${args.length} arguments`, expr, "randomFill(buffer[, offset[, size]], callback) is supported");
+        }
+        const form = { kind: "numLit", value: args.length - 1, type: F64, loc };
+        const buffer = lowerer.lowerExpr(args[0]);
+        if (buffer.type.kind === "bytes" && cryptoNumberArgs(lowerer, args.slice(1, -1))) {
+            const view = buffer.type;
+            const offset = args.length >= 3
+                ? lowerer.lowerExprExpecting(args[1], F64)
+                : { kind: "numLit", value: 0, type: F64, loc };
+            const size = args.length === 4
+                ? lowerer.lowerExprExpecting(args[2], F64)
+                : { kind: "numLit", value: 0, type: F64, loc };
+            const callback = errorFirstCallback(lowerer, args[args.length - 1], "crypto.randomFill", (value) => value.kind === "bytes" && value.elem === view.elem, "the buffer's own view");
+            return {
+                kind: "libCall",
+                fn: "crypto.randomFillCb",
+                args: [buffer, offset, size, form, callback],
+                type: VOID,
+                loc,
+            };
+        }
+        const callback = errorFirstCallback(lowerer, args[args.length - 1], "crypto.randomFill", () => false, "unknown-typed");
+        return {
+            kind: "libCall",
+            fn: "crypto.randomFillCbDyn",
+            args: [
+                lowerer.coerceInto(args[0], buffer, DYN),
+                args.length >= 3 ? lowerer.lowerExprExpecting(args[1], DYN) : dynUndefinedExpr(loc),
+                args.length === 4 ? lowerer.lowerExprExpecting(args[2], DYN) : dynUndefinedExpr(loc),
+                form,
+                callback,
+            ],
+            type: VOID,
             loc,
         };
     }
     if (bi.member === "randomInt") {
-        if (args.length !== 1 && args.length !== 2) {
-            lowerer.noLowering(`crypto.randomInt with ${args.length} arguments`, expr, "the synchronous randomInt(max) and randomInt(min, max) forms are supported");
+        if (args.length < 1 || args.length > 3 || args.some(ts.isSpreadElement)) {
+            lowerer.noLowering(`crypto.randomInt with ${args.length} arguments`, expr, "randomInt([min, ]max[, callback]) is supported");
         }
-        const min = args.length === 1
+        const last = args[args.length - 1];
+        const lastType = lowerer.mapTypeOf(lowerer.typeOf(last));
+        const withCallback = args.length === 3 || (args.length === 2 && lastType?.kind === "func");
+        const numbers = withCallback ? args.slice(0, -1) : args;
+        const min = numbers.length === 1
             ? { kind: "numLit", value: 0, type: F64, loc }
-            : lowerer.lowerExprExpecting(args[0], F64);
-        const max = lowerer.lowerExprExpecting(args[args.length - 1], F64);
-        return { kind: "libCall", fn: "crypto.randomInt", args: [min, max], type: F64, loc };
+            : lowerer.lowerExprExpecting(numbers[0], F64);
+        const max = lowerer.lowerExprExpecting(numbers[numbers.length - 1], F64);
+        if (!withCallback) {
+            if (numbers.length === 1)
+                return { kind: "libCall", fn: "crypto.randomIntMax", args: [max], type: F64, loc };
+            return { kind: "libCall", fn: "crypto.randomInt", args: [min, max], type: F64, loc };
+        }
+        const callback = errorFirstCallback(lowerer, last, "crypto.randomInt", (value) => value.kind === "f64", "number");
+        const minGiven = {
+            kind: "numLit",
+            value: numbers.length === 2 ? 1 : 0,
+            type: F64,
+            loc,
+        };
+        return {
+            kind: "libCall",
+            fn: "crypto.randomIntCb",
+            args: [min, max, minGiven, callback],
+            type: VOID,
+            loc,
+        };
+    }
+    if (bi.member === "randomUUID" && args.length > 0) {
+        if (args.length > 1 || args.some(ts.isSpreadElement))
+            lowerer.noLowering(`crypto.randomUUID with ${args.length} arguments`, expr, "randomUUID([options]) is supported");
+        return {
+            kind: "libCall",
+            fn: "crypto.randomUUIDOpts",
+            args: [dynArg(lowerer, args[0], loc)],
+            type: STRING,
+            loc,
+        };
+    }
+    if (bi.member === "createSecretKey") {
+        if (args.length < 1 || args.length > 2 || args.some(ts.isSpreadElement))
+            lowerer.noLowering(`crypto.createSecretKey with ${args.length} arguments`, expr, "createSecretKey(key[, encoding]) is supported");
+        return {
+            kind: "libCall",
+            fn: "crypto.createSecretKey",
+            args: [lowerer.lowerExprExpecting(args[0], DYN), dynArg(lowerer, args[1], loc)],
+            type: DYN,
+            loc,
+        };
+    }
+    if (bi.member === "generateKeySync") {
+        if (args.length < 1 || args.length > 2 || args.some(ts.isSpreadElement))
+            lowerer.noLowering(`crypto.generateKeySync with ${args.length} arguments`, expr, "generateKeySync(type, options) is supported");
+        return {
+            kind: "libCall",
+            fn: "crypto.generateKeySync",
+            args: [lowerer.lowerExprExpecting(args[0], DYN), dynArg(lowerer, args[1], loc)],
+            type: DYN,
+            loc,
+        };
+    }
+    if (bi.member === "generateKey") {
+        if (args.length < 1 || args.length > 3 || args.some(ts.isSpreadElement))
+            lowerer.noLowering(`crypto.generateKey with ${args.length} arguments`, expr, "generateKey(type, options, callback) is supported");
+        const isFunction = (node) => !!node && lowerer.mapTypeOf(lowerer.typeOf(node))?.kind === "func";
+        // Node takes a function in the options position as the callback, and
+        // checks the callback before the type and options.
+        const optionsNode = args.length === 2 && isFunction(args[1]) ? undefined : args[1];
+        const callbackNode = args.length === 2 && isFunction(args[1]) ? args[1] : args[2];
+        const callbackType = callbackNode ? lowerer.mapTypeOf(lowerer.typeOf(callbackNode)) : undefined;
+        const type = lowerer.lowerExprExpecting(args[0], DYN);
+        const options = dynArg(lowerer, optionsNode, loc);
+        if (callbackType?.kind !== "func" && callbackType?.kind !== "dyn") {
+            const got = callbackNode
+                ? lowerer.lowerExprExpecting(callbackNode, DYN)
+                : dynUndefinedExpr(loc);
+            return {
+                kind: "seqExpr",
+                stmts: [
+                    { kind: "exprStmt", expr: type, loc },
+                    { kind: "exprStmt", expr: options, loc },
+                ],
+                result: {
+                    kind: "libCall",
+                    fn: "error.argTypeThrow",
+                    args: [
+                        { kind: "strLit", value: "callback", type: STRING, loc },
+                        { kind: "strLit", value: "of type function", type: STRING, loc },
+                        got,
+                    ],
+                    type: VOID,
+                    loc,
+                },
+                type: VOID,
+                loc,
+            };
+        }
+        const callback = errorFirstCallback(lowerer, callbackNode, "crypto.generateKey", () => false, "KeyObject");
+        return {
+            kind: "libCall",
+            fn: "crypto.generateKeyCb",
+            args: [type, options, callback],
+            type: VOID,
+            loc,
+        };
+    }
+    if (bi.member === "randomUUIDv7") {
+        if (args.length > 1 || args.some(ts.isSpreadElement))
+            lowerer.noLowering(`crypto.randomUUIDv7 with ${args.length} arguments`, expr, "randomUUIDv7([options]) is supported");
+        return {
+            kind: "libCall",
+            fn: "crypto.randomUUIDv7",
+            args: [dynArg(lowerer, args[0], loc)],
+            type: STRING,
+            loc,
+        };
     }
     if (bi.member === "pbkdf2Sync") {
         if (args.length !== 5) {
@@ -365,7 +667,7 @@ export function lowerCryptoModuleCall(lowerer, expr, bi, loc) {
                 salt,
                 lowerer.lowerExprExpecting(args[2], F64),
                 lowerer.lowerExprExpecting(args[3], F64),
-                cryptoAlgorithm(lowerer, args[4], "crypto.pbkdf2Sync"),
+                cryptoAlgorithm(lowerer, args[4]),
             ],
             type: BYTES_U8,
             loc,
@@ -392,6 +694,89 @@ export function lowerCryptoModuleCall(lowerer, expr, bi, loc) {
         loc,
     };
 }
+/** The implemented cipher names and OpenSSL's aliases for them,
+ * lower-cased (scr_cipher.c's table). */
+const IMPLEMENTED_CIPHERS = new Set([
+    "aes-128-cbc",
+    "aes-192-cbc",
+    "aes-256-cbc",
+    "aes128",
+    "aes192",
+    "aes256",
+    "aes-128-ctr",
+    "aes-192-ctr",
+    "aes-256-ctr",
+    "aes-128-gcm",
+    "aes-192-gcm",
+    "aes-256-gcm",
+    "id-aes128-gcm",
+    "id-aes192-gcm",
+    "id-aes256-gcm",
+    "chacha20-poly1305",
+]);
+const SUPPORTED_CIPHERS_HINT = "the supported ciphers are aes-128-cbc, aes-192-cbc, aes-256-cbc, aes-128-ctr, aes-192-ctr, " +
+    "aes-256-ctr, aes-128-gcm, aes-192-gcm, aes-256-gcm, and chacha20-poly1305";
+/** A literal cipher name that Node knows but the runtime does not
+ * implement is refused at compile time. Unknown literal names keep Node's
+ * runtime ERR_CRYPTO_UNKNOWN_CIPHER. */
+function checkCipherName(lowerer, node, use) {
+    const type = lowerer.typeOf(node);
+    if (!type.isStringLiteralType())
+        return;
+    const name = type.value.toLowerCase();
+    if (IMPLEMENTED_CIPHERS.has(name) || !CRYPTO_CIPHERS.includes(name))
+        return;
+    lowerer.noLowering(`${use} with cipher '${type.value}'`, node, SUPPORTED_CIPHERS_HINT);
+}
+/** Whether a checker type is node:crypto's Cipheriv/Decipheriv family. */
+export function isCipherType(lowerer, type) {
+    const symbol = type.getAliasSymbol() ?? type.getSymbol();
+    return (!!symbol &&
+        CIPHER_TYPE_NAMES.has(symbol.name) &&
+        lowerer.checker.declarationsOf(symbol).some((d) => lowerer.isStdlibFile(d.getSourceFile())));
+}
+const CIPHER_METHODS = new Set([
+    "update",
+    "final",
+    "setAAD",
+    "setAutoPadding",
+    "getAuthTag",
+    "setAuthTag",
+]);
+/** V8's spelling of a callee in "is not a function" messages: call
+ * arguments render as "(...)". */
+function v8CalleeText(node) {
+    if (ts.isPropertyAccessExpression(node))
+        return `${v8CalleeText(node.expression)}.${node.name.text}`;
+    if (ts.isCallExpression(node))
+        return `${v8CalleeText(node.expression)}(...)`;
+    return node.getText();
+}
+/** Calls on native Cipheriv/Decipheriv handles dispatch through the
+ * handle's methods with checked-dynamic arguments. The stream.Transform
+ * members the classes inherit are refused. */
+export function lowerCipherMethodCall(lowerer, call, access) {
+    if (call.questionDotToken || access.questionDotToken)
+        return null;
+    if (!isCipherType(lowerer, lowerer.typeOf(access.expression)))
+        return null;
+    const name = access.name.text;
+    if (!CIPHER_METHODS.has(name)) {
+        lowerer.noLowering(`Cipheriv/Decipheriv.${name}`, call, "update(), final(), setAAD(), setAutoPadding(), getAuthTag(), and setAuthTag() are supported; cipher streams are not");
+    }
+    if (call.arguments.some(ts.isSpreadElement))
+        lowerer.noLowering(`Cipheriv/Decipheriv.${name} with spread arguments`, call);
+    const loc = locOf(call);
+    return {
+        kind: "dynInvoke",
+        recv: lowerer.lowerExprExpecting(access.expression, DYN),
+        method: name,
+        calleeName: v8CalleeText(access),
+        args: call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)),
+        type: DYN,
+        loc,
+    };
+}
 /** Calls on native crypto.Hash/Hmac handles. The handle survives locals,
  * aliases, loops, and returns; update() retains and returns the receiver,
  * digest() finalizes it, and Hash.copy() snapshots the incremental state. */
@@ -406,106 +791,126 @@ export function lowerCryptoHashMethodCall(lowerer, call, access) {
     const name = access.name.text;
     const loc = locOf(call);
     const receiver = () => lowerer.lowerExprExpecting(access.expression, receiverType);
+    const hash = receiverType.kind === "cryptoHash";
+    const label = hash ? "Hash" : "Hmac";
+    if (call.arguments.some(ts.isSpreadElement))
+        lowerer.noLowering(`${label}.${name} with spread arguments`, call);
     if (name === "update") {
-        if (call.arguments.length < 1 ||
-            call.arguments.length > 2 ||
-            call.arguments.some(ts.isSpreadElement)) {
-            lowerer.noLowering(`${receiverType.kind === "cryptoHash" ? "Hash" : "Hmac"}.update with ${call.arguments.length} arguments`, call, "update(stringOrBuffer[, inputEncoding]) is supported");
+        if (call.arguments.length < 1 || call.arguments.length > 2) {
+            lowerer.noLowering(`${label}.update with ${call.arguments.length} arguments`, call, "update(data[, inputEncoding]) is supported");
         }
+        const target = receiver();
         const dataNode = call.arguments[0];
+        const encodingNode = call.arguments[1];
         const dataType = lowerer.mapTypeOf(lowerer.typeOf(dataNode));
         // Indexed reads can retain optional storage after a nullish fallback
         // or narrowing. Use the proven argument type through a checked coercion.
         const data = dataType?.kind === "string" || dataType?.kind === "bytes"
             ? lowerer.lowerExprExpecting(dataNode, dataType)
             : lowerer.lowerExpr(dataNode);
-        const prefix = receiverType.kind === "cryptoHash" ? "crypto.hashUpdate" : "crypto.hmacUpdate";
-        if (data.type.kind === "bytes" && data.type.elem === "u8") {
-            if (call.arguments.length !== 1) {
-                lowerer.noLowering("Hash/Hmac.update with an encoding for Buffer data", call.arguments[1], "input encodings apply only to string data");
-            }
+        const prefix = hash ? "crypto.hashUpdate" : "crypto.hmacUpdate";
+        const encodingType = encodingNode ? lowerer.mapTypeOf(lowerer.typeOf(encodingNode)) : undefined;
+        if (data.type.kind === "bytes" && encodingNode === undefined) {
             return {
                 kind: "libCall",
                 fn: `${prefix}Bytes`,
-                args: [receiver(), data],
+                args: [target, cryptoByteView(lowerer, dataNode, data)],
                 type: receiverType,
                 loc,
             };
         }
         if (data.type.kind === "string") {
-            const encodingNode = call.arguments[1];
-            if (encodingNode === undefined) {
+            const literal = encodingNode ? stringLiteralValues(lowerer.typeOf(encodingNode)) : undefined;
+            const utf8 = encodingNode === undefined ||
+                (literal?.length === 1 && cryptoEncodingName(literal[0]) === "utf8");
+            if (utf8) {
+                if (encodingNode)
+                    lowerer.lowerExprExpecting(encodingNode, STRING);
                 return {
                     kind: "libCall",
                     fn: `${prefix}Str`,
-                    args: [receiver(), data],
+                    args: [target, data],
                     type: receiverType,
                     loc,
                 };
             }
-            const encodingType = lowerer.typeOf(encodingNode);
-            if (!encodingType.isStringLiteralType() ||
-                !["utf8", "utf-8", "hex", "base64"].includes(encodingType.value)) {
-                lowerer.noLowering("Hash/Hmac.update with this input encoding", encodingNode, "utf8, hex, and base64 string inputs are supported");
-            }
-            if (encodingType.value === "utf8" || encodingType.value === "utf-8") {
-                lowerer.lowerExprExpecting(encodingNode, STRING);
+            if (encodingType?.kind === "string") {
                 return {
                     kind: "libCall",
-                    fn: `${prefix}Str`,
-                    args: [receiver(), data],
+                    fn: `${prefix}Enc`,
+                    args: [target, data, lowerer.lowerExprExpecting(encodingNode, STRING)],
                     type: receiverType,
                     loc,
                 };
             }
-            const encoded = {
+        }
+        // Other data and encodings take Node's checks at run time: views and
+        // strings hash, anything else throws ERR_INVALID_ARG_TYPE.
+        return {
+            kind: "libCall",
+            fn: `${prefix}Dyn`,
+            args: [target, lowerer.coerceInto(dataNode, data, DYN), dynArg(lowerer, encodingNode, loc)],
+            type: receiverType,
+            loc,
+        };
+    }
+    if (name === "digest") {
+        if (call.arguments.length > 1) {
+            lowerer.noLowering(`${label}.digest with ${call.arguments.length} arguments`, call, "digest([outputEncoding]) is supported");
+        }
+        const encodingNode = call.arguments[0];
+        if (encodingNode === undefined) {
+            return {
                 kind: "libCall",
-                fn: "buffer.fromStr",
-                args: [data, lowerer.lowerExprExpecting(encodingNode, STRING)],
+                fn: hash ? "crypto.hashDigestBuffer" : "crypto.hmacDigestBuffer",
+                args: [receiver()],
                 type: BYTES_U8,
                 loc,
             };
+        }
+        if (isStringDigestEncoding(lowerer, encodingNode, false)) {
             return {
                 kind: "libCall",
-                fn: `${prefix}Bytes`,
-                args: [receiver(), encoded],
-                type: receiverType,
+                fn: hash ? "crypto.hashDigestString" : "crypto.hmacDigestString",
+                args: [receiver(), lowerer.lowerExprExpecting(encodingNode, STRING)],
+                type: STRING,
                 loc,
             };
         }
-        lowerer.noLowering(`Hash/Hmac.update of '${lowerer.fmt(data.type)}' values`, dataNode, "string and Buffer/Uint8Array inputs are supported");
-    }
-    if (name === "digest") {
-        if (call.arguments.length > 1 || call.arguments.some(ts.isSpreadElement)) {
-            lowerer.noLowering(`${receiverType.kind === "cryptoHash" ? "Hash" : "Hmac"}.digest with ${call.arguments.length} arguments`, call, 'digest() and digest("hex" | "base64") are supported');
+        // Node returns a Buffer for a falsy or unknown encoding. A literal
+        // whose Buffer result the declared string type cannot hold is refused.
+        const literal = stringLiteralValues(lowerer.typeOf(encodingNode));
+        const declared = lowerer.mapTypeOf(lowerer.typeOf(call));
+        if (literal && declared?.kind === "string") {
+            lowerer.noLowering(`${label}.digest with encoding '${literal.join("' | '")}'`, encodingNode, "Node returns a Buffer for this encoding, and the call's declared type is string");
         }
-        if (call.arguments.length === 0) {
+        return {
+            kind: "libCall",
+            fn: hash ? "crypto.hashDigestDyn" : "crypto.hmacDigestDyn",
+            args: [receiver(), lowerer.lowerExprExpecting(encodingNode, DYN)],
+            type: DYN,
+            loc,
+        };
+    }
+    if (name === "copy" && hash) {
+        if (call.arguments.length > 1)
+            lowerer.noLowering(`Hash.copy with ${call.arguments.length} arguments`, call, "copy([options]) is supported");
+        if (call.arguments.length === 0)
             return {
                 kind: "libCall",
-                fn: receiverType.kind === "cryptoHash"
-                    ? "crypto.hashDigestBuffer"
-                    : "crypto.hmacDigestBuffer",
+                fn: "crypto.hashCopy",
                 args: [receiver()],
-                type: BYTES_U8,
+                type: CRYPTOHASH_T,
                 loc,
             };
-        }
         return {
             kind: "libCall",
-            fn: receiverType.kind === "cryptoHash" ? "crypto.hashDigestString" : "crypto.hmacDigestString",
-            args: [
-                receiver(),
-                cryptoEncoding(lowerer, call.arguments[0], `${receiverType.kind === "cryptoHash" ? "Hash" : "Hmac"}.digest`),
-            ],
-            type: STRING,
+            fn: "crypto.hashCopyOpts",
+            args: [receiver(), lowerer.lowerExprExpecting(call.arguments[0], DYN)],
+            type: CRYPTOHASH_T,
             loc,
         };
     }
-    if (name === "copy" && receiverType.kind === "cryptoHash") {
-        if (call.arguments.length !== 0)
-            lowerer.noLowering(`Hash.copy with ${call.arguments.length} arguments`, call, "copy() without options is supported");
-        return { kind: "libCall", fn: "crypto.hashCopy", args: [receiver()], type: CRYPTOHASH_T, loc };
-    }
     lowerer.noLowering(`${receiverType.kind === "cryptoHash" ? "Hash" : "Hmac"}.${name}`, call, receiverType.kind === "cryptoHash"
         ? "update(), digest(), and copy() are supported"
         : "update() and digest() are supported", lowerer.checker.getSymbolAtLocation(access.name));