@yielded/crypto 0.0.0-stage → 0.1.0-beta.20

package/dist/internal/xchacha-core.mjs

@@ -0,0 +1,285 @@
+import { Poly1305 } from "./poly1305.mjs";
+//#region src/internal/xchacha-core.ts
+/**
+* Adapted from noble-ciphers, Copyright (c) 2022 Paul Miller.
+* MIT; source revision 785181b0772ba84afbe812025714163e4e48262f.
+* Poly1305 arithmetic derives from the public-domain poly1305-donna implementation.
+* See ../../THIRD_PARTY_NOTICES.md for source mapping and licenses.
+*/
+const rotl = (word, shift) => word << shift | word >>> 32 - shift;
+function chachaCore(s, k, n, out, cnt, rounds = 20) {
+	let y00 = s[0], y01 = s[1], y02 = s[2], y03 = s[3], y04 = k[0], y05 = k[1], y06 = k[2], y07 = k[3], y08 = k[4], y09 = k[5], y10 = k[6], y11 = k[7], y12 = cnt, y13 = n[0], y14 = n[1], y15 = n[2];
+	let x00 = y00, x01 = y01, x02 = y02, x03 = y03, x04 = y04, x05 = y05, x06 = y06, x07 = y07, x08 = y08, x09 = y09, x10 = y10, x11 = y11, x12 = y12, x13 = y13, x14 = y14, x15 = y15;
+	for (let r = 0; r < rounds; r += 2) {
+		x00 = x00 + x04 | 0;
+		x12 = rotl(x12 ^ x00, 16);
+		x08 = x08 + x12 | 0;
+		x04 = rotl(x04 ^ x08, 12);
+		x00 = x00 + x04 | 0;
+		x12 = rotl(x12 ^ x00, 8);
+		x08 = x08 + x12 | 0;
+		x04 = rotl(x04 ^ x08, 7);
+		x01 = x01 + x05 | 0;
+		x13 = rotl(x13 ^ x01, 16);
+		x09 = x09 + x13 | 0;
+		x05 = rotl(x05 ^ x09, 12);
+		x01 = x01 + x05 | 0;
+		x13 = rotl(x13 ^ x01, 8);
+		x09 = x09 + x13 | 0;
+		x05 = rotl(x05 ^ x09, 7);
+		x02 = x02 + x06 | 0;
+		x14 = rotl(x14 ^ x02, 16);
+		x10 = x10 + x14 | 0;
+		x06 = rotl(x06 ^ x10, 12);
+		x02 = x02 + x06 | 0;
+		x14 = rotl(x14 ^ x02, 8);
+		x10 = x10 + x14 | 0;
+		x06 = rotl(x06 ^ x10, 7);
+		x03 = x03 + x07 | 0;
+		x15 = rotl(x15 ^ x03, 16);
+		x11 = x11 + x15 | 0;
+		x07 = rotl(x07 ^ x11, 12);
+		x03 = x03 + x07 | 0;
+		x15 = rotl(x15 ^ x03, 8);
+		x11 = x11 + x15 | 0;
+		x07 = rotl(x07 ^ x11, 7);
+		x00 = x00 + x05 | 0;
+		x15 = rotl(x15 ^ x00, 16);
+		x10 = x10 + x15 | 0;
+		x05 = rotl(x05 ^ x10, 12);
+		x00 = x00 + x05 | 0;
+		x15 = rotl(x15 ^ x00, 8);
+		x10 = x10 + x15 | 0;
+		x05 = rotl(x05 ^ x10, 7);
+		x01 = x01 + x06 | 0;
+		x12 = rotl(x12 ^ x01, 16);
+		x11 = x11 + x12 | 0;
+		x06 = rotl(x06 ^ x11, 12);
+		x01 = x01 + x06 | 0;
+		x12 = rotl(x12 ^ x01, 8);
+		x11 = x11 + x12 | 0;
+		x06 = rotl(x06 ^ x11, 7);
+		x02 = x02 + x07 | 0;
+		x13 = rotl(x13 ^ x02, 16);
+		x08 = x08 + x13 | 0;
+		x07 = rotl(x07 ^ x08, 12);
+		x02 = x02 + x07 | 0;
+		x13 = rotl(x13 ^ x02, 8);
+		x08 = x08 + x13 | 0;
+		x07 = rotl(x07 ^ x08, 7);
+		x03 = x03 + x04 | 0;
+		x14 = rotl(x14 ^ x03, 16);
+		x09 = x09 + x14 | 0;
+		x04 = rotl(x04 ^ x09, 12);
+		x03 = x03 + x04 | 0;
+		x14 = rotl(x14 ^ x03, 8);
+		x09 = x09 + x14 | 0;
+		x04 = rotl(x04 ^ x09, 7);
+	}
+	let oi = 0;
+	out[oi++] = y00 + x00 | 0;
+	out[oi++] = y01 + x01 | 0;
+	out[oi++] = y02 + x02 | 0;
+	out[oi++] = y03 + x03 | 0;
+	out[oi++] = y04 + x04 | 0;
+	out[oi++] = y05 + x05 | 0;
+	out[oi++] = y06 + x06 | 0;
+	out[oi++] = y07 + x07 | 0;
+	out[oi++] = y08 + x08 | 0;
+	out[oi++] = y09 + x09 | 0;
+	out[oi++] = y10 + x10 | 0;
+	out[oi++] = y11 + x11 | 0;
+	out[oi++] = y12 + x12 | 0;
+	out[oi++] = y13 + x13 | 0;
+	out[oi++] = y14 + x14 | 0;
+	out[oi++] = y15 + x15 | 0;
+}
+/**
+* hchacha hashes key and nonce into key' and nonce' for xchacha20.
+*/
+function hchacha(s, k, i, out) {
+	let x00 = s[0], x01 = s[1], x02 = s[2], x03 = s[3], x04 = k[0], x05 = k[1], x06 = k[2], x07 = k[3], x08 = k[4], x09 = k[5], x10 = k[6], x11 = k[7], x12 = i[0], x13 = i[1], x14 = i[2], x15 = i[3];
+	for (let r = 0; r < 20; r += 2) {
+		x00 = x00 + x04 | 0;
+		x12 = rotl(x12 ^ x00, 16);
+		x08 = x08 + x12 | 0;
+		x04 = rotl(x04 ^ x08, 12);
+		x00 = x00 + x04 | 0;
+		x12 = rotl(x12 ^ x00, 8);
+		x08 = x08 + x12 | 0;
+		x04 = rotl(x04 ^ x08, 7);
+		x01 = x01 + x05 | 0;
+		x13 = rotl(x13 ^ x01, 16);
+		x09 = x09 + x13 | 0;
+		x05 = rotl(x05 ^ x09, 12);
+		x01 = x01 + x05 | 0;
+		x13 = rotl(x13 ^ x01, 8);
+		x09 = x09 + x13 | 0;
+		x05 = rotl(x05 ^ x09, 7);
+		x02 = x02 + x06 | 0;
+		x14 = rotl(x14 ^ x02, 16);
+		x10 = x10 + x14 | 0;
+		x06 = rotl(x06 ^ x10, 12);
+		x02 = x02 + x06 | 0;
+		x14 = rotl(x14 ^ x02, 8);
+		x10 = x10 + x14 | 0;
+		x06 = rotl(x06 ^ x10, 7);
+		x03 = x03 + x07 | 0;
+		x15 = rotl(x15 ^ x03, 16);
+		x11 = x11 + x15 | 0;
+		x07 = rotl(x07 ^ x11, 12);
+		x03 = x03 + x07 | 0;
+		x15 = rotl(x15 ^ x03, 8);
+		x11 = x11 + x15 | 0;
+		x07 = rotl(x07 ^ x11, 7);
+		x00 = x00 + x05 | 0;
+		x15 = rotl(x15 ^ x00, 16);
+		x10 = x10 + x15 | 0;
+		x05 = rotl(x05 ^ x10, 12);
+		x00 = x00 + x05 | 0;
+		x15 = rotl(x15 ^ x00, 8);
+		x10 = x10 + x15 | 0;
+		x05 = rotl(x05 ^ x10, 7);
+		x01 = x01 + x06 | 0;
+		x12 = rotl(x12 ^ x01, 16);
+		x11 = x11 + x12 | 0;
+		x06 = rotl(x06 ^ x11, 12);
+		x01 = x01 + x06 | 0;
+		x12 = rotl(x12 ^ x01, 8);
+		x11 = x11 + x12 | 0;
+		x06 = rotl(x06 ^ x11, 7);
+		x02 = x02 + x07 | 0;
+		x13 = rotl(x13 ^ x02, 16);
+		x08 = x08 + x13 | 0;
+		x07 = rotl(x07 ^ x08, 12);
+		x02 = x02 + x07 | 0;
+		x13 = rotl(x13 ^ x02, 8);
+		x08 = x08 + x13 | 0;
+		x07 = rotl(x07 ^ x08, 7);
+		x03 = x03 + x04 | 0;
+		x14 = rotl(x14 ^ x03, 16);
+		x09 = x09 + x14 | 0;
+		x04 = rotl(x04 ^ x09, 12);
+		x03 = x03 + x04 | 0;
+		x14 = rotl(x14 ^ x03, 8);
+		x09 = x09 + x14 | 0;
+		x04 = rotl(x04 ^ x09, 7);
+	}
+	let oi = 0;
+	out[oi++] = x00;
+	out[oi++] = x01;
+	out[oi++] = x02;
+	out[oi++] = x03;
+	out[oi++] = x12;
+	out[oi++] = x13;
+	out[oi++] = x14;
+	out[oi++] = x15;
+}
+const sigma = Uint32Array.from([
+	1634760805,
+	857760878,
+	2036477234,
+	1797285236
+]);
+const padding = /* @__PURE__ */ new Uint8Array(16);
+const readWords = (data, words) => {
+	const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+	for (let i = 0; i < words.length; i++) words[i] = view.getUint32(i * 4, true);
+};
+function withState(key, nonce, operation) {
+	const original = /* @__PURE__ */ new Uint32Array(8);
+	const extendedNonce = /* @__PURE__ */ new Uint32Array(4);
+	const state = {
+		key: /* @__PURE__ */ new Uint32Array(8),
+		nonce: /* @__PURE__ */ new Uint32Array(3),
+		words: /* @__PURE__ */ new Uint32Array(16),
+		stream: /* @__PURE__ */ new Uint8Array(64)
+	};
+	try {
+		readWords(key, original);
+		readWords(nonce.subarray(0, 16), extendedNonce);
+		hchacha(sigma, original, extendedNonce, state.key);
+		const view = new DataView(nonce.buffer, nonce.byteOffset, nonce.byteLength);
+		state.nonce[1] = view.getUint32(16, true);
+		state.nonce[2] = view.getUint32(20, true);
+		return operation(state);
+	} finally {
+		original.fill(0);
+		extendedNonce.fill(0);
+		state.key.fill(0);
+		state.nonce.fill(0);
+		state.words.fill(0);
+		state.stream.fill(0);
+	}
+}
+const blockAt = (state, counter) => {
+	chachaCore(sigma, state.key, state.nonce, state.words, counter);
+	const view = new DataView(state.stream.buffer, state.stream.byteOffset, state.stream.byteLength);
+	for (let i = 0; i < 16; i++) view.setUint32(i * 4, state.words[i], true);
+};
+const xor = (state, data, out) => {
+	for (let offset = 0, counter = 1; offset < data.length; offset += 64, counter++) {
+		blockAt(state, counter);
+		const length = Math.min(64, data.length - offset);
+		for (let i = 0; i < length; i++) out[offset + i] = data[offset + i] ^ state.stream[i];
+	}
+};
+const padded = (mac, data) => {
+	mac.update(data);
+	const remainder = data.length % 16;
+	if (remainder !== 0) mac.update(padding.subarray(remainder));
+};
+const tag = (state, ciphertext, additionalData) => {
+	const lengths = /* @__PURE__ */ new Uint8Array(16);
+	const view = new DataView(lengths.buffer);
+	view.setUint32(0, additionalData.length >>> 0, true);
+	view.setUint32(4, Math.floor(additionalData.length / 4294967296), true);
+	view.setUint32(8, ciphertext.length >>> 0, true);
+	view.setUint32(12, Math.floor(ciphertext.length / 4294967296), true);
+	blockAt(state, 0);
+	const mac = new Poly1305(state.stream.subarray(0, 32));
+	try {
+		padded(mac, additionalData);
+		padded(mac, ciphertext);
+		return mac.update(lengths).digest();
+	} finally {
+		mac.destroy();
+		lengths.fill(0);
+		state.stream.fill(0);
+	}
+};
+const encrypt = (key, nonce, additionalData, plaintext) => withState(key, nonce, (state) => {
+	const out = new Uint8Array(plaintext.length + 16);
+	const ciphertext = out.subarray(0, plaintext.length);
+	try {
+		xor(state, plaintext, ciphertext);
+		const authentication = tag(state, ciphertext, additionalData);
+		out.set(authentication, plaintext.length);
+		authentication.fill(0);
+		return out;
+	} catch (error) {
+		out.fill(0);
+		throw error;
+	}
+});
+/** Authenticate the complete input before allocating or producing plaintext. */
+const decrypt = (key, nonce, additionalData, sealed) => withState(key, nonce, (state) => {
+	const ciphertext = sealed.subarray(0, -16);
+	const authentication = tag(state, ciphertext, additionalData);
+	let difference = 0;
+	for (let i = 0; i < 16; i++) difference |= authentication[i] ^ sealed[ciphertext.length + i];
+	authentication.fill(0);
+	if (difference !== 0) return void 0;
+	const out = new Uint8Array(ciphertext.length);
+	try {
+		xor(state, ciphertext, out);
+		return out;
+	} catch (error) {
+		out.fill(0);
+		throw error;
+	}
+});
+//#endregion
+export { decrypt, encrypt };
+
+//# sourceMappingURL=xchacha-core.mjs.map

package/dist/internal/xchacha-core.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"xchacha-core.mjs","names":[],"sources":["../../src/internal/xchacha-core.ts"],"sourcesContent":["/**\n * Adapted from noble-ciphers, Copyright (c) 2022 Paul Miller.\n * MIT; source revision 785181b0772ba84afbe812025714163e4e48262f.\n * Poly1305 arithmetic derives from the public-domain poly1305-donna implementation.\n * See ../../THIRD_PARTY_NOTICES.md for source mapping and licenses.\n */\nimport { Poly1305 } from \"./poly1305\";\n\nconst rotl = (word: number, shift: number): number => (word << shift) | (word >>> (32 - shift));\n\nfunction chachaCore(\n  s: Uint32Array,\n  k: Uint32Array,\n  n: Uint32Array,\n  out: Uint32Array,\n  cnt: number,\n  rounds = 20,\n): void {\n  let y00 = s[0],\n    y01 = s[1],\n    y02 = s[2],\n    y03 = s[3], // \"expa\"   \"nd 3\"  \"2-by\"  \"te k\"\n    y04 = k[0],\n    y05 = k[1],\n    y06 = k[2],\n    y07 = k[3], // Key      Key     Key     Key\n    y08 = k[4],\n    y09 = k[5],\n    y10 = k[6],\n    y11 = k[7], // Key      Key     Key     Key\n    y12 = cnt,\n    y13 = n[0],\n    y14 = n[1],\n    y15 = n[2]; // Counter  Counter\tNonce   Nonce\n\n  // Save state to temporary variables\n  let x00 = y00,\n    x01 = y01,\n    x02 = y02,\n    x03 = y03,\n    x04 = y04,\n    x05 = y05,\n    x06 = y06,\n    x07 = y07,\n    x08 = y08,\n    x09 = y09,\n    x10 = y10,\n    x11 = y11,\n    x12 = y12,\n    x13 = y13,\n    x14 = y14,\n    x15 = y15;\n\n  for (let r = 0; r < rounds; r += 2) {\n    x00 = (x00 + x04) | 0;\n    x12 = rotl(x12 ^ x00, 16);\n    x08 = (x08 + x12) | 0;\n    x04 = rotl(x04 ^ x08, 12);\n    x00 = (x00 + x04) | 0;\n    x12 = rotl(x12 ^ x00, 8);\n    x08 = (x08 + x12) | 0;\n    x04 = rotl(x04 ^ x08, 7);\n\n    x01 = (x01 + x05) | 0;\n    x13 = rotl(x13 ^ x01, 16);\n    x09 = (x09 + x13) | 0;\n    x05 = rotl(x05 ^ x09, 12);\n    x01 = (x01 + x05) | 0;\n    x13 = rotl(x13 ^ x01, 8);\n    x09 = (x09 + x13) | 0;\n    x05 = rotl(x05 ^ x09, 7);\n\n    x02 = (x02 + x06) | 0;\n    x14 = rotl(x14 ^ x02, 16);\n    x10 = (x10 + x14) | 0;\n    x06 = rotl(x06 ^ x10, 12);\n    x02 = (x02 + x06) | 0;\n    x14 = rotl(x14 ^ x02, 8);\n    x10 = (x10 + x14) | 0;\n    x06 = rotl(x06 ^ x10, 7);\n\n    x03 = (x03 + x07) | 0;\n    x15 = rotl(x15 ^ x03, 16);\n    x11 = (x11 + x15) | 0;\n    x07 = rotl(x07 ^ x11, 12);\n    x03 = (x03 + x07) | 0;\n    x15 = rotl(x15 ^ x03, 8);\n    x11 = (x11 + x15) | 0;\n    x07 = rotl(x07 ^ x11, 7);\n\n    x00 = (x00 + x05) | 0;\n    x15 = rotl(x15 ^ x00, 16);\n    x10 = (x10 + x15) | 0;\n    x05 = rotl(x05 ^ x10, 12);\n    x00 = (x00 + x05) | 0;\n    x15 = rotl(x15 ^ x00, 8);\n    x10 = (x10 + x15) | 0;\n    x05 = rotl(x05 ^ x10, 7);\n\n    x01 = (x01 + x06) | 0;\n    x12 = rotl(x12 ^ x01, 16);\n    x11 = (x11 + x12) | 0;\n    x06 = rotl(x06 ^ x11, 12);\n    x01 = (x01 + x06) | 0;\n    x12 = rotl(x12 ^ x01, 8);\n    x11 = (x11 + x12) | 0;\n    x06 = rotl(x06 ^ x11, 7);\n\n    x02 = (x02 + x07) | 0;\n    x13 = rotl(x13 ^ x02, 16);\n    x08 = (x08 + x13) | 0;\n    x07 = rotl(x07 ^ x08, 12);\n    x02 = (x02 + x07) | 0;\n    x13 = rotl(x13 ^ x02, 8);\n    x08 = (x08 + x13) | 0;\n    x07 = rotl(x07 ^ x08, 7);\n\n    x03 = (x03 + x04) | 0;\n    x14 = rotl(x14 ^ x03, 16);\n    x09 = (x09 + x14) | 0;\n    x04 = rotl(x04 ^ x09, 12);\n    x03 = (x03 + x04) | 0;\n    x14 = rotl(x14 ^ x03, 8);\n    x09 = (x09 + x14) | 0;\n    x04 = rotl(x04 ^ x09, 7);\n  }\n  // Write output\n  let oi = 0;\n\n  out[oi++] = (y00 + x00) | 0;\n  out[oi++] = (y01 + x01) | 0;\n  out[oi++] = (y02 + x02) | 0;\n  out[oi++] = (y03 + x03) | 0;\n  out[oi++] = (y04 + x04) | 0;\n  out[oi++] = (y05 + x05) | 0;\n  out[oi++] = (y06 + x06) | 0;\n  out[oi++] = (y07 + x07) | 0;\n  out[oi++] = (y08 + x08) | 0;\n  out[oi++] = (y09 + x09) | 0;\n  out[oi++] = (y10 + x10) | 0;\n  out[oi++] = (y11 + x11) | 0;\n  out[oi++] = (y12 + x12) | 0;\n  out[oi++] = (y13 + x13) | 0;\n  out[oi++] = (y14 + x14) | 0;\n  out[oi++] = (y15 + x15) | 0;\n}\n/**\n * hchacha hashes key and nonce into key' and nonce' for xchacha20.\n */\nfunction hchacha(s: Uint32Array, k: Uint32Array, i: Uint32Array, out: Uint32Array): void {\n  let x00 = s[0],\n    x01 = s[1],\n    x02 = s[2],\n    x03 = s[3],\n    x04 = k[0],\n    x05 = k[1],\n    x06 = k[2],\n    x07 = k[3],\n    x08 = k[4],\n    x09 = k[5],\n    x10 = k[6],\n    x11 = k[7],\n    x12 = i[0],\n    x13 = i[1],\n    x14 = i[2],\n    x15 = i[3];\n\n  for (let r = 0; r < 20; r += 2) {\n    x00 = (x00 + x04) | 0;\n    x12 = rotl(x12 ^ x00, 16);\n    x08 = (x08 + x12) | 0;\n    x04 = rotl(x04 ^ x08, 12);\n    x00 = (x00 + x04) | 0;\n    x12 = rotl(x12 ^ x00, 8);\n    x08 = (x08 + x12) | 0;\n    x04 = rotl(x04 ^ x08, 7);\n\n    x01 = (x01 + x05) | 0;\n    x13 = rotl(x13 ^ x01, 16);\n    x09 = (x09 + x13) | 0;\n    x05 = rotl(x05 ^ x09, 12);\n    x01 = (x01 + x05) | 0;\n    x13 = rotl(x13 ^ x01, 8);\n    x09 = (x09 + x13) | 0;\n    x05 = rotl(x05 ^ x09, 7);\n\n    x02 = (x02 + x06) | 0;\n    x14 = rotl(x14 ^ x02, 16);\n    x10 = (x10 + x14) | 0;\n    x06 = rotl(x06 ^ x10, 12);\n    x02 = (x02 + x06) | 0;\n    x14 = rotl(x14 ^ x02, 8);\n    x10 = (x10 + x14) | 0;\n    x06 = rotl(x06 ^ x10, 7);\n\n    x03 = (x03 + x07) | 0;\n    x15 = rotl(x15 ^ x03, 16);\n    x11 = (x11 + x15) | 0;\n    x07 = rotl(x07 ^ x11, 12);\n    x03 = (x03 + x07) | 0;\n    x15 = rotl(x15 ^ x03, 8);\n    x11 = (x11 + x15) | 0;\n    x07 = rotl(x07 ^ x11, 7);\n\n    x00 = (x00 + x05) | 0;\n    x15 = rotl(x15 ^ x00, 16);\n    x10 = (x10 + x15) | 0;\n    x05 = rotl(x05 ^ x10, 12);\n    x00 = (x00 + x05) | 0;\n    x15 = rotl(x15 ^ x00, 8);\n    x10 = (x10 + x15) | 0;\n    x05 = rotl(x05 ^ x10, 7);\n\n    x01 = (x01 + x06) | 0;\n    x12 = rotl(x12 ^ x01, 16);\n    x11 = (x11 + x12) | 0;\n    x06 = rotl(x06 ^ x11, 12);\n    x01 = (x01 + x06) | 0;\n    x12 = rotl(x12 ^ x01, 8);\n    x11 = (x11 + x12) | 0;\n    x06 = rotl(x06 ^ x11, 7);\n\n    x02 = (x02 + x07) | 0;\n    x13 = rotl(x13 ^ x02, 16);\n    x08 = (x08 + x13) | 0;\n    x07 = rotl(x07 ^ x08, 12);\n    x02 = (x02 + x07) | 0;\n    x13 = rotl(x13 ^ x02, 8);\n    x08 = (x08 + x13) | 0;\n    x07 = rotl(x07 ^ x08, 7);\n\n    x03 = (x03 + x04) | 0;\n    x14 = rotl(x14 ^ x03, 16);\n    x09 = (x09 + x14) | 0;\n    x04 = rotl(x04 ^ x09, 12);\n    x03 = (x03 + x04) | 0;\n    x14 = rotl(x14 ^ x03, 8);\n    x09 = (x09 + x14) | 0;\n    x04 = rotl(x04 ^ x09, 7);\n  }\n  let oi = 0;\n\n  out[oi++] = x00;\n  out[oi++] = x01;\n  out[oi++] = x02;\n  out[oi++] = x03;\n  out[oi++] = x12;\n  out[oi++] = x13;\n  out[oi++] = x14;\n  out[oi++] = x15;\n}\n\nconst sigma = Uint32Array.from([0x61707865, 0x3320646e, 0x79622d32, 0x6b206574]);\nconst padding = new Uint8Array(16);\n\ninterface State {\n  readonly key: Uint32Array;\n  readonly nonce: Uint32Array;\n  readonly words: Uint32Array;\n  readonly stream: Uint8Array;\n}\n\nconst readWords = (data: Uint8Array, words: Uint32Array): void => {\n  const view = new DataView(data.buffer, data.byteOffset, data.byteLength);\n\n  for (let i = 0; i < words.length; i++) words[i] = view.getUint32(i * 4, true);\n};\n\nfunction withState<A>(key: Uint8Array, nonce: Uint8Array, operation: (state: State) => A): A {\n  const original = new Uint32Array(8);\n  const extendedNonce = new Uint32Array(4);\n\n  const state: State = {\n    key: new Uint32Array(8),\n    nonce: new Uint32Array(3),\n    words: new Uint32Array(16),\n    stream: new Uint8Array(64),\n  };\n\n  try {\n    readWords(key, original);\n    readWords(nonce.subarray(0, 16), extendedNonce);\n    hchacha(sigma, original, extendedNonce, state.key);\n    // XChaCha uses HChaCha(key, nonce[0..16]), then 0 || nonce[16..24].\n    const view = new DataView(nonce.buffer, nonce.byteOffset, nonce.byteLength);\n\n    state.nonce[1] = view.getUint32(16, true);\n    state.nonce[2] = view.getUint32(20, true);\n\n    return operation(state);\n  } finally {\n    original.fill(0);\n    extendedNonce.fill(0);\n    state.key.fill(0);\n    state.nonce.fill(0);\n    state.words.fill(0);\n    state.stream.fill(0);\n  }\n}\n\nconst blockAt = (state: State, counter: number): void => {\n  chachaCore(sigma, state.key, state.nonce, state.words, counter);\n  const view = new DataView(state.stream.buffer, state.stream.byteOffset, state.stream.byteLength);\n\n  for (let i = 0; i < 16; i++) view.setUint32(i * 4, state.words[i], true);\n};\n\nconst xor = (state: State, data: Uint8Array, out: Uint8Array): void => {\n  for (let offset = 0, counter = 1; offset < data.length; offset += 64, counter++) {\n    blockAt(state, counter);\n    const length = Math.min(64, data.length - offset);\n\n    for (let i = 0; i < length; i++) out[offset + i] = data[offset + i] ^ state.stream[i];\n  }\n};\n\nconst padded = (mac: Poly1305, data: Uint8Array): void => {\n  mac.update(data);\n  const remainder = data.length % 16;\n\n  if (remainder !== 0) mac.update(padding.subarray(remainder));\n};\n\nconst tag = (state: State, ciphertext: Uint8Array, additionalData: Uint8Array): Uint8Array => {\n  const lengths = new Uint8Array(16);\n  const view = new DataView(lengths.buffer);\n\n  // RFC 8439 authenticates little-endian 64-bit byte lengths, AAD first.\n  view.setUint32(0, additionalData.length >>> 0, true);\n  view.setUint32(4, Math.floor(additionalData.length / 0x100000000), true);\n  view.setUint32(8, ciphertext.length >>> 0, true);\n  view.setUint32(12, Math.floor(ciphertext.length / 0x100000000), true);\n  blockAt(state, 0);\n  const mac = new Poly1305(state.stream.subarray(0, 32));\n\n  try {\n    padded(mac, additionalData);\n    padded(mac, ciphertext);\n\n    return mac.update(lengths).digest();\n  } finally {\n    mac.destroy();\n    lengths.fill(0);\n    state.stream.fill(0);\n  }\n};\n\nexport const encrypt = (\n  key: Uint8Array,\n  nonce: Uint8Array,\n  additionalData: Uint8Array,\n  plaintext: Uint8Array,\n): Uint8Array =>\n  withState(key, nonce, (state) => {\n    const out = new Uint8Array(plaintext.length + 16);\n    const ciphertext = out.subarray(0, plaintext.length);\n\n    try {\n      xor(state, plaintext, ciphertext);\n      const authentication = tag(state, ciphertext, additionalData);\n\n      out.set(authentication, plaintext.length);\n      authentication.fill(0);\n\n      return out;\n    } catch (error) {\n      out.fill(0);\n      throw error;\n    }\n  });\n\n/** Authenticate the complete input before allocating or producing plaintext. */\nexport const decrypt = (\n  key: Uint8Array,\n  nonce: Uint8Array,\n  additionalData: Uint8Array,\n  sealed: Uint8Array,\n): Uint8Array | undefined =>\n  withState(key, nonce, (state) => {\n    const ciphertext = sealed.subarray(0, -16);\n    const authentication = tag(state, ciphertext, additionalData);\n    let difference = 0;\n\n    for (let i = 0; i < 16; i++) difference |= authentication[i] ^ sealed[ciphertext.length + i];\n    authentication.fill(0);\n    if (difference !== 0) return undefined;\n    const out = new Uint8Array(ciphertext.length);\n\n    try {\n      xor(state, ciphertext, out);\n\n      return out;\n    } catch (error) {\n      out.fill(0);\n      throw error;\n    }\n  });\n"],"mappings":";;;;;;;;AAQA,MAAM,QAAQ,MAAc,UAA2B,QAAQ,QAAU,SAAU,KAAK;AAExF,SAAS,WACP,GACA,GACA,GACA,KACA,KACA,SAAS,IACH;CACN,IAAI,MAAM,EAAE,IACV,MAAM,EAAE,IACR,MAAM,EAAE,IACR,MAAM,EAAE,IACR,MAAM,EAAE,IACR,MAAM,EAAE,IACR,MAAM,EAAE,IACR,MAAM,EAAE,IACR,MAAM,EAAE,IACR,MAAM,EAAE,IACR,MAAM,EAAE,IACR,MAAM,EAAE,IACR,MAAM,KACN,MAAM,EAAE,IACR,MAAM,EAAE,IACR,MAAM,EAAE;CAGV,IAAI,MAAM,KACR,MAAM,KACN,MAAM,KACN,MAAM,KACN,MAAM,KACN,MAAM,KACN,MAAM,KACN,MAAM,KACN,MAAM,KACN,MAAM,KACN,MAAM,KACN,MAAM,KACN,MAAM,KACN,MAAM,KACN,MAAM,KACN,MAAM;CAER,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,KAAK,GAAG;EAClC,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EACvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EAEvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EACvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EAEvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EACvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EAEvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EACvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EAEvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EACvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EAEvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EACvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EAEvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EACvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EAEvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EACvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;CACzB;CAEA,IAAI,KAAK;CAET,IAAI,QAAS,MAAM,MAAO;CAC1B,IAAI,QAAS,MAAM,MAAO;CAC1B,IAAI,QAAS,MAAM,MAAO;CAC1B,IAAI,QAAS,MAAM,MAAO;CAC1B,IAAI,QAAS,MAAM,MAAO;CAC1B,IAAI,QAAS,MAAM,MAAO;CAC1B,IAAI,QAAS,MAAM,MAAO;CAC1B,IAAI,QAAS,MAAM,MAAO;CAC1B,IAAI,QAAS,MAAM,MAAO;CAC1B,IAAI,QAAS,MAAM,MAAO;CAC1B,IAAI,QAAS,MAAM,MAAO;CAC1B,IAAI,QAAS,MAAM,MAAO;CAC1B,IAAI,QAAS,MAAM,MAAO;CAC1B,IAAI,QAAS,MAAM,MAAO;CAC1B,IAAI,QAAS,MAAM,MAAO;CAC1B,IAAI,QAAS,MAAM,MAAO;AAC5B;;;;AAIA,SAAS,QAAQ,GAAgB,GAAgB,GAAgB,KAAwB;CACvF,IAAI,MAAM,EAAE,IACV,MAAM,EAAE,IACR,MAAM,EAAE,IACR,MAAM,EAAE,IACR,MAAM,EAAE,IACR,MAAM,EAAE,IACR,MAAM,EAAE,IACR,MAAM,EAAE,IACR,MAAM,EAAE,IACR,MAAM,EAAE,IACR,MAAM,EAAE,IACR,MAAM,EAAE,IACR,MAAM,EAAE,IACR,MAAM,EAAE,IACR,MAAM,EAAE,IACR,MAAM,EAAE;CAEV,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK,GAAG;EAC9B,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EACvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EAEvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EACvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EAEvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EACvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EAEvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EACvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EAEvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EACvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EAEvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EACvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EAEvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EACvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EAEvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,EAAE;EACxB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;EACvB,MAAO,MAAM,MAAO;EACpB,MAAM,KAAK,MAAM,KAAK,CAAC;CACzB;CACA,IAAI,KAAK;CAET,IAAI,QAAQ;CACZ,IAAI,QAAQ;CACZ,IAAI,QAAQ;CACZ,IAAI,QAAQ;CACZ,IAAI,QAAQ;CACZ,IAAI,QAAQ;CACZ,IAAI,QAAQ;CACZ,IAAI,QAAQ;AACd;AAEA,MAAM,QAAQ,YAAY,KAAK;CAAC;CAAY;CAAY;CAAY;AAAU,CAAC;AAC/E,MAAM,0BAAU,IAAI,WAAW,EAAE;AASjC,MAAM,aAAa,MAAkB,UAA6B;CAChE,MAAM,OAAO,IAAI,SAAS,KAAK,QAAQ,KAAK,YAAY,KAAK,UAAU;CAEvE,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,MAAM,KAAK,KAAK,UAAU,IAAI,GAAG,IAAI;AAC9E;AAEA,SAAS,UAAa,KAAiB,OAAmB,WAAmC;CAC3F,MAAM,2BAAW,IAAI,YAAY,CAAC;CAClC,MAAM,gCAAgB,IAAI,YAAY,CAAC;CAEvC,MAAM,QAAe;EACnB,qBAAK,IAAI,YAAY,CAAC;EACtB,uBAAO,IAAI,YAAY,CAAC;EACxB,uBAAO,IAAI,YAAY,EAAE;EACzB,wBAAQ,IAAI,WAAW,EAAE;CAC3B;CAEA,IAAI;EACF,UAAU,KAAK,QAAQ;EACvB,UAAU,MAAM,SAAS,GAAG,EAAE,GAAG,aAAa;EAC9C,QAAQ,OAAO,UAAU,eAAe,MAAM,GAAG;EAEjD,MAAM,OAAO,IAAI,SAAS,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU;EAE1E,MAAM,MAAM,KAAK,KAAK,UAAU,IAAI,IAAI;EACxC,MAAM,MAAM,KAAK,KAAK,UAAU,IAAI,IAAI;EAExC,OAAO,UAAU,KAAK;CACxB,UAAU;EACR,SAAS,KAAK,CAAC;EACf,cAAc,KAAK,CAAC;EACpB,MAAM,IAAI,KAAK,CAAC;EAChB,MAAM,MAAM,KAAK,CAAC;EAClB,MAAM,MAAM,KAAK,CAAC;EAClB,MAAM,OAAO,KAAK,CAAC;CACrB;AACF;AAEA,MAAM,WAAW,OAAc,YAA0B;CACvD,WAAW,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,OAAO,OAAO;CAC9D,MAAM,OAAO,IAAI,SAAS,MAAM,OAAO,QAAQ,MAAM,OAAO,YAAY,MAAM,OAAO,UAAU;CAE/F,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK,KAAK,UAAU,IAAI,GAAG,MAAM,MAAM,IAAI,IAAI;AACzE;AAEA,MAAM,OAAO,OAAc,MAAkB,QAA0B;CACrE,KAAK,IAAI,SAAS,GAAG,UAAU,GAAG,SAAS,KAAK,QAAQ,UAAU,IAAI,WAAW;EAC/E,QAAQ,OAAO,OAAO;EACtB,MAAM,SAAS,KAAK,IAAI,IAAI,KAAK,SAAS,MAAM;EAEhD,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,KAAK,IAAI,SAAS,KAAK,KAAK,SAAS,KAAK,MAAM,OAAO;CACrF;AACF;AAEA,MAAM,UAAU,KAAe,SAA2B;CACxD,IAAI,OAAO,IAAI;CACf,MAAM,YAAY,KAAK,SAAS;CAEhC,IAAI,cAAc,GAAG,IAAI,OAAO,QAAQ,SAAS,SAAS,CAAC;AAC7D;AAEA,MAAM,OAAO,OAAc,YAAwB,mBAA2C;CAC5F,MAAM,0BAAU,IAAI,WAAW,EAAE;CACjC,MAAM,OAAO,IAAI,SAAS,QAAQ,MAAM;CAGxC,KAAK,UAAU,GAAG,eAAe,WAAW,GAAG,IAAI;CACnD,KAAK,UAAU,GAAG,KAAK,MAAM,eAAe,SAAS,UAAW,GAAG,IAAI;CACvE,KAAK,UAAU,GAAG,WAAW,WAAW,GAAG,IAAI;CAC/C,KAAK,UAAU,IAAI,KAAK,MAAM,WAAW,SAAS,UAAW,GAAG,IAAI;CACpE,QAAQ,OAAO,CAAC;CAChB,MAAM,MAAM,IAAI,SAAS,MAAM,OAAO,SAAS,GAAG,EAAE,CAAC;CAErD,IAAI;EACF,OAAO,KAAK,cAAc;EAC1B,OAAO,KAAK,UAAU;EAEtB,OAAO,IAAI,OAAO,OAAO,CAAC,CAAC,OAAO;CACpC,UAAU;EACR,IAAI,QAAQ;EACZ,QAAQ,KAAK,CAAC;EACd,MAAM,OAAO,KAAK,CAAC;CACrB;AACF;AAEA,MAAa,WACX,KACA,OACA,gBACA,cAEA,UAAU,KAAK,QAAQ,UAAU;CAC/B,MAAM,MAAM,IAAI,WAAW,UAAU,SAAS,EAAE;CAChD,MAAM,aAAa,IAAI,SAAS,GAAG,UAAU,MAAM;CAEnD,IAAI;EACF,IAAI,OAAO,WAAW,UAAU;EAChC,MAAM,iBAAiB,IAAI,OAAO,YAAY,cAAc;EAE5D,IAAI,IAAI,gBAAgB,UAAU,MAAM;EACxC,eAAe,KAAK,CAAC;EAErB,OAAO;CACT,SAAS,OAAO;EACd,IAAI,KAAK,CAAC;EACV,MAAM;CACR;AACF,CAAC;;AAGH,MAAa,WACX,KACA,OACA,gBACA,WAEA,UAAU,KAAK,QAAQ,UAAU;CAC/B,MAAM,aAAa,OAAO,SAAS,GAAG,GAAG;CACzC,MAAM,iBAAiB,IAAI,OAAO,YAAY,cAAc;CAC5D,IAAI,aAAa;CAEjB,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK,cAAc,eAAe,KAAK,OAAO,WAAW,SAAS;CAC1F,eAAe,KAAK,CAAC;CACrB,IAAI,eAAe,GAAG,OAAO,KAAA;CAC7B,MAAM,MAAM,IAAI,WAAW,WAAW,MAAM;CAE5C,IAAI;EACF,IAAI,OAAO,YAAY,GAAG;EAE1B,OAAO;CACT,SAAS,OAAO;EACd,IAAI,KAAK,CAAC;EACV,MAAM;CACR;AACF,CAAC"}

package/dist/internal/xchacha.mjs

@@ -0,0 +1,21 @@
+import { AuthenticationFailed, InvalidInput } from "../Errors.mjs";
+import { decrypt, encrypt } from "./xchacha-core.mjs";
+import { Effect } from "effect";
+//#region src/internal/xchacha.ts
+const maximumPlaintextBytes = 274877906880;
+const xchacha = {
+	encrypt: Effect.fnUntraced(function* ({ key, nonce, additionalData, data }) {
+		if (data.length > maximumPlaintextBytes) return yield* InvalidInput.make({ reason: "data" });
+		return encrypt(key, nonce, additionalData, data);
+	}),
+	decrypt: Effect.fnUntraced(function* ({ key, nonce, additionalData, data }) {
+		if (data.length - 16 > maximumPlaintextBytes) return yield* InvalidInput.make({ reason: "data" });
+		const plaintext = decrypt(key, nonce, additionalData, data);
+		if (plaintext === void 0) return yield* AuthenticationFailed.make({});
+		return plaintext;
+	})
+};
+//#endregion
+export { xchacha };
+
+//# sourceMappingURL=xchacha.mjs.map

package/dist/internal/xchacha.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"xchacha.mjs","names":[],"sources":["../../src/internal/xchacha.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport { AuthenticationFailed, InvalidInput } from \"../Errors\";\nimport type { XChaCha } from \"./aead\";\nimport { decrypt, encrypt } from \"./xchacha-core\";\n\n// Counter zero derives the MAC key; payload blocks use the remaining uint32 values.\nconst maximumPlaintextBytes = 0xffffffff * 64;\n\nexport const xchacha: XChaCha = {\n  encrypt: Effect.fnUntraced(function* ({ key, nonce, additionalData, data }) {\n    if (data.length > maximumPlaintextBytes) return yield* InvalidInput.make({ reason: \"data\" });\n\n    return encrypt(key, nonce, additionalData, data);\n  }),\n  decrypt: Effect.fnUntraced(function* ({ key, nonce, additionalData, data }) {\n    if (data.length - 16 > maximumPlaintextBytes)\n      return yield* InvalidInput.make({ reason: \"data\" });\n\n    const plaintext = decrypt(key, nonce, additionalData, data);\n\n    if (plaintext === undefined) return yield* AuthenticationFailed.make({});\n\n    return plaintext;\n  }),\n};\n"],"mappings":";;;;AAOA,MAAM,wBAAwB;AAE9B,MAAa,UAAmB;CAC9B,SAAS,OAAO,WAAW,WAAW,EAAE,KAAK,OAAO,gBAAgB,QAAQ;EAC1E,IAAI,KAAK,SAAS,uBAAuB,OAAO,OAAO,aAAa,KAAK,EAAE,QAAQ,OAAO,CAAC;EAE3F,OAAO,QAAQ,KAAK,OAAO,gBAAgB,IAAI;CACjD,CAAC;CACD,SAAS,OAAO,WAAW,WAAW,EAAE,KAAK,OAAO,gBAAgB,QAAQ;EAC1E,IAAI,KAAK,SAAS,KAAK,uBACrB,OAAO,OAAO,aAAa,KAAK,EAAE,QAAQ,OAAO,CAAC;EAEpD,MAAM,YAAY,QAAQ,KAAK,OAAO,gBAAgB,IAAI;EAE1D,IAAI,cAAc,KAAA,GAAW,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;EAEvE,OAAO;CACT,CAAC;AACH"}

package/dist/platform-bun.d.mts

@@ -0,0 +1,2 @@
+import { layer } from "./internal/node.mjs";
+export { layer };

package/dist/platform-bun.mjs

@@ -0,0 +1,2 @@
+import { layer } from "./internal/node.mjs";
+export { layer };

package/dist/platform-node.d.mts

@@ -0,0 +1,2 @@
+import { layer } from "./internal/node.mjs";
+export { layer };

package/dist/platform-node.mjs

@@ -0,0 +1,2 @@
+import { layer } from "./internal/node.mjs";
+export { layer };

package/package.json

@@ -1,6 +1 @@
-{
-  "name": "@yielded/crypto",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+{"name":"@yielded/crypto","version":"0.1.0-beta.20","devDependencies":{"@effect/vitest":"4.0.0","@types/node":"26.1.2","effect":"4.0.0","typescript":"7.0.2","vite-plus":"0.3.3"},"peerDependencies":{"effect":"^4.0.0"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./Aead":{"types":"./dist/Aead.d.mts","default":"./dist/Aead.mjs"},"./Errors":{"types":"./dist/Errors.d.mts","default":"./dist/Errors.mjs"},"./Hmac":{"types":"./dist/Hmac.d.mts","default":"./dist/Hmac.mjs"},"./Kdf":{"types":"./dist/Kdf.d.mts","default":"./dist/Kdf.mjs"},"./KdfAdmission":{"types":"./dist/KdfAdmission.d.mts","default":"./dist/KdfAdmission.mjs"},"./Signature":{"types":"./dist/Signature.d.mts","default":"./dist/Signature.mjs"},"./WebCrypto":{"types":"./dist/WebCrypto.d.mts","default":"./dist/WebCrypto.mjs"},"./platform-node":{"types":"./dist/platform-node.d.mts","default":"./dist/platform-node.mjs"},"./platform-bun":{"types":"./dist/platform-bun.d.mts","default":"./dist/platform-bun.mjs"},"./Portable":{"types":"./dist/Portable.d.mts","default":"./dist/Portable.mjs"}},"description":"Effect cryptography services with explicit native and portable backends.","homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/crypto"},"files":["dist","src","THIRD_PARTY_NOTICES.md"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test"}}

package/src/Aead.ts

@@ -0,0 +1,39 @@
+import { Context, type Effect, type Redacted, Schema } from "effect";
+
+import type { AuthenticationFailed, OperationError } from "./Errors";
+
+export const Algorithm = Schema.Literals(["AES-256-GCM", "XChaCha20-Poly1305"]);
+export type Algorithm = typeof Algorithm.Type;
+
+const context = {
+  algorithm: Algorithm,
+  key: Schema.Redacted(Schema.Uint8Array, { disallowJsonEncode: true }),
+  nonce: Schema.Uint8Array,
+  additionalData: Schema.optionalKey(Schema.Uint8Array),
+};
+
+export const EncryptInput = Schema.Struct({
+  ...context,
+  plaintext: Schema.Redacted(Schema.Uint8Array, { disallowJsonEncode: true }),
+});
+
+export type EncryptInput = typeof EncryptInput.Type;
+
+export const DecryptInput = Schema.Struct({ ...context, ciphertext: Schema.Uint8Array });
+export type DecryptInput = typeof DecryptInput.Type;
+
+/**
+ * Both algorithms use a 32-byte key and append a 16-byte tag to ciphertext.
+ * AES-GCM uses a 12-byte nonce; XChaCha uses 24. The caller MUST supply a unique
+ * nonce for each encryption with a key. Obtain entropy from Effect Crypto.
+ * Envelope serialization and key selection belong to the caller.
+ */
+export class Aead extends Context.Service<
+  Aead,
+  {
+    readonly encrypt: (input: EncryptInput) => Effect.Effect<Uint8Array, OperationError>;
+    readonly decrypt: (
+      input: DecryptInput,
+    ) => Effect.Effect<Redacted.Redacted<Uint8Array>, OperationError | AuthenticationFailed>;
+  }
+>()("@yielded/crypto/Aead") {}

package/src/Errors.ts

@@ -0,0 +1,27 @@
+import { Schema } from "effect";
+
+/** Diagnostics contain only fixed classifications, never native causes or input. */
+export class InvalidInput extends Schema.TaggedError<InvalidInput>()("CryptoInvalidInput", {
+  reason: Schema.Literals(["key", "nonce", "parameters", "data"]),
+}) {}
+
+export class UnsupportedAlgorithm extends Schema.TaggedError<UnsupportedAlgorithm>()(
+  "CryptoUnsupportedAlgorithm",
+  {},
+) {}
+
+/** A native backend failed without a more specific classification. */
+export class CryptoUnavailable extends Schema.TaggedError<CryptoUnavailable>()(
+  "CryptoUnavailable",
+  {},
+) {}
+
+/** An authenticated decryption rejected the supplied ciphertext or context. */
+export class AuthenticationFailed extends Schema.TaggedError<AuthenticationFailed>()(
+  "CryptoAuthenticationFailed",
+  {},
+) {}
+
+export class KdfBusy extends Schema.TaggedError<KdfBusy>()("CryptoKdfBusy", {}) {}
+
+export type OperationError = InvalidInput | UnsupportedAlgorithm | CryptoUnavailable;

package/src/Hmac.ts

@@ -0,0 +1,41 @@
+import { Context, type Effect, Schema, type Scope } from "effect";
+
+import type { OperationError } from "./Errors";
+
+/** SHA-1 exists for interoperability with TOTP, not new signature designs. */
+export const Algorithm = Schema.Literals(["SHA-1", "SHA-256", "SHA-384", "SHA-512"]);
+export type Algorithm = typeof Algorithm.Type;
+
+export const KeyInput = Schema.Struct({
+  algorithm: Algorithm,
+  key: Schema.Redacted(Schema.Uint8Array, { disallowJsonEncode: true }),
+});
+
+export type KeyInput = typeof KeyInput.Type;
+
+export const Input = Schema.Struct({
+  ...KeyInput.fields,
+  data: Schema.Uint8Array,
+});
+
+export type Input = typeof Input.Type;
+
+export const VerifyInput = Schema.Struct({ ...Input.fields, tag: Schema.Uint8Array });
+export type VerifyInput = typeof VerifyInput.Type;
+
+/** An imported, nonextractable key, usable only while its owning Scope is open. */
+export interface Key {
+  readonly sign: (data: Uint8Array) => Effect.Effect<Uint8Array, OperationError>;
+  readonly verify: (data: Uint8Array, tag: Uint8Array) => Effect.Effect<boolean, OperationError>;
+}
+
+export class Hmac extends Context.Service<
+  Hmac,
+  {
+    /** Snapshot and validate once. Closing the Scope joins native work and releases the key. */
+    readonly importKey: (input: KeyInput) => Effect.Effect<Key, OperationError, Scope.Scope>;
+    readonly sign: (input: Input) => Effect.Effect<Uint8Array, OperationError>;
+    /** A wrong tag is false; a key or backend failure stays in the error channel. */
+    readonly verify: (input: VerifyInput) => Effect.Effect<boolean, OperationError>;
+  }
+>()("@yielded/crypto/Hmac") {}

package/src/Kdf.ts

@@ -0,0 +1,87 @@
+import { Context, type Effect, type Redacted, Schema } from "effect";
+
+import type { KdfBusy, OperationError } from "./Errors";
+
+const positive = Schema.Int.check(Schema.isGreaterThan(0));
+const uint32 = Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 0xffffffff }));
+const bytes = Schema.Uint8Array;
+const secret = Schema.Redacted(bytes, { disallowJsonEncode: true });
+const argon2Bytes = bytes.check(Schema.isMaxLength(0xffffffff));
+const argon2Secret = Schema.Redacted(argon2Bytes, { disallowJsonEncode: true });
+
+export const Argon2idInput = Schema.Struct({
+  password: argon2Secret,
+  salt: argon2Bytes.check(Schema.isMinLength(8)),
+  memoryKiB: uint32,
+  passes: uint32,
+  parallelism: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 0xffffff })),
+  length: Schema.Int.check(Schema.isBetween({ minimum: 4, maximum: 0xffffffff })),
+  secret: Schema.optionalKey(argon2Secret),
+  associatedData: Schema.optionalKey(argon2Bytes),
+});
+
+export type Argon2idInput = typeof Argon2idInput.Type;
+
+export const Pbkdf2Input = Schema.Struct({
+  password: secret,
+  salt: bytes,
+  // Native Node/Bun PBKDF2 accepts a positive signed 32-bit iteration count.
+  iterations: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 0x7fffffff })),
+  // WebCrypto takes an unsigned 32-bit bit count; this API takes whole bytes.
+  length: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 0x1fffffff })),
+});
+
+export type Pbkdf2Input = typeof Pbkdf2Input.Type;
+
+export const HkdfInput = Schema.Struct({
+  key: secret,
+  salt: bytes,
+  info: bytes.check(Schema.isMaxLength(1024)),
+  length: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 255 * 32 })),
+});
+
+export type HkdfInput = typeof HkdfInput.Type;
+
+/** Resource ceilings, not a password-strength policy. Limits apply per permit. */
+export const Limits = Schema.Struct({
+  maximumMemoryKiB: positive,
+  maximumPasses: positive,
+  maximumParallelism: positive,
+  maximumMemoryPasses: positive,
+  maximumIterations: positive,
+  maximumInputBytes: positive,
+  maximumOutputBytes: positive,
+});
+
+export type Limits = typeof Limits.Type;
+
+export const defaultLimits: Limits = Object.freeze({
+  maximumMemoryKiB: 65536,
+  maximumPasses: 6,
+  maximumParallelism: 4,
+  maximumMemoryPasses: 131072,
+  maximumIterations: 1000000,
+  maximumInputBytes: 65536,
+  maximumOutputBytes: 1024,
+});
+
+/**
+ * Byte-preserving derivation; no text normalization, PHC parsing or password policy.
+ * Argon2id uses version 19; PBKDF2 and HKDF use SHA-256. A backend captures shared
+ * KdfAdmission when its Layer is built and retains admission until work and cleanup
+ * finish, including when a native operation cannot be cancelled.
+ */
+export class Kdf extends Context.Service<
+  Kdf,
+  {
+    readonly argon2id: (
+      input: Argon2idInput,
+    ) => Effect.Effect<Redacted.Redacted<Uint8Array>, OperationError | KdfBusy>;
+    readonly pbkdf2: (
+      input: Pbkdf2Input,
+    ) => Effect.Effect<Redacted.Redacted<Uint8Array>, OperationError | KdfBusy>;
+    readonly hkdf: (
+      input: HkdfInput,
+    ) => Effect.Effect<Redacted.Redacted<Uint8Array>, OperationError | KdfBusy>;
+  }
+>()("@yielded/crypto/Kdf") {}

package/src/KdfAdmission.ts

@@ -0,0 +1,87 @@
+import { Context, Effect, Layer, Option, Schema, Semaphore } from "effect";
+
+import { InvalidInput, KdfBusy } from "./Errors";
+
+export interface Options {
+  readonly concurrency?: number;
+  readonly maxQueued?: number;
+  readonly maxWaitMilliseconds?: number;
+}
+
+/** Share one Layer across all backend instances to bound actual KDF work. */
+export class KdfAdmission extends Context.Service<
+  KdfAdmission,
+  {
+    readonly run: <A, E, R>(work: Effect.Effect<A, E, R>) => Effect.Effect<A, E | KdfBusy, R>;
+  }
+>()("@yielded/crypto/KdfAdmission") {}
+
+const Configuration = Schema.Struct({
+  concurrency: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 32 })),
+  maxQueued: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+  maxWaitMilliseconds: Schema.Int.check(Schema.isGreaterThan(0)),
+});
+
+/**
+ * Waiting is interruptible and bounded. The permit covers work and its cleanup;
+ * backends protect nonabortable native calls until actual completion. Owned
+ * interruptible work can stop and release its resources without finishing a KDF.
+ * Nested work in the same fiber shares its permit through scoped cleanup; forked
+ * fibers must acquire their own. This covers preparation and cleanup around a KDF.
+ * Defaults: one running derivation, sixteen waiting, five-second acquisition wait.
+ */
+export const layer = (options: Options = {}): Layer.Layer<KdfAdmission, InvalidInput> => {
+  const snapshot = {
+    concurrency: options.concurrency ?? 1,
+    maxQueued: options.maxQueued ?? 16,
+    maxWaitMilliseconds: options.maxWaitMilliseconds ?? 5000,
+  };
+
+  return Layer.effect(
+    KdfAdmission,
+    Effect.gen(function* () {
+      const config = yield* Schema.decodeEffect(Configuration)(snapshot).pipe(
+        Effect.mapError(() => InvalidInput.make({ reason: "parameters" })),
+      );
+
+      const capacity = yield* Schema.decodeEffect(Schema.Int)(
+        config.concurrency + config.maxQueued,
+      ).pipe(Effect.mapError(() => InvalidInput.make({ reason: "parameters" })));
+
+      const active = yield* Semaphore.make(config.concurrency);
+      const admitted = yield* Semaphore.make(capacity);
+      const owners = new Set<number>();
+
+      const acquire = Effect.acquireRelease(active.take(1), () => active.release(1), {
+        interruptible: true,
+      }).pipe(
+        Effect.timeoutOrElse({
+          duration: config.maxWaitMilliseconds,
+          orElse: () => Effect.fail(KdfBusy.make({})),
+        }),
+      );
+
+      return KdfAdmission.of({
+        run: <A, E, R>(work: Effect.Effect<A, E, R>) =>
+          Effect.withFiber((fiber) => {
+            if (owners.has(fiber.id)) return work;
+
+            const owned = Effect.acquireRelease(
+              Effect.sync(() => owners.add(fiber.id)),
+              () => Effect.sync(() => owners.delete(fiber.id)),
+            ).pipe(Effect.andThen(work));
+
+            return admitted
+              .withPermitsIfAvailable(1)(Effect.scoped(Effect.andThen(acquire, owned)))
+              .pipe(
+                Effect.flatMap((result) =>
+                  Option.isSome(result)
+                    ? Effect.succeed(result.value)
+                    : Effect.fail(KdfBusy.make({})),
+                ),
+              );
+          }),
+      });
+    }),
+  );
+};