@yielded/crypto 0.1.0-beta.29 → 0.1.0-beta.31

package/README.md

@@ -17,16 +17,15 @@ an implementation through a direct backend import:
   web adapters for Effect entropy/digests and HMAC.
 - `/Portable`: WebCrypto plus owned Argon2id and XChaCha20-Poly1305 implementations.
 - `/platform-node`, `/platform-bun`: shared Node-compatible WebCrypto and native
-  Argon2id, plus the owned XChaCha20-Poly1305 implementation.
+  Argon2id and scrypt, plus the owned XChaCha20-Poly1305 implementation.
+- `/platform-workerd`: supplied WebCrypto, Wasm Argon2id, native scrypt and owned
+  XChaCha20-Poly1305. Wrangler bundles the included Wasm module; consumers need
+  no compiler. This backend requires Workers Node.js compatibility.
 
-Full backend Layers require one shared `KdfAdmission` Layer. The focused
-`WebCrypto.layerHmac(subtle)` and global `layerWebCrypto` adapters need no KDF
-admission. Waiting for derivation is bounded;
-once admitted, derivation retains its permit until actual work and cleanup finish,
-including interruption. Portable Argon2id yields through Effect between time slices,
-accepts interruption, and clears its work buffers before releasing admission. It
-still runs on the calling thread. JavaScript cannot guarantee zeroization or
-constant-time execution.
+Full backend Layers require one shared `KdfAdmission` Layer to bound derivation
+concurrency and waiting. Interruption waits for admitted native work to finish;
+portable Argon2id yields cooperatively but runs on the calling thread. The focused
+`WebCrypto.layerHmac(subtle)` and global `layerWebCrypto` adapters need no KDF admission.
 
 Secret inputs, derived bytes and decrypted plaintext use `Redacted`. Backend
 errors contain classifications without native causes or secret payloads. Keep

package/THIRD_PARTY_NOTICES.md

@@ -21,6 +21,9 @@ and [noble-ciphers](https://github.com/paulmillr/noble-ciphers).
   into `src/internal/argon2-core.ts`, `blake2b.ts`, and `word64.ts`. The port retains
   Argon2id v19 and its unkeyed BLAKE2b machinery, with per-derivation work buffers,
   explicit little-endian encoding, and an Effect driver in `src/internal/argon2.ts`.
+  `src/internal/argon2-block.c` expresses the same block compression with Wasm SIMD;
+  `src/internal/argon2.wasm` is its compiled artifact. The workerd backend shares
+  the portable initialization, indexing, finalization and Effect scheduling.
 - noble-ciphers 2.1.1, revision `785181b0772ba84afbe812025714163e4e48262f`:
   AEAD test behavior and independent vectors informed `test/primitives.test.ts`
   and `test/vectors.ts`. `src/chacha.ts`, `src/_poly1305.ts`, and the stream/nonce

package/dist/Kdf.d.mts

@@ -12,6 +12,15 @@ export declare const Argon2idInput: Schema.Struct<{
   readonly associatedData: Schema.optionalKey<Schema.Uint8Array>;
 }>;
 export type Argon2idInput = typeof Argon2idInput.Type;
+export declare const ScryptInput: Schema.Struct<{
+  readonly password: Schema.Redacted<Schema.Uint8Array>;
+  readonly salt: Schema.Uint8Array;
+  readonly cost: Schema.Int;
+  readonly blockSize: Schema.Int;
+  readonly parallelism: Schema.Int;
+  readonly length: Schema.Int;
+}>;
+export type ScryptInput = typeof ScryptInput.Type;
 export declare const Pbkdf2Input: Schema.Struct<{
   readonly password: Schema.Redacted<Schema.Uint8Array>;
   readonly salt: Schema.Uint8Array;
@@ -26,7 +35,10 @@ export declare const HkdfInput: Schema.Struct<{
   readonly length: Schema.Int;
 }>;
 export type HkdfInput = typeof HkdfInput.Type;
-/** Resource ceilings, not a password-strength policy. Limits apply per permit. */
+/** Resource ceilings, not a password-strength policy. Limits apply per permit.
+ * Scrypt bounds its allocation by maximumMemoryKiB and N*r*p/8 by
+ * maximumMemoryPasses. maximumPasses/maximumParallelism apply to Argon2id.
+ */
 export declare const Limits: Schema.Struct<{
   readonly maximumMemoryKiB: Schema.Int;
   readonly maximumPasses: Schema.Int;
@@ -40,12 +52,14 @@ export type Limits = typeof Limits.Type;
 export declare const defaultLimits: Limits;
 declare const Kdf_base: Context.ServiceClass<Kdf, "@yielded/crypto/Kdf", {
   readonly argon2id: (input: Argon2idInput) => Effect.Effect<Redacted.Redacted<Uint8Array>, OperationError | KdfBusy>;
+  readonly scrypt: (input: ScryptInput) => Effect.Effect<Redacted.Redacted<Uint8Array>, OperationError | KdfBusy>;
   readonly pbkdf2: (input: Pbkdf2Input) => Effect.Effect<Redacted.Redacted<Uint8Array>, OperationError | KdfBusy>;
   readonly hkdf: (input: HkdfInput) => Effect.Effect<Redacted.Redacted<Uint8Array>, OperationError | KdfBusy>;
 }>;
 /**
  * Byte-preserving derivation; no text normalization, PHC parsing or password policy.
- * Argon2id uses version 19; PBKDF2 and HKDF use SHA-256. A backend captures shared
+ * Argon2id uses version 19; PBKDF2 and HKDF use SHA-256. Scrypt names N/r/p as
+ * cost/blockSize/parallelism. A backend captures shared
  * KdfAdmission when its Layer is built and retains admission until work and cleanup
  * finish, including when a native operation cannot be cancelled.
  */

package/dist/Kdf.mjs

@@ -25,6 +25,20 @@ const Argon2idInput = Schema.Struct({
 	secret: Schema.optionalKey(argon2Secret),
 	associatedData: Schema.optionalKey(argon2Bytes)
 });
+const ScryptInput = Schema.Struct({
+	password: secret,
+	salt: bytes,
+	cost: Schema.Int.check(Schema.isBetween({
+		minimum: 2,
+		maximum: 2147483648
+	})),
+	blockSize: uint32,
+	parallelism: uint32,
+	length: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 2147483647
+	}))
+});
 const Pbkdf2Input = Schema.Struct({
 	password: secret,
 	salt: bytes,
@@ -46,7 +60,10 @@ const HkdfInput = Schema.Struct({
 		maximum: 8160
 	}))
 });
-/** Resource ceilings, not a password-strength policy. Limits apply per permit. */
+/** Resource ceilings, not a password-strength policy. Limits apply per permit.
+* Scrypt bounds its allocation by maximumMemoryKiB and N*r*p/8 by
+* maximumMemoryPasses. maximumPasses/maximumParallelism apply to Argon2id.
+*/
 const Limits = Schema.Struct({
 	maximumMemoryKiB: positive,
 	maximumPasses: positive,
@@ -67,12 +84,13 @@ const defaultLimits = Object.freeze({
 });
 /**
 * Byte-preserving derivation; no text normalization, PHC parsing or password policy.
-* Argon2id uses version 19; PBKDF2 and HKDF use SHA-256. A backend captures shared
+* Argon2id uses version 19; PBKDF2 and HKDF use SHA-256. Scrypt names N/r/p as
+* cost/blockSize/parallelism. A backend captures shared
 * KdfAdmission when its Layer is built and retains admission until work and cleanup
 * finish, including when a native operation cannot be cancelled.
 */
 var Kdf = class extends Context.Service()("@yielded/crypto/Kdf") {};
 //#endregion
-export { Argon2idInput, HkdfInput, Kdf, Limits, Pbkdf2Input, defaultLimits };
+export { Argon2idInput, HkdfInput, Kdf, Limits, Pbkdf2Input, ScryptInput, defaultLimits };
 
 //# sourceMappingURL=Kdf.mjs.map

package/dist/Kdf.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"Kdf.mjs","names":[],"sources":["../src/Kdf.ts"],"sourcesContent":["import { Context, type Effect, type Redacted, Schema } from \"effect\";\n\nimport type { KdfBusy, OperationError } from \"./Errors\";\n\nconst positive = Schema.Int.check(Schema.isGreaterThan(0));\nconst uint32 = Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 0xffffffff }));\nconst bytes = Schema.Uint8Array;\nconst secret = Schema.Redacted(bytes, { disallowJsonEncode: true });\nconst argon2Bytes = bytes.check(Schema.isMaxLength(0xffffffff));\nconst argon2Secret = Schema.Redacted(argon2Bytes, { disallowJsonEncode: true });\n\nexport const Argon2idInput = Schema.Struct({\n  password: argon2Secret,\n  salt: argon2Bytes.check(Schema.isMinLength(8)),\n  memoryKiB: uint32,\n  passes: uint32,\n  parallelism: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 0xffffff })),\n  length: Schema.Int.check(Schema.isBetween({ minimum: 4, maximum: 0xffffffff })),\n  secret: Schema.optionalKey(argon2Secret),\n  associatedData: Schema.optionalKey(argon2Bytes),\n});\n\nexport type Argon2idInput = typeof Argon2idInput.Type;\n\nexport const Pbkdf2Input = Schema.Struct({\n  password: secret,\n  salt: bytes,\n  // Native Node/Bun PBKDF2 accepts a positive signed 32-bit iteration count.\n  iterations: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 0x7fffffff })),\n  // WebCrypto takes an unsigned 32-bit bit count; this API takes whole bytes.\n  length: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 0x1fffffff })),\n});\n\nexport type Pbkdf2Input = typeof Pbkdf2Input.Type;\n\nexport const HkdfInput = Schema.Struct({\n  key: secret,\n  salt: bytes,\n  info: bytes.check(Schema.isMaxLength(1024)),\n  length: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 255 * 32 })),\n});\n\nexport type HkdfInput = typeof HkdfInput.Type;\n\n/** Resource ceilings, not a password-strength policy. Limits apply per permit. */\nexport const Limits = Schema.Struct({\n  maximumMemoryKiB: positive,\n  maximumPasses: positive,\n  maximumParallelism: positive,\n  maximumMemoryPasses: positive,\n  maximumIterations: positive,\n  maximumInputBytes: positive,\n  maximumOutputBytes: positive,\n});\n\nexport type Limits = typeof Limits.Type;\n\nexport const defaultLimits: Limits = Object.freeze({\n  maximumMemoryKiB: 65536,\n  maximumPasses: 6,\n  maximumParallelism: 4,\n  maximumMemoryPasses: 131072,\n  maximumIterations: 1000000,\n  maximumInputBytes: 65536,\n  maximumOutputBytes: 1024,\n});\n\n/**\n * Byte-preserving derivation; no text normalization, PHC parsing or password policy.\n * Argon2id uses version 19; PBKDF2 and HKDF use SHA-256. A backend captures shared\n * KdfAdmission when its Layer is built and retains admission until work and cleanup\n * finish, including when a native operation cannot be cancelled.\n */\nexport class Kdf extends Context.Service<\n  Kdf,\n  {\n    readonly argon2id: (\n      input: Argon2idInput,\n    ) => Effect.Effect<Redacted.Redacted<Uint8Array>, OperationError | KdfBusy>;\n    readonly pbkdf2: (\n      input: Pbkdf2Input,\n    ) => Effect.Effect<Redacted.Redacted<Uint8Array>, OperationError | KdfBusy>;\n    readonly hkdf: (\n      input: HkdfInput,\n    ) => Effect.Effect<Redacted.Redacted<Uint8Array>, OperationError | KdfBusy>;\n  }\n>()(\"@yielded/crypto/Kdf\") {}\n"],"mappings":";;AAIA,MAAM,WAAW,OAAO,IAAI,MAAM,OAAO,cAAc,CAAC,CAAC;AACzD,MAAM,SAAS,OAAO,IAAI,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAW,CAAC,CAAC;AACrF,MAAM,QAAQ,OAAO;AACrB,MAAM,SAAS,OAAO,SAAS,OAAO,EAAE,oBAAoB,KAAK,CAAC;AAClE,MAAM,cAAc,MAAM,MAAM,OAAO,YAAY,UAAU,CAAC;AAC9D,MAAM,eAAe,OAAO,SAAS,aAAa,EAAE,oBAAoB,KAAK,CAAC;AAE9E,MAAa,gBAAgB,OAAO,OAAO;CACzC,UAAU;CACV,MAAM,YAAY,MAAM,OAAO,YAAY,CAAC,CAAC;CAC7C,WAAW;CACX,QAAQ;CACR,aAAa,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAS,CAAC,CAAC;CACjF,QAAQ,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAW,CAAC,CAAC;CAC9E,QAAQ,OAAO,YAAY,YAAY;CACvC,gBAAgB,OAAO,YAAY,WAAW;AAChD,CAAC;AAID,MAAa,cAAc,OAAO,OAAO;CACvC,UAAU;CACV,MAAM;CAEN,YAAY,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAW,CAAC,CAAC;CAElF,QAAQ,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAW,CAAC,CAAC;AAChF,CAAC;AAID,MAAa,YAAY,OAAO,OAAO;CACrC,KAAK;CACL,MAAM;CACN,MAAM,MAAM,MAAM,OAAO,YAAY,IAAI,CAAC;CAC1C,QAAQ,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAS,CAAC,CAAC;AAC9E,CAAC;;AAKD,MAAa,SAAS,OAAO,OAAO;CAClC,kBAAkB;CAClB,eAAe;CACf,oBAAoB;CACpB,qBAAqB;CACrB,mBAAmB;CACnB,mBAAmB;CACnB,oBAAoB;AACtB,CAAC;AAID,MAAa,gBAAwB,OAAO,OAAO;CACjD,kBAAkB;CAClB,eAAe;CACf,oBAAoB;CACpB,qBAAqB;CACrB,mBAAmB;CACnB,mBAAmB;CACnB,oBAAoB;AACtB,CAAC;;;;;;;AAQD,IAAa,MAAb,cAAyB,QAAQ,QAa/B,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"Kdf.mjs","names":[],"sources":["../src/Kdf.ts"],"sourcesContent":["import { Context, type Effect, type Redacted, Schema } from \"effect\";\n\nimport type { KdfBusy, OperationError } from \"./Errors\";\n\nconst positive = Schema.Int.check(Schema.isGreaterThan(0));\nconst uint32 = Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 0xffffffff }));\nconst bytes = Schema.Uint8Array;\nconst secret = Schema.Redacted(bytes, { disallowJsonEncode: true });\nconst argon2Bytes = bytes.check(Schema.isMaxLength(0xffffffff));\nconst argon2Secret = Schema.Redacted(argon2Bytes, { disallowJsonEncode: true });\n\nexport const Argon2idInput = Schema.Struct({\n  password: argon2Secret,\n  salt: argon2Bytes.check(Schema.isMinLength(8)),\n  memoryKiB: uint32,\n  passes: uint32,\n  parallelism: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 0xffffff })),\n  length: Schema.Int.check(Schema.isBetween({ minimum: 4, maximum: 0xffffffff })),\n  secret: Schema.optionalKey(argon2Secret),\n  associatedData: Schema.optionalKey(argon2Bytes),\n});\n\nexport type Argon2idInput = typeof Argon2idInput.Type;\n\nexport const ScryptInput = Schema.Struct({\n  password: secret,\n  salt: bytes,\n  cost: Schema.Int.check(Schema.isBetween({ minimum: 2, maximum: 0x80000000 })),\n  blockSize: uint32,\n  parallelism: uint32,\n  length: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 0x7fffffff })),\n});\n\nexport type ScryptInput = typeof ScryptInput.Type;\n\nexport const Pbkdf2Input = Schema.Struct({\n  password: secret,\n  salt: bytes,\n  // Native Node/Bun PBKDF2 accepts a positive signed 32-bit iteration count.\n  iterations: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 0x7fffffff })),\n  // WebCrypto takes an unsigned 32-bit bit count; this API takes whole bytes.\n  length: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 0x1fffffff })),\n});\n\nexport type Pbkdf2Input = typeof Pbkdf2Input.Type;\n\nexport const HkdfInput = Schema.Struct({\n  key: secret,\n  salt: bytes,\n  info: bytes.check(Schema.isMaxLength(1024)),\n  length: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 255 * 32 })),\n});\n\nexport type HkdfInput = typeof HkdfInput.Type;\n\n/** Resource ceilings, not a password-strength policy. Limits apply per permit.\n * Scrypt bounds its allocation by maximumMemoryKiB and N*r*p/8 by\n * maximumMemoryPasses. maximumPasses/maximumParallelism apply to Argon2id.\n */\nexport const Limits = Schema.Struct({\n  maximumMemoryKiB: positive,\n  maximumPasses: positive,\n  maximumParallelism: positive,\n  maximumMemoryPasses: positive,\n  maximumIterations: positive,\n  maximumInputBytes: positive,\n  maximumOutputBytes: positive,\n});\n\nexport type Limits = typeof Limits.Type;\n\nexport const defaultLimits: Limits = Object.freeze({\n  maximumMemoryKiB: 65536,\n  maximumPasses: 6,\n  maximumParallelism: 4,\n  maximumMemoryPasses: 131072,\n  maximumIterations: 1000000,\n  maximumInputBytes: 65536,\n  maximumOutputBytes: 1024,\n});\n\n/**\n * Byte-preserving derivation; no text normalization, PHC parsing or password policy.\n * Argon2id uses version 19; PBKDF2 and HKDF use SHA-256. Scrypt names N/r/p as\n * cost/blockSize/parallelism. A backend captures shared\n * KdfAdmission when its Layer is built and retains admission until work and cleanup\n * finish, including when a native operation cannot be cancelled.\n */\nexport class Kdf extends Context.Service<\n  Kdf,\n  {\n    readonly argon2id: (\n      input: Argon2idInput,\n    ) => Effect.Effect<Redacted.Redacted<Uint8Array>, OperationError | KdfBusy>;\n    readonly scrypt: (\n      input: ScryptInput,\n    ) => Effect.Effect<Redacted.Redacted<Uint8Array>, OperationError | KdfBusy>;\n    readonly pbkdf2: (\n      input: Pbkdf2Input,\n    ) => Effect.Effect<Redacted.Redacted<Uint8Array>, OperationError | KdfBusy>;\n    readonly hkdf: (\n      input: HkdfInput,\n    ) => Effect.Effect<Redacted.Redacted<Uint8Array>, OperationError | KdfBusy>;\n  }\n>()(\"@yielded/crypto/Kdf\") {}\n"],"mappings":";;AAIA,MAAM,WAAW,OAAO,IAAI,MAAM,OAAO,cAAc,CAAC,CAAC;AACzD,MAAM,SAAS,OAAO,IAAI,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAW,CAAC,CAAC;AACrF,MAAM,QAAQ,OAAO;AACrB,MAAM,SAAS,OAAO,SAAS,OAAO,EAAE,oBAAoB,KAAK,CAAC;AAClE,MAAM,cAAc,MAAM,MAAM,OAAO,YAAY,UAAU,CAAC;AAC9D,MAAM,eAAe,OAAO,SAAS,aAAa,EAAE,oBAAoB,KAAK,CAAC;AAE9E,MAAa,gBAAgB,OAAO,OAAO;CACzC,UAAU;CACV,MAAM,YAAY,MAAM,OAAO,YAAY,CAAC,CAAC;CAC7C,WAAW;CACX,QAAQ;CACR,aAAa,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAS,CAAC,CAAC;CACjF,QAAQ,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAW,CAAC,CAAC;CAC9E,QAAQ,OAAO,YAAY,YAAY;CACvC,gBAAgB,OAAO,YAAY,WAAW;AAChD,CAAC;AAID,MAAa,cAAc,OAAO,OAAO;CACvC,UAAU;CACV,MAAM;CACN,MAAM,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAW,CAAC,CAAC;CAC5E,WAAW;CACX,aAAa;CACb,QAAQ,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAW,CAAC,CAAC;AAChF,CAAC;AAID,MAAa,cAAc,OAAO,OAAO;CACvC,UAAU;CACV,MAAM;CAEN,YAAY,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAW,CAAC,CAAC;CAElF,QAAQ,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAW,CAAC,CAAC;AAChF,CAAC;AAID,MAAa,YAAY,OAAO,OAAO;CACrC,KAAK;CACL,MAAM;CACN,MAAM,MAAM,MAAM,OAAO,YAAY,IAAI,CAAC;CAC1C,QAAQ,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAS,CAAC,CAAC;AAC9E,CAAC;;;;;AAQD,MAAa,SAAS,OAAO,OAAO;CAClC,kBAAkB;CAClB,eAAe;CACf,oBAAoB;CACpB,qBAAqB;CACrB,mBAAmB;CACnB,mBAAmB;CACnB,oBAAoB;AACtB,CAAC;AAID,MAAa,gBAAwB,OAAO,OAAO;CACjD,kBAAkB;CAClB,eAAe;CACf,oBAAoB;CACpB,qBAAqB;CACrB,mBAAmB;CACnB,mBAAmB;CACnB,oBAAoB;AACtB,CAAC;;;;;;;;AASD,IAAa,MAAb,cAAyB,QAAQ,QAgB/B,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC"}

package/dist/Portable.d.mts

@@ -4,8 +4,9 @@ import { Hmac } from "./Hmac.mjs";
 import { Kdf, Limits } from "./Kdf.mjs";
 import { KdfAdmission } from "./KdfAdmission.mjs";
 import { Signature } from "./Signature.mjs";
+import { Layer } from "effect";
 //#region src/Portable.d.ts
 /** WebCrypto with owned, portable Argon2id and XChaCha20-Poly1305 implementations. */
-export declare const layer: (subtle: SubtleCrypto, limits?: Partial<Limits>) => import("effect/Layer").Layer<Aead | Hmac | Kdf | Signature, InvalidInput, KdfAdmission>;
+export declare const layer: (subtle: SubtleCrypto, limits?: Partial<Limits>) => Layer.Layer<Aead | Hmac | Kdf | Signature, InvalidInput, KdfAdmission>;
 //#endregion
 //# sourceMappingURL=Portable.d.mts.map

package/dist/Portable.mjs

@@ -1,12 +1,14 @@
+import { layerUnsupported } from "./internal/scrypt-backend.mjs";
 import { makeLayer } from "./internal/layer.mjs";
 import { xchacha } from "./internal/xchacha.mjs";
 import { argon2 } from "./internal/argon2.mjs";
+import { Layer } from "effect";
 //#region src/Portable.ts
 /** WebCrypto with owned, portable Argon2id and XChaCha20-Poly1305 implementations. */
 const layer = (subtle, limits = {}) => makeLayer(subtle, limits, {
 	argon2,
 	xchacha
-});
+}).pipe(Layer.provide(layerUnsupported));
 //#endregion
 export { layer };
 

package/dist/Portable.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"Portable.mjs","names":[],"sources":["../src/Portable.ts"],"sourcesContent":["import { argon2 } from \"./internal/argon2\";\nimport { makeLayer } from \"./internal/layer\";\nimport { xchacha } from \"./internal/xchacha\";\nimport type { Limits } from \"./Kdf\";\n\n/** WebCrypto with owned, portable Argon2id and XChaCha20-Poly1305 implementations. */\nexport const layer = (subtle: SubtleCrypto, limits: Partial<Limits> = {}) =>\n  makeLayer(subtle, limits, { argon2, xchacha });\n"],"mappings":";;;;;AAMA,MAAa,SAAS,QAAsB,SAA0B,CAAC,MACrE,UAAU,QAAQ,QAAQ;CAAE;CAAQ;AAAQ,CAAC"}
+{"version":3,"file":"Portable.mjs","names":[],"sources":["../src/Portable.ts"],"sourcesContent":["import { Layer } from \"effect\";\n\nimport { argon2 } from \"./internal/argon2\";\nimport { makeLayer } from \"./internal/layer\";\nimport { layerUnsupported } from \"./internal/scrypt-backend\";\nimport { xchacha } from \"./internal/xchacha\";\nimport type { Limits } from \"./Kdf\";\n\n/** WebCrypto with owned, portable Argon2id and XChaCha20-Poly1305 implementations. */\nexport const layer = (subtle: SubtleCrypto, limits: Partial<Limits> = {}) =>\n  makeLayer(subtle, limits, { argon2, xchacha }).pipe(Layer.provide(layerUnsupported));\n"],"mappings":";;;;;;;AASA,MAAa,SAAS,QAAsB,SAA0B,CAAC,MACrE,UAAU,QAAQ,QAAQ;CAAE;CAAQ;AAAQ,CAAC,CAAC,CAAC,KAAK,MAAM,QAAQ,gBAAgB,CAAC"}

package/dist/Signature.d.mts

@@ -41,6 +41,50 @@ export declare const PrivateKeyParameters: Schema.Union<readonly [Schema.Struct<
   readonly qi: Schema.Uint8Array;
 }>]>;
 export type PrivateKeyParameters = typeof PrivateKeyParameters.Type;
+export declare const RsaModulusLength: Schema.Literals<readonly [2048, 3072, 4096]>;
+/** RSA defaults to 2048 bits and exponent 65537; curves are fixed by algorithm. */
+export declare const GenerateKeyPairInput: Schema.Union<readonly [Schema.Struct<{
+  readonly algorithm: Schema.Literals<readonly ["ECDSA-P256-SHA256", "Ed25519"]>;
+}>, Schema.Struct<{
+  readonly algorithm: Schema.Literals<readonly ["RSASSA-PKCS1-v1_5-SHA256", "RSA-PSS-SHA256"]>;
+  readonly modulusLength: Schema.optionalKey<Schema.Literals<readonly [2048, 3072, 4096]>>;
+}>]>;
+export type GenerateKeyPairInput = typeof GenerateKeyPairInput.Type;
+export declare const KeyPairParameters: Schema.Struct<{
+  readonly publicKey: Schema.Union<readonly [Schema.Struct<{
+    algorithm: Schema.Literal<"ECDSA-P256-SHA256">;
+    x: Schema.Uint8Array;
+    y: Schema.Uint8Array;
+  }>, Schema.Struct<{
+    algorithm: Schema.Literal<"Ed25519">;
+    x: Schema.Uint8Array;
+  }>, Schema.Struct<{
+    algorithm: Schema.Literals<readonly ["RSASSA-PKCS1-v1_5-SHA256", "RSA-PSS-SHA256"]>;
+    n: Schema.Uint8Array;
+    e: Schema.Uint8Array;
+  }>]>;
+  readonly privateKey: Schema.Redacted<Schema.Union<readonly [Schema.Struct<{
+    readonly algorithm: Schema.Literal<"ECDSA-P256-SHA256">;
+    readonly x: Schema.Uint8Array;
+    readonly y: Schema.Uint8Array;
+    readonly d: Schema.Uint8Array;
+  }>, Schema.Struct<{
+    readonly algorithm: Schema.Literal<"Ed25519">;
+    readonly x: Schema.Uint8Array;
+    readonly d: Schema.Uint8Array;
+  }>, Schema.Struct<{
+    readonly algorithm: Schema.Literals<readonly ["RSASSA-PKCS1-v1_5-SHA256", "RSA-PSS-SHA256"]>;
+    readonly n: Schema.Uint8Array;
+    readonly e: Schema.Uint8Array;
+    readonly d: Schema.Uint8Array;
+    readonly p: Schema.Uint8Array;
+    readonly q: Schema.Uint8Array;
+    readonly dp: Schema.Uint8Array;
+    readonly dq: Schema.Uint8Array;
+    readonly qi: Schema.Uint8Array;
+  }>]>>;
+}>;
+export type KeyPairParameters = typeof KeyPairParameters.Type;
 export declare const PrivateKeyInput: Schema.Struct<{
   readonly algorithm: Schema.Literals<readonly ["ECDSA-P256-SHA256", "RSASSA-PKCS1-v1_5-SHA256", "RSA-PSS-SHA256", "Ed25519"]>;
   readonly privateKey: Schema.Redacted<Schema.Uint8Array>;
@@ -77,6 +121,8 @@ declare const Signature_base: Context.ServiceClass<Signature, "@yielded/crypto/S
   readonly importPrivateKey: (input: PrivateKeyInput) => Effect.Effect<PrivateKey, OperationError, Scope.Scope>;
   /** Snapshot SPKI once; scope closure joins native work and rejects later use. */
   readonly importPublicKey: (input: PublicKeyInput) => Effect.Effect<PublicKey, OperationError, Scope.Scope>;
+  /** Generate exportable components. The caller owns the returned secret bytes. */
+  readonly generateKeyPair: (input: GenerateKeyPairInput) => Effect.Effect<KeyPairParameters, OperationError>;
   readonly encodePublicKey: (input: PublicKeyParameters) => Effect.Effect<Uint8Array, OperationError>;
   readonly encodePrivateKey: (input: Redacted.Redacted<PrivateKeyParameters>) => Effect.Effect<Redacted.Redacted<Uint8Array>, OperationError>;
   readonly sign: (input: SignInput) => Effect.Effect<Uint8Array, OperationError>;

package/dist/Signature.mjs

@@ -50,6 +50,20 @@ const PrivateKeyParameters = Schema.Union([
 		qi: integer
 	})
 ]);
+const RsaModulusLength = Schema.Literals([
+	2048,
+	3072,
+	4096
+]);
+/** RSA defaults to 2048 bits and exponent 65537; curves are fixed by algorithm. */
+const GenerateKeyPairInput = Schema.Union([Schema.Struct({ algorithm: Schema.Literals(["ECDSA-P256-SHA256", "Ed25519"]) }), Schema.Struct({
+	algorithm: Schema.Literals(["RSASSA-PKCS1-v1_5-SHA256", "RSA-PSS-SHA256"]),
+	modulusLength: Schema.optionalKey(RsaModulusLength)
+})]);
+const KeyPairParameters = Schema.Struct({
+	publicKey: PublicKeyParameters,
+	privateKey: Schema.Redacted(PrivateKeyParameters, { disallowJsonEncode: true })
+});
 const PrivateKeyInput = Schema.Struct({
 	algorithm: Algorithm,
 	privateKey: Schema.Redacted(Schema.Uint8Array, { disallowJsonEncode: true })
@@ -74,6 +88,6 @@ const VerifyInput = Schema.Struct({
 */
 var Signature = class extends Context.Service()("@yielded/crypto/Signature") {};
 //#endregion
-export { Algorithm, PrivateKeyInput, PrivateKeyParameters, PublicKeyInput, PublicKeyParameters, SignInput, Signature, VerifyInput };
+export { Algorithm, GenerateKeyPairInput, KeyPairParameters, PrivateKeyInput, PrivateKeyParameters, PublicKeyInput, PublicKeyParameters, RsaModulusLength, SignInput, Signature, VerifyInput };
 
 //# sourceMappingURL=Signature.mjs.map

package/dist/Signature.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"Signature.mjs","names":[],"sources":["../src/Signature.ts"],"sourcesContent":["import { Context, type Effect, type Redacted, Schema, type Scope } from \"effect\";\n\nimport type { OperationError } from \"./Errors\";\n\nexport const Algorithm = Schema.Literals([\n  \"ECDSA-P256-SHA256\",\n  \"RSASSA-PKCS1-v1_5-SHA256\",\n  \"RSA-PSS-SHA256\",\n  \"Ed25519\",\n]);\n\nexport type Algorithm = typeof Algorithm.Type;\n\nconst coordinate = Schema.Uint8Array.check(Schema.isMinLength(32), Schema.isMaxLength(32));\nconst integer = Schema.Uint8Array.check(Schema.isMinLength(1), Schema.isMaxLength(1024));\nconst ec = { algorithm: Schema.Literal(\"ECDSA-P256-SHA256\"), x: coordinate, y: coordinate };\nconst ed = { algorithm: Schema.Literal(\"Ed25519\"), x: coordinate };\n\nconst rsa = {\n  algorithm: Schema.Literals([\"RSASSA-PKCS1-v1_5-SHA256\", \"RSA-PSS-SHA256\"]),\n  n: integer,\n  e: integer,\n};\n\n/**\n * Unsigned big-endian components: 32-byte curve values and RSA components up to\n * 1024 bytes. Native import validates the actual key, including RSA's minimum.\n */\nexport const PublicKeyParameters = Schema.Union([\n  Schema.Struct(ec),\n  Schema.Struct(ed),\n  Schema.Struct(rsa),\n]);\n\nexport type PublicKeyParameters = typeof PublicKeyParameters.Type;\n\nexport const PrivateKeyParameters = Schema.Union([\n  Schema.Struct({ ...ec, d: coordinate }),\n  Schema.Struct({ ...ed, d: coordinate }),\n  Schema.Struct({\n    ...rsa,\n    d: integer,\n    p: integer,\n    q: integer,\n    dp: integer,\n    dq: integer,\n    qi: integer,\n  }),\n]);\n\nexport type PrivateKeyParameters = typeof PrivateKeyParameters.Type;\n\nexport const PrivateKeyInput = Schema.Struct({\n  algorithm: Algorithm,\n  privateKey: Schema.Redacted(Schema.Uint8Array, { disallowJsonEncode: true }),\n});\n\nexport type PrivateKeyInput = typeof PrivateKeyInput.Type;\n\nexport const PublicKeyInput = Schema.Struct({\n  algorithm: Algorithm,\n  publicKey: Schema.Uint8Array,\n});\n\nexport type PublicKeyInput = typeof PublicKeyInput.Type;\n\nexport const SignInput = Schema.Struct({\n  ...PrivateKeyInput.fields,\n  data: Schema.Uint8Array,\n});\n\nexport type SignInput = typeof SignInput.Type;\n\nexport const VerifyInput = Schema.Struct({\n  ...PublicKeyInput.fields,\n  data: Schema.Uint8Array,\n  signature: Schema.Uint8Array,\n});\n\nexport type VerifyInput = typeof VerifyInput.Type;\n\n/** A nonextractable signing key with its algorithm fixed at import. */\nexport interface PrivateKey {\n  readonly sign: (data: Uint8Array) => Effect.Effect<Uint8Array, OperationError>;\n}\n\n/** A verification key with its algorithm fixed at import. */\nexport interface PublicKey {\n  readonly verify: (\n    data: Uint8Array,\n    signature: Uint8Array,\n  ) => Effect.Effect<boolean, OperationError>;\n}\n\n/**\n * Private keys are PKCS8 DER; public keys are SPKI DER. ECDSA signatures are\n * 64-byte IEEE P1363 (r || s), not ASN.1 DER. RSA requires at least 2048 bits;\n * PSS uses a 32-byte salt. Key serialization/selection and JOSE policy stay outside.\n */\nexport class Signature extends Context.Service<\n  Signature,\n  {\n    /** Snapshot PKCS8 once; the imported key is usable only inside its owning Scope. */\n    readonly importPrivateKey: (\n      input: PrivateKeyInput,\n    ) => Effect.Effect<PrivateKey, OperationError, Scope.Scope>;\n    /** Snapshot SPKI once; scope closure joins native work and rejects later use. */\n    readonly importPublicKey: (\n      input: PublicKeyInput,\n    ) => Effect.Effect<PublicKey, OperationError, Scope.Scope>;\n    readonly encodePublicKey: (\n      input: PublicKeyParameters,\n    ) => Effect.Effect<Uint8Array, OperationError>;\n    readonly encodePrivateKey: (\n      input: Redacted.Redacted<PrivateKeyParameters>,\n    ) => Effect.Effect<Redacted.Redacted<Uint8Array>, OperationError>;\n    readonly sign: (input: SignInput) => Effect.Effect<Uint8Array, OperationError>;\n    readonly verify: (input: VerifyInput) => Effect.Effect<boolean, OperationError>;\n  }\n>()(\"@yielded/crypto/Signature\") {}\n"],"mappings":";;AAIA,MAAa,YAAY,OAAO,SAAS;CACvC;CACA;CACA;CACA;AACF,CAAC;AAID,MAAM,aAAa,OAAO,WAAW,MAAM,OAAO,YAAY,EAAE,GAAG,OAAO,YAAY,EAAE,CAAC;AACzF,MAAM,UAAU,OAAO,WAAW,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,IAAI,CAAC;AACvF,MAAM,KAAK;CAAE,WAAW,OAAO,QAAQ,mBAAmB;CAAG,GAAG;CAAY,GAAG;AAAW;AAC1F,MAAM,KAAK;CAAE,WAAW,OAAO,QAAQ,SAAS;CAAG,GAAG;AAAW;AAEjE,MAAM,MAAM;CACV,WAAW,OAAO,SAAS,CAAC,4BAA4B,gBAAgB,CAAC;CACzE,GAAG;CACH,GAAG;AACL;;;;;AAMA,MAAa,sBAAsB,OAAO,MAAM;CAC9C,OAAO,OAAO,EAAE;CAChB,OAAO,OAAO,EAAE;CAChB,OAAO,OAAO,GAAG;AACnB,CAAC;AAID,MAAa,uBAAuB,OAAO,MAAM;CAC/C,OAAO,OAAO;EAAE,GAAG;EAAI,GAAG;CAAW,CAAC;CACtC,OAAO,OAAO;EAAE,GAAG;EAAI,GAAG;CAAW,CAAC;CACtC,OAAO,OAAO;EACZ,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAG;EACH,IAAI;EACJ,IAAI;EACJ,IAAI;CACN,CAAC;AACH,CAAC;AAID,MAAa,kBAAkB,OAAO,OAAO;CAC3C,WAAW;CACX,YAAY,OAAO,SAAS,OAAO,YAAY,EAAE,oBAAoB,KAAK,CAAC;AAC7E,CAAC;AAID,MAAa,iBAAiB,OAAO,OAAO;CAC1C,WAAW;CACX,WAAW,OAAO;AACpB,CAAC;AAID,MAAa,YAAY,OAAO,OAAO;CACrC,GAAG,gBAAgB;CACnB,MAAM,OAAO;AACf,CAAC;AAID,MAAa,cAAc,OAAO,OAAO;CACvC,GAAG,eAAe;CAClB,MAAM,OAAO;CACb,WAAW,OAAO;AACpB,CAAC;;;;;;AAsBD,IAAa,YAAb,cAA+B,QAAQ,QAoBrC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC"}
+{"version":3,"file":"Signature.mjs","names":[],"sources":["../src/Signature.ts"],"sourcesContent":["import { Context, type Effect, type Redacted, Schema, type Scope } from \"effect\";\n\nimport type { OperationError } from \"./Errors\";\n\nexport const Algorithm = Schema.Literals([\n  \"ECDSA-P256-SHA256\",\n  \"RSASSA-PKCS1-v1_5-SHA256\",\n  \"RSA-PSS-SHA256\",\n  \"Ed25519\",\n]);\n\nexport type Algorithm = typeof Algorithm.Type;\n\nconst coordinate = Schema.Uint8Array.check(Schema.isMinLength(32), Schema.isMaxLength(32));\nconst integer = Schema.Uint8Array.check(Schema.isMinLength(1), Schema.isMaxLength(1024));\nconst ec = { algorithm: Schema.Literal(\"ECDSA-P256-SHA256\"), x: coordinate, y: coordinate };\nconst ed = { algorithm: Schema.Literal(\"Ed25519\"), x: coordinate };\n\nconst rsa = {\n  algorithm: Schema.Literals([\"RSASSA-PKCS1-v1_5-SHA256\", \"RSA-PSS-SHA256\"]),\n  n: integer,\n  e: integer,\n};\n\n/**\n * Unsigned big-endian components: 32-byte curve values and RSA components up to\n * 1024 bytes. Native import validates the actual key, including RSA's minimum.\n */\nexport const PublicKeyParameters = Schema.Union([\n  Schema.Struct(ec),\n  Schema.Struct(ed),\n  Schema.Struct(rsa),\n]);\n\nexport type PublicKeyParameters = typeof PublicKeyParameters.Type;\n\nexport const PrivateKeyParameters = Schema.Union([\n  Schema.Struct({ ...ec, d: coordinate }),\n  Schema.Struct({ ...ed, d: coordinate }),\n  Schema.Struct({\n    ...rsa,\n    d: integer,\n    p: integer,\n    q: integer,\n    dp: integer,\n    dq: integer,\n    qi: integer,\n  }),\n]);\n\nexport type PrivateKeyParameters = typeof PrivateKeyParameters.Type;\n\nexport const RsaModulusLength = Schema.Literals([2048, 3072, 4096]);\n\n/** RSA defaults to 2048 bits and exponent 65537; curves are fixed by algorithm. */\nexport const GenerateKeyPairInput = Schema.Union([\n  Schema.Struct({ algorithm: Schema.Literals([\"ECDSA-P256-SHA256\", \"Ed25519\"]) }),\n  Schema.Struct({\n    algorithm: Schema.Literals([\"RSASSA-PKCS1-v1_5-SHA256\", \"RSA-PSS-SHA256\"]),\n    modulusLength: Schema.optionalKey(RsaModulusLength),\n  }),\n]);\n\nexport type GenerateKeyPairInput = typeof GenerateKeyPairInput.Type;\n\nexport const KeyPairParameters = Schema.Struct({\n  publicKey: PublicKeyParameters,\n  privateKey: Schema.Redacted(PrivateKeyParameters, { disallowJsonEncode: true }),\n});\n\nexport type KeyPairParameters = typeof KeyPairParameters.Type;\n\nexport const PrivateKeyInput = Schema.Struct({\n  algorithm: Algorithm,\n  privateKey: Schema.Redacted(Schema.Uint8Array, { disallowJsonEncode: true }),\n});\n\nexport type PrivateKeyInput = typeof PrivateKeyInput.Type;\n\nexport const PublicKeyInput = Schema.Struct({\n  algorithm: Algorithm,\n  publicKey: Schema.Uint8Array,\n});\n\nexport type PublicKeyInput = typeof PublicKeyInput.Type;\n\nexport const SignInput = Schema.Struct({\n  ...PrivateKeyInput.fields,\n  data: Schema.Uint8Array,\n});\n\nexport type SignInput = typeof SignInput.Type;\n\nexport const VerifyInput = Schema.Struct({\n  ...PublicKeyInput.fields,\n  data: Schema.Uint8Array,\n  signature: Schema.Uint8Array,\n});\n\nexport type VerifyInput = typeof VerifyInput.Type;\n\n/** A nonextractable signing key with its algorithm fixed at import. */\nexport interface PrivateKey {\n  readonly sign: (data: Uint8Array) => Effect.Effect<Uint8Array, OperationError>;\n}\n\n/** A verification key with its algorithm fixed at import. */\nexport interface PublicKey {\n  readonly verify: (\n    data: Uint8Array,\n    signature: Uint8Array,\n  ) => Effect.Effect<boolean, OperationError>;\n}\n\n/**\n * Private keys are PKCS8 DER; public keys are SPKI DER. ECDSA signatures are\n * 64-byte IEEE P1363 (r || s), not ASN.1 DER. RSA requires at least 2048 bits;\n * PSS uses a 32-byte salt. Key serialization/selection and JOSE policy stay outside.\n */\nexport class Signature extends Context.Service<\n  Signature,\n  {\n    /** Snapshot PKCS8 once; the imported key is usable only inside its owning Scope. */\n    readonly importPrivateKey: (\n      input: PrivateKeyInput,\n    ) => Effect.Effect<PrivateKey, OperationError, Scope.Scope>;\n    /** Snapshot SPKI once; scope closure joins native work and rejects later use. */\n    readonly importPublicKey: (\n      input: PublicKeyInput,\n    ) => Effect.Effect<PublicKey, OperationError, Scope.Scope>;\n    /** Generate exportable components. The caller owns the returned secret bytes. */\n    readonly generateKeyPair: (\n      input: GenerateKeyPairInput,\n    ) => Effect.Effect<KeyPairParameters, OperationError>;\n    readonly encodePublicKey: (\n      input: PublicKeyParameters,\n    ) => Effect.Effect<Uint8Array, OperationError>;\n    readonly encodePrivateKey: (\n      input: Redacted.Redacted<PrivateKeyParameters>,\n    ) => Effect.Effect<Redacted.Redacted<Uint8Array>, OperationError>;\n    readonly sign: (input: SignInput) => Effect.Effect<Uint8Array, OperationError>;\n    readonly verify: (input: VerifyInput) => Effect.Effect<boolean, OperationError>;\n  }\n>()(\"@yielded/crypto/Signature\") {}\n"],"mappings":";;AAIA,MAAa,YAAY,OAAO,SAAS;CACvC;CACA;CACA;CACA;AACF,CAAC;AAID,MAAM,aAAa,OAAO,WAAW,MAAM,OAAO,YAAY,EAAE,GAAG,OAAO,YAAY,EAAE,CAAC;AACzF,MAAM,UAAU,OAAO,WAAW,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,IAAI,CAAC;AACvF,MAAM,KAAK;CAAE,WAAW,OAAO,QAAQ,mBAAmB;CAAG,GAAG;CAAY,GAAG;AAAW;AAC1F,MAAM,KAAK;CAAE,WAAW,OAAO,QAAQ,SAAS;CAAG,GAAG;AAAW;AAEjE,MAAM,MAAM;CACV,WAAW,OAAO,SAAS,CAAC,4BAA4B,gBAAgB,CAAC;CACzE,GAAG;CACH,GAAG;AACL;;;;;AAMA,MAAa,sBAAsB,OAAO,MAAM;CAC9C,OAAO,OAAO,EAAE;CAChB,OAAO,OAAO,EAAE;CAChB,OAAO,OAAO,GAAG;AACnB,CAAC;AAID,MAAa,uBAAuB,OAAO,MAAM;CAC/C,OAAO,OAAO;EAAE,GAAG;EAAI,GAAG;CAAW,CAAC;CACtC,OAAO,OAAO;EAAE,GAAG;EAAI,GAAG;CAAW,CAAC;CACtC,OAAO,OAAO;EACZ,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAG;EACH,IAAI;EACJ,IAAI;EACJ,IAAI;CACN,CAAC;AACH,CAAC;AAID,MAAa,mBAAmB,OAAO,SAAS;CAAC;CAAM;CAAM;AAAI,CAAC;;AAGlE,MAAa,uBAAuB,OAAO,MAAM,CAC/C,OAAO,OAAO,EAAE,WAAW,OAAO,SAAS,CAAC,qBAAqB,SAAS,CAAC,EAAE,CAAC,GAC9E,OAAO,OAAO;CACZ,WAAW,OAAO,SAAS,CAAC,4BAA4B,gBAAgB,CAAC;CACzE,eAAe,OAAO,YAAY,gBAAgB;AACpD,CAAC,CACH,CAAC;AAID,MAAa,oBAAoB,OAAO,OAAO;CAC7C,WAAW;CACX,YAAY,OAAO,SAAS,sBAAsB,EAAE,oBAAoB,KAAK,CAAC;AAChF,CAAC;AAID,MAAa,kBAAkB,OAAO,OAAO;CAC3C,WAAW;CACX,YAAY,OAAO,SAAS,OAAO,YAAY,EAAE,oBAAoB,KAAK,CAAC;AAC7E,CAAC;AAID,MAAa,iBAAiB,OAAO,OAAO;CAC1C,WAAW;CACX,WAAW,OAAO;AACpB,CAAC;AAID,MAAa,YAAY,OAAO,OAAO;CACrC,GAAG,gBAAgB;CACnB,MAAM,OAAO;AACf,CAAC;AAID,MAAa,cAAc,OAAO,OAAO;CACvC,GAAG,eAAe;CAClB,MAAM,OAAO;CACb,WAAW,OAAO;AACpB,CAAC;;;;;;AAsBD,IAAa,YAAb,cAA+B,QAAQ,QAwBrC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC"}

package/dist/WebCrypto.mjs

@@ -1,10 +1,11 @@
 import { Hmac } from "./Hmac.mjs";
 import { makeHmac } from "./internal/hmac.mjs";
+import { layerUnsupported } from "./internal/scrypt-backend.mjs";
 import { makeLayer } from "./internal/layer.mjs";
 import { Crypto, Effect, Layer, PlatformError } from "effect";
 //#region src/WebCrypto.ts
 /** Supply the host capability explicitly; no implicit global backend selection. */
-const layer = (subtle, limits = {}) => makeLayer(subtle, limits);
+const layer = (subtle, limits = {}) => makeLayer(subtle, limits).pipe(Layer.provide(layerUnsupported));
 /** HMAC alone has no KDF admission requirement. */
 const layerHmac = (subtle) => Layer.sync(Hmac)(() => makeHmac(subtle));
 /** Effect entropy and SHA digests from the host's global WebCrypto implementation. */

package/dist/WebCrypto.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"WebCrypto.mjs","names":[],"sources":["../src/WebCrypto.ts"],"sourcesContent":["import { Crypto, Effect, Layer, PlatformError } from \"effect\";\n\nimport { Hmac } from \"./Hmac\";\nimport { makeHmac } from \"./internal/hmac\";\nimport { makeLayer } from \"./internal/layer\";\nimport type { Limits } from \"./Kdf\";\n\n/** Supply the host capability explicitly; no implicit global backend selection. */\nexport const layer = (subtle: SubtleCrypto, limits: Partial<Limits> = {}) =>\n  makeLayer(subtle, limits);\n\n/** HMAC alone has no KDF admission requirement. */\nexport const layerHmac = (subtle: SubtleCrypto): Layer.Layer<Hmac> =>\n  Layer.sync(Hmac)(() => makeHmac(subtle));\n\n/** Effect entropy and SHA digests from the host's global WebCrypto implementation. */\nexport const layerCryptoWeb: Layer.Layer<Crypto.Crypto> = Layer.sync(Crypto.Crypto)(() =>\n  Crypto.make({\n    randomBytes: (size) => globalThis.crypto.getRandomValues(new Uint8Array(size)),\n    digest: (algorithm, data) =>\n      Effect.tryPromise({\n        try: () => globalThis.crypto.subtle.digest(algorithm, new Uint8Array(data)),\n        catch: (cause) =>\n          PlatformError.systemError({\n            _tag: \"Unknown\",\n            module: \"Crypto\",\n            method: \"digest\",\n            cause,\n          }),\n      }).pipe(Effect.map((bytes) => new Uint8Array(bytes))),\n  }),\n);\n\n/** HMAC from global WebCrypto. Missing WebCrypto is a platform defect at Layer construction. */\nexport const layerHmacWeb: Layer.Layer<Hmac> = Layer.effect(Hmac)(\n  Effect.suspend(() => {\n    const subtle = globalThis.crypto?.subtle;\n\n    return subtle === undefined\n      ? Effect.die(new Error(\"WebCrypto is unavailable in this runtime\"))\n      : Effect.succeed(makeHmac(subtle));\n  }),\n);\n\n/** Entropy, SHA digests and HMAC for sessions and proofs, without password derivation. */\nexport const layerWebCrypto = Layer.merge(layerCryptoWeb, layerHmacWeb);\n"],"mappings":";;;;;;AAQA,MAAa,SAAS,QAAsB,SAA0B,CAAC,MACrE,UAAU,QAAQ,MAAM;;AAG1B,MAAa,aAAa,WACxB,MAAM,KAAK,IAAI,CAAC,OAAO,SAAS,MAAM,CAAC;;AAGzC,MAAa,iBAA6C,MAAM,KAAK,OAAO,MAAM,CAAC,OACjF,OAAO,KAAK;CACV,cAAc,SAAS,WAAW,OAAO,gBAAgB,IAAI,WAAW,IAAI,CAAC;CAC7E,SAAS,WAAW,SAClB,OAAO,WAAW;EAChB,WAAW,WAAW,OAAO,OAAO,OAAO,WAAW,IAAI,WAAW,IAAI,CAAC;EAC1E,QAAQ,UACN,cAAc,YAAY;GACxB,MAAM;GACN,QAAQ;GACR,QAAQ;GACR;EACF,CAAC;CACL,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,UAAU,IAAI,WAAW,KAAK,CAAC,CAAC;AACxD,CAAC,CACH;;AAGA,MAAa,eAAkC,MAAM,OAAO,IAAI,CAAC,CAC/D,OAAO,cAAc;CACnB,MAAM,SAAS,WAAW,QAAQ;CAElC,OAAO,WAAW,KAAA,IACd,OAAO,oBAAI,IAAI,MAAM,0CAA0C,CAAC,IAChE,OAAO,QAAQ,SAAS,MAAM,CAAC;AACrC,CAAC,CACH;;AAGA,MAAa,iBAAiB,MAAM,MAAM,gBAAgB,YAAY"}
+{"version":3,"file":"WebCrypto.mjs","names":[],"sources":["../src/WebCrypto.ts"],"sourcesContent":["import { Crypto, Effect, Layer, PlatformError } from \"effect\";\n\nimport { Hmac } from \"./Hmac\";\nimport { makeHmac } from \"./internal/hmac\";\nimport { makeLayer } from \"./internal/layer\";\nimport { layerUnsupported } from \"./internal/scrypt-backend\";\nimport type { Limits } from \"./Kdf\";\n\n/** Supply the host capability explicitly; no implicit global backend selection. */\nexport const layer = (subtle: SubtleCrypto, limits: Partial<Limits> = {}) =>\n  makeLayer(subtle, limits).pipe(Layer.provide(layerUnsupported));\n\n/** HMAC alone has no KDF admission requirement. */\nexport const layerHmac = (subtle: SubtleCrypto): Layer.Layer<Hmac> =>\n  Layer.sync(Hmac)(() => makeHmac(subtle));\n\n/** Effect entropy and SHA digests from the host's global WebCrypto implementation. */\nexport const layerCryptoWeb: Layer.Layer<Crypto.Crypto> = Layer.sync(Crypto.Crypto)(() =>\n  Crypto.make({\n    randomBytes: (size) => globalThis.crypto.getRandomValues(new Uint8Array(size)),\n    digest: (algorithm, data) =>\n      Effect.tryPromise({\n        try: () => globalThis.crypto.subtle.digest(algorithm, new Uint8Array(data)),\n        catch: (cause) =>\n          PlatformError.systemError({\n            _tag: \"Unknown\",\n            module: \"Crypto\",\n            method: \"digest\",\n            cause,\n          }),\n      }).pipe(Effect.map((bytes) => new Uint8Array(bytes))),\n  }),\n);\n\n/** HMAC from global WebCrypto. Missing WebCrypto is a platform defect at Layer construction. */\nexport const layerHmacWeb: Layer.Layer<Hmac> = Layer.effect(Hmac)(\n  Effect.suspend(() => {\n    const subtle = globalThis.crypto?.subtle;\n\n    return subtle === undefined\n      ? Effect.die(new Error(\"WebCrypto is unavailable in this runtime\"))\n      : Effect.succeed(makeHmac(subtle));\n  }),\n);\n\n/** Entropy, SHA digests and HMAC for sessions and proofs, without password derivation. */\nexport const layerWebCrypto = Layer.merge(layerCryptoWeb, layerHmacWeb);\n"],"mappings":";;;;;;;AASA,MAAa,SAAS,QAAsB,SAA0B,CAAC,MACrE,UAAU,QAAQ,MAAM,CAAC,CAAC,KAAK,MAAM,QAAQ,gBAAgB,CAAC;;AAGhE,MAAa,aAAa,WACxB,MAAM,KAAK,IAAI,CAAC,OAAO,SAAS,MAAM,CAAC;;AAGzC,MAAa,iBAA6C,MAAM,KAAK,OAAO,MAAM,CAAC,OACjF,OAAO,KAAK;CACV,cAAc,SAAS,WAAW,OAAO,gBAAgB,IAAI,WAAW,IAAI,CAAC;CAC7E,SAAS,WAAW,SAClB,OAAO,WAAW;EAChB,WAAW,WAAW,OAAO,OAAO,OAAO,WAAW,IAAI,WAAW,IAAI,CAAC;EAC1E,QAAQ,UACN,cAAc,YAAY;GACxB,MAAM;GACN,QAAQ;GACR,QAAQ;GACR;EACF,CAAC;CACL,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,UAAU,IAAI,WAAW,KAAK,CAAC,CAAC;AACxD,CAAC,CACH;;AAGA,MAAa,eAAkC,MAAM,OAAO,IAAI,CAAC,CAC/D,OAAO,cAAc;CACnB,MAAM,SAAS,WAAW,QAAQ;CAElC,OAAO,WAAW,KAAA,IACd,OAAO,oBAAI,IAAI,MAAM,0CAA0C,CAAC,IAChE,OAAO,QAAQ,SAAS,MAAM,CAAC;AACrC,CAAC,CACH;;AAGA,MAAa,iBAAiB,MAAM,MAAM,gBAAgB,YAAY"}

package/dist/internal/argon2-core.mjs

@@ -157,15 +157,22 @@ function variableHash(words, length) {
 		data.fill(0);
 	}
 }
-const allocate = (input) => {
+const allocate = (input, backing) => {
 	const blocks = 4 * input.parallelism * Math.floor(input.memoryKiB / (4 * input.parallelism));
 	const laneLength = blocks / input.parallelism;
+	let offset = backing?.byteOffset ?? 0;
+	const words = (length) => {
+		if (backing === void 0) return new Uint32Array(length);
+		const view = new Uint32Array(backing.buffer, offset, length);
+		offset += view.byteLength;
+		return view;
+	};
 	return {
-		memory: new Uint32Array(blocks * 256),
-		scratch: /* @__PURE__ */ new Uint32Array(256),
-		address: /* @__PURE__ */ new Uint32Array(768),
-		initial: /* @__PURE__ */ new Uint32Array(18),
-		final: /* @__PURE__ */ new Uint32Array(256),
+		memory: words(blocks * 256),
+		scratch: words(256),
+		address: words(768),
+		initial: words(18),
+		final: words(256),
 		blocks,
 		laneLength,
 		segmentLength: laneLength / 4
@@ -232,7 +239,7 @@ const initialize = (state, input) => {
 	}
 };
 /** Yield block boundaries to the Effect driver; all scratch belongs to this derivation. */
-function* fill(state, input) {
+function* fill(state, input, compress = block) {
 	const { memory: B, scratch, address, laneLength: laneLen, segmentLength: segmentLen } = state;
 	const p = input.parallelism;
 	address[262] = state.blocks;
@@ -250,8 +257,8 @@ function* fill(state, input) {
 				const start = r === 0 && s === 0 ? 2 : 0;
 				if (start === 2 && dataIndependent) {
 					address[268]++;
-					block(scratch, address, 256, 512, 0, false);
-					block(scratch, address, 0, 512, 0, false);
+					compress(scratch, address, 256, 512, 0, false);
+					compress(scratch, address, 0, 512, 0, false);
 				}
 				let offset = lane * laneLen + s * segmentLen + start;
 				for (let index = start; index < segmentLen; index++, offset++) {
@@ -262,8 +269,8 @@ function* fill(state, input) {
 						const addressIndex = index % 128;
 						if (addressIndex === 0) {
 							address[268]++;
-							block(scratch, address, 256, 512, 0, false);
-							block(scratch, address, 0, 512, 0, false);
+							compress(scratch, address, 256, 512, 0, false);
+							compress(scratch, address, 0, 512, 0, false);
 						}
 						randL = address[2 * addressIndex];
 						randH = address[2 * addressIndex + 1];
@@ -273,7 +280,7 @@ function* fill(state, input) {
 					}
 					const refLane = r === 0 && s === 0 ? lane : randH % p;
 					const refPos = indexAlpha(r, s, laneLen, segmentLen, index, randL, refLane === lane);
-					block(scratch, B, 256 * prev, 256 * (laneLen * refLane + refPos), offset * 256, needXor);
+					compress(scratch, B, 256 * prev, 256 * (laneLen * refLane + refPos), offset * 256, needXor);
 					yield;
 				}
 			}

package/dist/internal/argon2-core.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"argon2-core.mjs","names":[],"sources":["../../src/internal/argon2-core.ts"],"sourcesContent":["import { Blake2b } from \"./blake2b\";\nimport type { Argon2Parameters } from \"./kdf\";\n/**\n * Adapted from noble-hashes, Copyright (c) 2022 Paul Miller.\n * MIT; source revision 8060cc83bbab6681d23c9eed071db3f3a6b442da.\n * See ../../THIRD_PARTY_NOTICES.md for source mapping and license.\n */\nimport { rotr32H, rotr32L, rotrBH, rotrBL, rotrSH, rotrSL } from \"./word64\";\n\nconst ARGON2_SYNC_POINTS = 4;\n\n// Unsigned `u32 * u32 = { h, l }`, returned as split 64-bit halves.\nfunction mul(a: number, b: number) {\n  // Split into 16-bit limbs so each partial product stays exact under `Math.imul`.\n  const aL = a & 0xffff;\n  const aH = a >>> 16;\n  const bL = b & 0xffff;\n  const bH = b >>> 16;\n  const ll = Math.imul(aL, bL);\n  const hl = Math.imul(aH, bL);\n  const lh = Math.imul(aL, bH);\n  const hh = Math.imul(aH, bH);\n  const carry = (ll >>> 16) + (hl & 0xffff) + lh;\n  const high = (hh + (hl >>> 16) + (carry >>> 16)) | 0;\n  const low = (carry << 16) | (ll & 0xffff);\n\n  return { h: high, l: low };\n}\n\n// High 32 bits of unsigned u32 multiply, via the same 16-bit limb split as `mul`.\nfunction mulHi(a: number, b: number): number {\n  const aL = a & 0xffff,\n    aH = a >>> 16,\n    bL = b & 0xffff,\n    bH = b >>> 16;\n\n  const carry = (Math.imul(aL, bL) >>> 16) + (Math.imul(aH, bL) & 0xffff) + Math.imul(aL, bH);\n\n  return (Math.imul(aH, bH) + (Math.imul(aH, bL) >>> 16) + (carry >>> 16)) | 0;\n}\n\n// 1024-byte block: 256 u32 = 128 interleaved low/high halves = RFC's\n// 8x8 matrix of 16-byte registers.\n\n// Quarter-round over 64-bit word indices into `A2_BUF`; each index maps to adjacent low/high u32s.\n// Each BlaMka step `X = X + Y + 2 * trunc(X) * trunc(Y)` (trunc = low 32 bits) is three lines:\n// `Math.imul` is the low product half, `mulHi` the high half, then a split 64-bit add with the\n// doubling folded in. RFC 9106 Figure 19 GB rotates by 32, 24, 16, and 63 bits after each XOR.\nfunction G(A2_BUF: Uint32Array, a: number, b: number, c: number, d: number) {\n  let Al = A2_BUF[2 * a],\n    Ah = A2_BUF[2 * a + 1];\n\n  let Bl = A2_BUF[2 * b],\n    Bh = A2_BUF[2 * b + 1];\n\n  let Cl = A2_BUF[2 * c],\n    Ch = A2_BUF[2 * c + 1];\n\n  let Dl = A2_BUF[2 * d],\n    Dh = A2_BUF[2 * d + 1];\n\n  let ml = 0,\n    mh = 0,\n    rl = 0,\n    xh = 0,\n    xl = 0;\n\n  // A = blamka(A, B); D = rotr64(D ^ A, 32)\n  ml = Math.imul(Al, Bl);\n  mh = mulHi(Al, Bl);\n  rl = (Al >>> 0) + (Bl >>> 0) + ((ml << 1) >>> 0);\n  Ah = (Ah + Bh + ((mh << 1) | (ml >>> 31)) + ((rl / 0x100000000) | 0)) | 0;\n  Al = rl | 0;\n  xh = Dh ^ Ah;\n  xl = Dl ^ Al;\n  Dh = rotr32H(xh, xl);\n  Dl = rotr32L(xh, xl);\n\n  // C = blamka(C, D); B = rotr64(B ^ C, 24)\n  ml = Math.imul(Cl, Dl);\n  mh = mulHi(Cl, Dl);\n  rl = (Cl >>> 0) + (Dl >>> 0) + ((ml << 1) >>> 0);\n  Ch = (Ch + Dh + ((mh << 1) | (ml >>> 31)) + ((rl / 0x100000000) | 0)) | 0;\n  Cl = rl | 0;\n  xh = Bh ^ Ch;\n  xl = Bl ^ Cl;\n  Bh = rotrSH(xh, xl, 24);\n  Bl = rotrSL(xh, xl, 24);\n\n  // A = blamka(A, B); D = rotr64(D ^ A, 16)\n  ml = Math.imul(Al, Bl);\n  mh = mulHi(Al, Bl);\n  rl = (Al >>> 0) + (Bl >>> 0) + ((ml << 1) >>> 0);\n  Ah = (Ah + Bh + ((mh << 1) | (ml >>> 31)) + ((rl / 0x100000000) | 0)) | 0;\n  Al = rl | 0;\n  xh = Dh ^ Ah;\n  xl = Dl ^ Al;\n  Dh = rotrSH(xh, xl, 16);\n  Dl = rotrSL(xh, xl, 16);\n\n  // C = blamka(C, D); B = rotr64(B ^ C, 63)\n  ml = Math.imul(Cl, Dl);\n  mh = mulHi(Cl, Dl);\n  rl = (Cl >>> 0) + (Dl >>> 0) + ((ml << 1) >>> 0);\n  Ch = (Ch + Dh + ((mh << 1) | (ml >>> 31)) + ((rl / 0x100000000) | 0)) | 0;\n  Cl = rl | 0;\n  xh = Bh ^ Ch;\n  xl = Bl ^ Cl;\n  Bh = rotrBH(xh, xl, 63);\n  Bl = rotrBL(xh, xl, 63);\n\n  A2_BUF[2 * a] = Al;\n  A2_BUF[2 * a + 1] = Ah;\n  A2_BUF[2 * b] = Bl;\n  A2_BUF[2 * b + 1] = Bh;\n  A2_BUF[2 * c] = Cl;\n  A2_BUF[2 * c + 1] = Ch;\n  A2_BUF[2 * d] = Dl;\n  A2_BUF[2 * d + 1] = Dh;\n}\n\n// Argon2 permutation over 16 register indices into `A2_BUF`, not the register values themselves.\n// RFC 9106 Figure 17: these arguments are the 16 `v0..v15` 64-bit word\n// indices inside eight 16-byte inputs, not copied word values.\nfunction P(\n  A2_BUF: Uint32Array,\n  v00: number,\n  v01: number,\n  v02: number,\n  v03: number,\n  v04: number,\n  v05: number,\n  v06: number,\n  v07: number,\n  v08: number,\n  v09: number,\n  v10: number,\n  v11: number,\n  v12: number,\n  v13: number,\n  v14: number,\n  v15: number,\n) {\n  // RFC 9106 Figure 18: first apply GB across rows, then across columns of the 8x8 register matrix.\n  G(A2_BUF, v00, v04, v08, v12);\n  G(A2_BUF, v01, v05, v09, v13);\n  G(A2_BUF, v02, v06, v10, v14);\n  G(A2_BUF, v03, v07, v11, v15);\n  G(A2_BUF, v00, v05, v10, v15);\n  G(A2_BUF, v01, v06, v11, v12);\n  G(A2_BUF, v02, v07, v08, v13);\n  G(A2_BUF, v03, v04, v09, v14);\n}\n\nfunction block(\n  A2_BUF: Uint32Array,\n  x: Uint32Array,\n  xPos: number,\n  yPos: number,\n  outPos: number,\n  needXor: boolean,\n) {\n  for (let i = 0; i < 256; i++) A2_BUF[i] = x[xPos + i] ^ x[yPos + i];\n  // rows (8 consecutive 16-register groups)\n  for (let i = 0; i < 128; i += 16) {\n    P(\n      A2_BUF,\n      i,\n      i + 1,\n      i + 2,\n      i + 3,\n      i + 4,\n      i + 5,\n      i + 6,\n      i + 7,\n      i + 8,\n      i + 9,\n      i + 10,\n      i + 11,\n      i + 12,\n      i + 13,\n      i + 14,\n      i + 15,\n    );\n  }\n  // columns (8 strided 16-register groups)\n  for (let i = 0; i < 16; i += 2) {\n    P(\n      A2_BUF,\n      i,\n      i + 1,\n      i + 16,\n      i + 17,\n      i + 32,\n      i + 33,\n      i + 48,\n      i + 49,\n      i + 64,\n      i + 65,\n      i + 80,\n      i + 81,\n      i + 96,\n      i + 97,\n      i + 112,\n      i + 113,\n    );\n  }\n\n  // RFC 9106 step 6: passes after the first XOR the old destination block into the new G(X, Y).\n  if (needXor) for (let i = 0; i < 256; i++) x[outPos + i] ^= A2_BUF[i] ^ x[xPos + i] ^ x[yPos + i];\n  else for (let i = 0; i < 256; i++) x[outPos + i] = A2_BUF[i] ^ x[xPos + i] ^ x[yPos + i];\n  A2_BUF.fill(0);\n}\n\n// Used only inside argon2Blocks!\nfunction indexAlpha(\n  r: number,\n  s: number,\n  laneLen: number,\n  segmentLen: number,\n  index: number,\n  randL: number,\n  sameLane: boolean = false,\n) {\n  // RFC 9106 §3.4.2 Figures 12-13: map `J1` / `J2` into the current lane's reference area `W`.\n  let area: number;\n\n  if (r === 0) {\n    if (s === 0) area = index - 1;\n    else if (sameLane) area = s * segmentLen + index - 1;\n    else area = s * segmentLen + (index === 0 ? -1 : 0);\n  } else if (sameLane) area = laneLen - segmentLen + index - 1;\n  else area = laneLen - segmentLen + (index === 0 ? -1 : 0);\n  const startPos = r !== 0 && s !== ARGON2_SYNC_POINTS - 1 ? (s + 1) * segmentLen : 0;\n  // RFC 9106 Figure 13: `mul(randL, randL).h` is `floor(J_1^2 / 2^32)`, and the outer high-half\n  // multiply computes `floor(|W| * x / 2^32)` without floating-point math.\n  const rel = area - 1 - mul(area, mul(randL, randL).h).h;\n\n  return (startPos + rel) % laneLen;\n}\n\nconst bytesOfWords = (words: Uint32Array): Uint8Array => {\n  const bytes = new Uint8Array(words.length * 4);\n  const view = new DataView(bytes.buffer);\n\n  for (let i = 0; i < words.length; i++) view.setUint32(i * 4, words[i], true);\n\n  return bytes;\n};\n\nconst hash = (data: Uint8Array, length = 64) => {\n  const state = new Blake2b(length);\n\n  try {\n    return state.update(data).digest();\n  } finally {\n    state.destroy();\n  }\n};\n\n// RFC 9106 H': preserve byte tails, including output lengths not divisible by four.\nfunction variableHash(words: Uint32Array, length: number): Uint8Array {\n  const data = bytesOfWords(words);\n  const prefix = new Uint8Array(4);\n\n  new DataView(prefix.buffer).setUint32(0, length, true);\n  const state = new Blake2b(Math.min(length, 64));\n  let previous: Uint8Array | undefined;\n  let out: Uint8Array | undefined;\n\n  try {\n    previous = state.update(prefix).update(data).digest();\n    if (length <= 64) {\n      const result = previous;\n\n      previous = undefined;\n\n      return result;\n    }\n    out = new Uint8Array(length);\n    out.set(previous.subarray(0, 32));\n    let position = 32;\n\n    for (; length - position > 64; position += 32) {\n      const next = hash(previous);\n\n      previous.fill(0);\n      previous = next;\n      out.set(previous.subarray(0, 32), position);\n    }\n    const last = hash(previous, length - position);\n\n    out.set(last, position);\n    last.fill(0);\n\n    return out;\n  } catch (error) {\n    out?.fill(0);\n    throw error;\n  } finally {\n    state.destroy();\n    previous?.fill(0);\n    prefix.fill(0);\n    data.fill(0);\n  }\n}\n\nexport interface State {\n  readonly memory: Uint32Array;\n  readonly scratch: Uint32Array;\n  readonly address: Uint32Array;\n  readonly initial: Uint32Array;\n  readonly final: Uint32Array;\n  readonly blocks: number;\n  readonly laneLength: number;\n  readonly segmentLength: number;\n}\n\n// Allocate before absorbing secrets. Kdf has already applied Schema/resource limits.\nexport const allocate = (input: Argon2Parameters): State => {\n  const blocks = 4 * input.parallelism * Math.floor(input.memoryKiB / (4 * input.parallelism));\n  const laneLength = blocks / input.parallelism;\n\n  return {\n    memory: new Uint32Array(blocks * 256),\n    scratch: new Uint32Array(256),\n    address: new Uint32Array(3 * 256),\n    initial: new Uint32Array(18),\n    final: new Uint32Array(256),\n    blocks,\n    laneLength,\n    segmentLength: laneLength / 4,\n  };\n};\n\nexport const destroy = (state: State): void => {\n  state.memory.fill(0);\n  state.scratch.fill(0);\n  state.address.fill(0);\n  state.initial.fill(0);\n  state.final.fill(0);\n};\n\nexport const initialize = (state: State, input: Argon2Parameters): void => {\n  const h = new Blake2b();\n  const scalar = new Uint8Array(4);\n  const view = new DataView(scalar.buffer);\n\n  const number = (value: number) => {\n    view.setUint32(0, value, true);\n    h.update(scalar);\n  };\n\n  try {\n    for (const value of [input.parallelism, input.length, input.memoryKiB, input.passes, 19, 2])\n      number(value);\n    for (const data of [\n      input.password,\n      input.salt,\n      input.secret ?? new Uint8Array(),\n      input.associatedData,\n    ]) {\n      number(data.length);\n      h.update(data);\n    }\n    const initial = h.digest();\n\n    try {\n      const hashView = new DataView(initial.buffer, initial.byteOffset, initial.byteLength);\n\n      for (let i = 0; i < 16; i++) state.initial[i] = hashView.getUint32(i * 4, true);\n    } finally {\n      initial.fill(0);\n    }\n    for (let lane = 0; lane < input.parallelism; lane++) {\n      state.initial[17] = lane;\n      for (let first = 0; first < 2; first++) {\n        state.initial[16] = first;\n        const expanded = variableHash(state.initial, 1024);\n\n        try {\n          const expandedView = new DataView(\n            expanded.buffer,\n            expanded.byteOffset,\n            expanded.byteLength,\n          );\n\n          const offset = (lane * state.laneLength + first) * 256;\n\n          for (let i = 0; i < 256; i++)\n            state.memory[offset + i] = expandedView.getUint32(i * 4, true);\n        } finally {\n          expanded.fill(0);\n        }\n      }\n    }\n  } finally {\n    h.destroy();\n    scalar.fill(0);\n    state.initial.fill(0);\n  }\n};\n\n/** Yield block boundaries to the Effect driver; all scratch belongs to this derivation. */\nexport function* fill(state: State, input: Argon2Parameters): Generator<void, void> {\n  const { memory: B, scratch, address, laneLength: laneLen, segmentLength: segmentLen } = state;\n  const p = input.parallelism;\n\n  address[256 + 6] = state.blocks;\n  address[256 + 8] = input.passes;\n  address[256 + 10] = 2;\n  for (let r = 0; r < input.passes; r++) {\n    const needXor = r !== 0;\n\n    address[256] = r;\n    for (let s = 0; s < ARGON2_SYNC_POINTS; s++) {\n      address[256 + 4] = s;\n      const dataIndependent = r === 0 && s < 2;\n\n      for (let lane = 0; lane < p; lane++) {\n        address[256 + 2] = lane;\n        address[256 + 12] = 0;\n        const start = r === 0 && s === 0 ? 2 : 0;\n\n        if (start === 2 && dataIndependent) {\n          address[256 + 12]++;\n          block(scratch, address, 256, 512, 0, false);\n          block(scratch, address, 0, 512, 0, false);\n        }\n        let offset = lane * laneLen + s * segmentLen + start;\n\n        for (let index = start; index < segmentLen; index++, offset++) {\n          const prev = offset % laneLen ? offset - 1 : offset + laneLen - 1;\n          let randL: number;\n          let randH: number;\n\n          if (dataIndependent) {\n            const addressIndex = index % 128;\n\n            if (addressIndex === 0) {\n              address[256 + 12]++;\n              block(scratch, address, 256, 512, 0, false);\n              block(scratch, address, 0, 512, 0, false);\n            }\n            randL = address[2 * addressIndex];\n            randH = address[2 * addressIndex + 1];\n          } else {\n            randL = B[256 * prev];\n            randH = B[256 * prev + 1];\n          }\n          const refLane = r === 0 && s === 0 ? lane : randH % p;\n          const refPos = indexAlpha(r, s, laneLen, segmentLen, index, randL, refLane === lane);\n\n          block(scratch, B, 256 * prev, 256 * (laneLen * refLane + refPos), offset * 256, needXor);\n          yield;\n        }\n      }\n    }\n  }\n}\n\nexport const output = (state: State, input: Argon2Parameters): Uint8Array => {\n  for (let lane = 0; lane < input.parallelism; lane++) {\n    const offset = 256 * (state.laneLength * lane + state.laneLength - 1);\n\n    for (let word = 0; word < 256; word++) state.final[word] ^= state.memory[offset + word];\n  }\n\n  return variableHash(state.final, input.length);\n};\n"],"mappings":";;;;;;;;AASA,MAAM,qBAAqB;AAG3B,SAAS,IAAI,GAAW,GAAW;CAEjC,MAAM,KAAK,IAAI;CACf,MAAM,KAAK,MAAM;CACjB,MAAM,KAAK,IAAI;CACf,MAAM,KAAK,MAAM;CACjB,MAAM,KAAK,KAAK,KAAK,IAAI,EAAE;CAC3B,MAAM,KAAK,KAAK,KAAK,IAAI,EAAE;CAC3B,MAAM,KAAK,KAAK,KAAK,IAAI,EAAE;CAC3B,MAAM,KAAK,KAAK,KAAK,IAAI,EAAE;CAC3B,MAAM,SAAS,OAAO,OAAO,KAAK,SAAU;CAI5C,OAAO;EAAE,GAHK,MAAM,OAAO,OAAO,UAAU,MAAO;EAGjC,GAFL,SAAS,KAAO,KAAK;CAET;AAC3B;AAGA,SAAS,MAAM,GAAW,GAAmB;CAC3C,MAAM,KAAK,IAAI,OACb,KAAK,MAAM,IACX,KAAK,IAAI,OACT,KAAK,MAAM;CAEb,MAAM,SAAS,KAAK,KAAK,IAAI,EAAE,MAAM,OAAO,KAAK,KAAK,IAAI,EAAE,IAAI,SAAU,KAAK,KAAK,IAAI,EAAE;CAE1F,OAAQ,KAAK,KAAK,IAAI,EAAE,KAAK,KAAK,KAAK,IAAI,EAAE,MAAM,OAAO,UAAU,MAAO;AAC7E;AASA,SAAS,EAAE,QAAqB,GAAW,GAAW,GAAW,GAAW;CAC1E,IAAI,KAAK,OAAO,IAAI,IAClB,KAAK,OAAO,IAAI,IAAI;CAEtB,IAAI,KAAK,OAAO,IAAI,IAClB,KAAK,OAAO,IAAI,IAAI;CAEtB,IAAI,KAAK,OAAO,IAAI,IAClB,KAAK,OAAO,IAAI,IAAI;CAEtB,IAAI,KAAK,OAAO,IAAI,IAClB,KAAK,OAAO,IAAI,IAAI;CAEtB,IAAI,KAAK,GACP,KAAK,GACL,KAAK,GACL,KAAK,GACL,KAAK;CAGP,KAAK,KAAK,KAAK,IAAI,EAAE;CACrB,KAAK,MAAM,IAAI,EAAE;CACjB,MAAM,OAAO,MAAM,OAAO,MAAO,MAAM,MAAO;CAC9C,KAAM,KAAK,MAAO,MAAM,IAAM,OAAO,OAAS,KAAK,aAAe,KAAM;CACxE,KAAK,KAAK;CACV,KAAK,KAAK;CACV,KAAK,KAAK;CACV,KAAK,QAAQ,IAAI,EAAE;CACnB,KAAK,QAAQ,IAAI,EAAE;CAGnB,KAAK,KAAK,KAAK,IAAI,EAAE;CACrB,KAAK,MAAM,IAAI,EAAE;CACjB,MAAM,OAAO,MAAM,OAAO,MAAO,MAAM,MAAO;CAC9C,KAAM,KAAK,MAAO,MAAM,IAAM,OAAO,OAAS,KAAK,aAAe,KAAM;CACxE,KAAK,KAAK;CACV,KAAK,KAAK;CACV,KAAK,KAAK;CACV,KAAK,OAAO,IAAI,IAAI,EAAE;CACtB,KAAK,OAAO,IAAI,IAAI,EAAE;CAGtB,KAAK,KAAK,KAAK,IAAI,EAAE;CACrB,KAAK,MAAM,IAAI,EAAE;CACjB,MAAM,OAAO,MAAM,OAAO,MAAO,MAAM,MAAO;CAC9C,KAAM,KAAK,MAAO,MAAM,IAAM,OAAO,OAAS,KAAK,aAAe,KAAM;CACxE,KAAK,KAAK;CACV,KAAK,KAAK;CACV,KAAK,KAAK;CACV,KAAK,OAAO,IAAI,IAAI,EAAE;CACtB,KAAK,OAAO,IAAI,IAAI,EAAE;CAGtB,KAAK,KAAK,KAAK,IAAI,EAAE;CACrB,KAAK,MAAM,IAAI,EAAE;CACjB,MAAM,OAAO,MAAM,OAAO,MAAO,MAAM,MAAO;CAC9C,KAAM,KAAK,MAAO,MAAM,IAAM,OAAO,OAAS,KAAK,aAAe,KAAM;CACxE,KAAK,KAAK;CACV,KAAK,KAAK;CACV,KAAK,KAAK;CACV,KAAK,OAAO,IAAI,IAAI,EAAE;CACtB,KAAK,OAAO,IAAI,IAAI,EAAE;CAEtB,OAAO,IAAI,KAAK;CAChB,OAAO,IAAI,IAAI,KAAK;CACpB,OAAO,IAAI,KAAK;CAChB,OAAO,IAAI,IAAI,KAAK;CACpB,OAAO,IAAI,KAAK;CAChB,OAAO,IAAI,IAAI,KAAK;CACpB,OAAO,IAAI,KAAK;CAChB,OAAO,IAAI,IAAI,KAAK;AACtB;AAKA,SAAS,EACP,QACA,KACA,KACA,KACA,KACA,KACA,KACA,KACA,KACA,KACA,KACA,KACA,KACA,KACA,KACA,KACA,KACA;CAEA,EAAE,QAAQ,KAAK,KAAK,KAAK,GAAG;CAC5B,EAAE,QAAQ,KAAK,KAAK,KAAK,GAAG;CAC5B,EAAE,QAAQ,KAAK,KAAK,KAAK,GAAG;CAC5B,EAAE,QAAQ,KAAK,KAAK,KAAK,GAAG;CAC5B,EAAE,QAAQ,KAAK,KAAK,KAAK,GAAG;CAC5B,EAAE,QAAQ,KAAK,KAAK,KAAK,GAAG;CAC5B,EAAE,QAAQ,KAAK,KAAK,KAAK,GAAG;CAC5B,EAAE,QAAQ,KAAK,KAAK,KAAK,GAAG;AAC9B;AAEA,SAAS,MACP,QACA,GACA,MACA,MACA,QACA,SACA;CACA,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,KAAK,OAAO,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO;CAEjE,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,KAAK,IAC5B,EACE,QACA,GACA,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,EACN;CAGF,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK,GAC3B,EACE,QACA,GACA,IAAI,GACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,KACJ,IAAI,GACN;CAIF,IAAI,SAAS,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,KAAK,EAAE,SAAS,MAAM,OAAO,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO;MAC1F,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,KAAK,EAAE,SAAS,KAAK,OAAO,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO;CACtF,OAAO,KAAK,CAAC;AACf;AAGA,SAAS,WACP,GACA,GACA,SACA,YACA,OACA,OACA,WAAoB,OACpB;CAEA,IAAI;CAEJ,IAAI,MAAM,GAAG;EACX,IAAI,MAAM,GAAG,OAAO,QAAQ;OACvB,IAAI,UAAU,OAAO,IAAI,aAAa,QAAQ;OAC9C,OAAO,IAAI,cAAc,UAAU,IAAI,KAAK;CACnD,OAAO,IAAI,UAAU,OAAO,UAAU,aAAa,QAAQ;MACtD,OAAO,UAAU,cAAc,UAAU,IAAI,KAAK;CAMvD,SALiB,MAAM,KAAK,MAAM,KAA0B,IAAI,KAAK,aAAa,MAGtE,OAAO,IAAI,IAAI,MAAM,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAE5B;AAC5B;AAEA,MAAM,gBAAgB,UAAmC;CACvD,MAAM,QAAQ,IAAI,WAAW,MAAM,SAAS,CAAC;CAC7C,MAAM,OAAO,IAAI,SAAS,MAAM,MAAM;CAEtC,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,KAAK,UAAU,IAAI,GAAG,MAAM,IAAI,IAAI;CAE3E,OAAO;AACT;AAEA,MAAM,QAAQ,MAAkB,SAAS,OAAO;CAC9C,MAAM,QAAQ,IAAI,QAAQ,MAAM;CAEhC,IAAI;EACF,OAAO,MAAM,OAAO,IAAI,CAAC,CAAC,OAAO;CACnC,UAAU;EACR,MAAM,QAAQ;CAChB;AACF;AAGA,SAAS,aAAa,OAAoB,QAA4B;CACpE,MAAM,OAAO,aAAa,KAAK;CAC/B,MAAM,yBAAS,IAAI,WAAW,CAAC;CAE/B,IAAI,SAAS,OAAO,MAAM,CAAC,CAAC,UAAU,GAAG,QAAQ,IAAI;CACrD,MAAM,QAAQ,IAAI,QAAQ,KAAK,IAAI,QAAQ,EAAE,CAAC;CAC9C,IAAI;CACJ,IAAI;CAEJ,IAAI;EACF,WAAW,MAAM,OAAO,MAAM,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO;EACpD,IAAI,UAAU,IAAI;GAChB,MAAM,SAAS;GAEf,WAAW,KAAA;GAEX,OAAO;EACT;EACA,MAAM,IAAI,WAAW,MAAM;EAC3B,IAAI,IAAI,SAAS,SAAS,GAAG,EAAE,CAAC;EAChC,IAAI,WAAW;EAEf,OAAO,SAAS,WAAW,IAAI,YAAY,IAAI;GAC7C,MAAM,OAAO,KAAK,QAAQ;GAE1B,SAAS,KAAK,CAAC;GACf,WAAW;GACX,IAAI,IAAI,SAAS,SAAS,GAAG,EAAE,GAAG,QAAQ;EAC5C;EACA,MAAM,OAAO,KAAK,UAAU,SAAS,QAAQ;EAE7C,IAAI,IAAI,MAAM,QAAQ;EACtB,KAAK,KAAK,CAAC;EAEX,OAAO;CACT,SAAS,OAAO;EACd,KAAK,KAAK,CAAC;EACX,MAAM;CACR,UAAU;EACR,MAAM,QAAQ;EACd,UAAU,KAAK,CAAC;EAChB,OAAO,KAAK,CAAC;EACb,KAAK,KAAK,CAAC;CACb;AACF;AAcA,MAAa,YAAY,UAAmC;CAC1D,MAAM,SAAS,IAAI,MAAM,cAAc,KAAK,MAAM,MAAM,aAAa,IAAI,MAAM,YAAY;CAC3F,MAAM,aAAa,SAAS,MAAM;CAElC,OAAO;EACL,QAAQ,IAAI,YAAY,SAAS,GAAG;EACpC,yBAAS,IAAI,YAAY,GAAG;EAC5B,yBAAS,IAAI,YAAY,GAAO;EAChC,yBAAS,IAAI,YAAY,EAAE;EAC3B,uBAAO,IAAI,YAAY,GAAG;EAC1B;EACA;EACA,eAAe,aAAa;CAC9B;AACF;AAEA,MAAa,WAAW,UAAuB;CAC7C,MAAM,OAAO,KAAK,CAAC;CACnB,MAAM,QAAQ,KAAK,CAAC;CACpB,MAAM,QAAQ,KAAK,CAAC;CACpB,MAAM,QAAQ,KAAK,CAAC;CACpB,MAAM,MAAM,KAAK,CAAC;AACpB;AAEA,MAAa,cAAc,OAAc,UAAkC;CACzE,MAAM,IAAI,IAAI,QAAQ;CACtB,MAAM,yBAAS,IAAI,WAAW,CAAC;CAC/B,MAAM,OAAO,IAAI,SAAS,OAAO,MAAM;CAEvC,MAAM,UAAU,UAAkB;EAChC,KAAK,UAAU,GAAG,OAAO,IAAI;EAC7B,EAAE,OAAO,MAAM;CACjB;CAEA,IAAI;EACF,KAAK,MAAM,SAAS;GAAC,MAAM;GAAa,MAAM;GAAQ,MAAM;GAAW,MAAM;GAAQ;GAAI;EAAC,GACxF,OAAO,KAAK;EACd,KAAK,MAAM,QAAQ;GACjB,MAAM;GACN,MAAM;GACN,MAAM,0BAAU,IAAI,WAAW;GAC/B,MAAM;EACR,GAAG;GACD,OAAO,KAAK,MAAM;GAClB,EAAE,OAAO,IAAI;EACf;EACA,MAAM,UAAU,EAAE,OAAO;EAEzB,IAAI;GACF,MAAM,WAAW,IAAI,SAAS,QAAQ,QAAQ,QAAQ,YAAY,QAAQ,UAAU;GAEpF,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK,MAAM,QAAQ,KAAK,SAAS,UAAU,IAAI,GAAG,IAAI;EAChF,UAAU;GACR,QAAQ,KAAK,CAAC;EAChB;EACA,KAAK,IAAI,OAAO,GAAG,OAAO,MAAM,aAAa,QAAQ;GACnD,MAAM,QAAQ,MAAM;GACpB,KAAK,IAAI,QAAQ,GAAG,QAAQ,GAAG,SAAS;IACtC,MAAM,QAAQ,MAAM;IACpB,MAAM,WAAW,aAAa,MAAM,SAAS,IAAI;IAEjD,IAAI;KACF,MAAM,eAAe,IAAI,SACvB,SAAS,QACT,SAAS,YACT,SAAS,UACX;KAEA,MAAM,UAAU,OAAO,MAAM,aAAa,SAAS;KAEnD,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,KACvB,MAAM,OAAO,SAAS,KAAK,aAAa,UAAU,IAAI,GAAG,IAAI;IACjE,UAAU;KACR,SAAS,KAAK,CAAC;IACjB;GACF;EACF;CACF,UAAU;EACR,EAAE,QAAQ;EACV,OAAO,KAAK,CAAC;EACb,MAAM,QAAQ,KAAK,CAAC;CACtB;AACF;;AAGA,UAAiB,KAAK,OAAc,OAAgD;CAClF,MAAM,EAAE,QAAQ,GAAG,SAAS,SAAS,YAAY,SAAS,eAAe,eAAe;CACxF,MAAM,IAAI,MAAM;CAEhB,QAAQ,OAAW,MAAM;CACzB,QAAQ,OAAW,MAAM;CACzB,QAAQ,OAAY;CACpB,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;EACrC,MAAM,UAAU,MAAM;EAEtB,QAAQ,OAAO;EACf,KAAK,IAAI,IAAI,GAAG,IAAI,oBAAoB,KAAK;GAC3C,QAAQ,OAAW;GACnB,MAAM,kBAAkB,MAAM,KAAK,IAAI;GAEvC,KAAK,IAAI,OAAO,GAAG,OAAO,GAAG,QAAQ;IACnC,QAAQ,OAAW;IACnB,QAAQ,OAAY;IACpB,MAAM,QAAQ,MAAM,KAAK,MAAM,IAAI,IAAI;IAEvC,IAAI,UAAU,KAAK,iBAAiB;KAClC,QAAQ,IAAS;KACjB,MAAM,SAAS,SAAS,KAAK,KAAK,GAAG,KAAK;KAC1C,MAAM,SAAS,SAAS,GAAG,KAAK,GAAG,KAAK;IAC1C;IACA,IAAI,SAAS,OAAO,UAAU,IAAI,aAAa;IAE/C,KAAK,IAAI,QAAQ,OAAO,QAAQ,YAAY,SAAS,UAAU;KAC7D,MAAM,OAAO,SAAS,UAAU,SAAS,IAAI,SAAS,UAAU;KAChE,IAAI;KACJ,IAAI;KAEJ,IAAI,iBAAiB;MACnB,MAAM,eAAe,QAAQ;MAE7B,IAAI,iBAAiB,GAAG;OACtB,QAAQ,IAAS;OACjB,MAAM,SAAS,SAAS,KAAK,KAAK,GAAG,KAAK;OAC1C,MAAM,SAAS,SAAS,GAAG,KAAK,GAAG,KAAK;MAC1C;MACA,QAAQ,QAAQ,IAAI;MACpB,QAAQ,QAAQ,IAAI,eAAe;KACrC,OAAO;MACL,QAAQ,EAAE,MAAM;MAChB,QAAQ,EAAE,MAAM,OAAO;KACzB;KACA,MAAM,UAAU,MAAM,KAAK,MAAM,IAAI,OAAO,QAAQ;KACpD,MAAM,SAAS,WAAW,GAAG,GAAG,SAAS,YAAY,OAAO,OAAO,YAAY,IAAI;KAEnF,MAAM,SAAS,GAAG,MAAM,MAAM,OAAO,UAAU,UAAU,SAAS,SAAS,KAAK,OAAO;KACvF;IACF;GACF;EACF;CACF;AACF;AAEA,MAAa,UAAU,OAAc,UAAwC;CAC3E,KAAK,IAAI,OAAO,GAAG,OAAO,MAAM,aAAa,QAAQ;EACnD,MAAM,SAAS,OAAO,MAAM,aAAa,OAAO,MAAM,aAAa;EAEnE,KAAK,IAAI,OAAO,GAAG,OAAO,KAAK,QAAQ,MAAM,MAAM,SAAS,MAAM,OAAO,SAAS;CACpF;CAEA,OAAO,aAAa,MAAM,OAAO,MAAM,MAAM;AAC/C"}
+{"version":3,"file":"argon2-core.mjs","names":[],"sources":["../../src/internal/argon2-core.ts"],"sourcesContent":["import { Blake2b } from \"./blake2b\";\nimport type { Argon2Parameters } from \"./kdf\";\n/**\n * Adapted from noble-hashes, Copyright (c) 2022 Paul Miller.\n * MIT; source revision 8060cc83bbab6681d23c9eed071db3f3a6b442da.\n * See ../../THIRD_PARTY_NOTICES.md for source mapping and license.\n */\nimport { rotr32H, rotr32L, rotrBH, rotrBL, rotrSH, rotrSL } from \"./word64\";\n\nconst ARGON2_SYNC_POINTS = 4;\n\n// Unsigned `u32 * u32 = { h, l }`, returned as split 64-bit halves.\nfunction mul(a: number, b: number) {\n  // Split into 16-bit limbs so each partial product stays exact under `Math.imul`.\n  const aL = a & 0xffff;\n  const aH = a >>> 16;\n  const bL = b & 0xffff;\n  const bH = b >>> 16;\n  const ll = Math.imul(aL, bL);\n  const hl = Math.imul(aH, bL);\n  const lh = Math.imul(aL, bH);\n  const hh = Math.imul(aH, bH);\n  const carry = (ll >>> 16) + (hl & 0xffff) + lh;\n  const high = (hh + (hl >>> 16) + (carry >>> 16)) | 0;\n  const low = (carry << 16) | (ll & 0xffff);\n\n  return { h: high, l: low };\n}\n\n// High 32 bits of unsigned u32 multiply, via the same 16-bit limb split as `mul`.\nfunction mulHi(a: number, b: number): number {\n  const aL = a & 0xffff,\n    aH = a >>> 16,\n    bL = b & 0xffff,\n    bH = b >>> 16;\n\n  const carry = (Math.imul(aL, bL) >>> 16) + (Math.imul(aH, bL) & 0xffff) + Math.imul(aL, bH);\n\n  return (Math.imul(aH, bH) + (Math.imul(aH, bL) >>> 16) + (carry >>> 16)) | 0;\n}\n\n// 1024-byte block: 256 u32 = 128 interleaved low/high halves = RFC's\n// 8x8 matrix of 16-byte registers.\n\n// Quarter-round over 64-bit word indices into `A2_BUF`; each index maps to adjacent low/high u32s.\n// Each BlaMka step `X = X + Y + 2 * trunc(X) * trunc(Y)` (trunc = low 32 bits) is three lines:\n// `Math.imul` is the low product half, `mulHi` the high half, then a split 64-bit add with the\n// doubling folded in. RFC 9106 Figure 19 GB rotates by 32, 24, 16, and 63 bits after each XOR.\nfunction G(A2_BUF: Uint32Array, a: number, b: number, c: number, d: number) {\n  let Al = A2_BUF[2 * a],\n    Ah = A2_BUF[2 * a + 1];\n\n  let Bl = A2_BUF[2 * b],\n    Bh = A2_BUF[2 * b + 1];\n\n  let Cl = A2_BUF[2 * c],\n    Ch = A2_BUF[2 * c + 1];\n\n  let Dl = A2_BUF[2 * d],\n    Dh = A2_BUF[2 * d + 1];\n\n  let ml = 0,\n    mh = 0,\n    rl = 0,\n    xh = 0,\n    xl = 0;\n\n  // A = blamka(A, B); D = rotr64(D ^ A, 32)\n  ml = Math.imul(Al, Bl);\n  mh = mulHi(Al, Bl);\n  rl = (Al >>> 0) + (Bl >>> 0) + ((ml << 1) >>> 0);\n  Ah = (Ah + Bh + ((mh << 1) | (ml >>> 31)) + ((rl / 0x100000000) | 0)) | 0;\n  Al = rl | 0;\n  xh = Dh ^ Ah;\n  xl = Dl ^ Al;\n  Dh = rotr32H(xh, xl);\n  Dl = rotr32L(xh, xl);\n\n  // C = blamka(C, D); B = rotr64(B ^ C, 24)\n  ml = Math.imul(Cl, Dl);\n  mh = mulHi(Cl, Dl);\n  rl = (Cl >>> 0) + (Dl >>> 0) + ((ml << 1) >>> 0);\n  Ch = (Ch + Dh + ((mh << 1) | (ml >>> 31)) + ((rl / 0x100000000) | 0)) | 0;\n  Cl = rl | 0;\n  xh = Bh ^ Ch;\n  xl = Bl ^ Cl;\n  Bh = rotrSH(xh, xl, 24);\n  Bl = rotrSL(xh, xl, 24);\n\n  // A = blamka(A, B); D = rotr64(D ^ A, 16)\n  ml = Math.imul(Al, Bl);\n  mh = mulHi(Al, Bl);\n  rl = (Al >>> 0) + (Bl >>> 0) + ((ml << 1) >>> 0);\n  Ah = (Ah + Bh + ((mh << 1) | (ml >>> 31)) + ((rl / 0x100000000) | 0)) | 0;\n  Al = rl | 0;\n  xh = Dh ^ Ah;\n  xl = Dl ^ Al;\n  Dh = rotrSH(xh, xl, 16);\n  Dl = rotrSL(xh, xl, 16);\n\n  // C = blamka(C, D); B = rotr64(B ^ C, 63)\n  ml = Math.imul(Cl, Dl);\n  mh = mulHi(Cl, Dl);\n  rl = (Cl >>> 0) + (Dl >>> 0) + ((ml << 1) >>> 0);\n  Ch = (Ch + Dh + ((mh << 1) | (ml >>> 31)) + ((rl / 0x100000000) | 0)) | 0;\n  Cl = rl | 0;\n  xh = Bh ^ Ch;\n  xl = Bl ^ Cl;\n  Bh = rotrBH(xh, xl, 63);\n  Bl = rotrBL(xh, xl, 63);\n\n  A2_BUF[2 * a] = Al;\n  A2_BUF[2 * a + 1] = Ah;\n  A2_BUF[2 * b] = Bl;\n  A2_BUF[2 * b + 1] = Bh;\n  A2_BUF[2 * c] = Cl;\n  A2_BUF[2 * c + 1] = Ch;\n  A2_BUF[2 * d] = Dl;\n  A2_BUF[2 * d + 1] = Dh;\n}\n\n// Argon2 permutation over 16 register indices into `A2_BUF`, not the register values themselves.\n// RFC 9106 Figure 17: these arguments are the 16 `v0..v15` 64-bit word\n// indices inside eight 16-byte inputs, not copied word values.\nfunction P(\n  A2_BUF: Uint32Array,\n  v00: number,\n  v01: number,\n  v02: number,\n  v03: number,\n  v04: number,\n  v05: number,\n  v06: number,\n  v07: number,\n  v08: number,\n  v09: number,\n  v10: number,\n  v11: number,\n  v12: number,\n  v13: number,\n  v14: number,\n  v15: number,\n) {\n  // RFC 9106 Figure 18: first apply GB across rows, then across columns of the 8x8 register matrix.\n  G(A2_BUF, v00, v04, v08, v12);\n  G(A2_BUF, v01, v05, v09, v13);\n  G(A2_BUF, v02, v06, v10, v14);\n  G(A2_BUF, v03, v07, v11, v15);\n  G(A2_BUF, v00, v05, v10, v15);\n  G(A2_BUF, v01, v06, v11, v12);\n  G(A2_BUF, v02, v07, v08, v13);\n  G(A2_BUF, v03, v04, v09, v14);\n}\n\nfunction block(\n  A2_BUF: Uint32Array,\n  x: Uint32Array,\n  xPos: number,\n  yPos: number,\n  outPos: number,\n  needXor: boolean,\n) {\n  for (let i = 0; i < 256; i++) A2_BUF[i] = x[xPos + i] ^ x[yPos + i];\n  // rows (8 consecutive 16-register groups)\n  for (let i = 0; i < 128; i += 16) {\n    P(\n      A2_BUF,\n      i,\n      i + 1,\n      i + 2,\n      i + 3,\n      i + 4,\n      i + 5,\n      i + 6,\n      i + 7,\n      i + 8,\n      i + 9,\n      i + 10,\n      i + 11,\n      i + 12,\n      i + 13,\n      i + 14,\n      i + 15,\n    );\n  }\n  // columns (8 strided 16-register groups)\n  for (let i = 0; i < 16; i += 2) {\n    P(\n      A2_BUF,\n      i,\n      i + 1,\n      i + 16,\n      i + 17,\n      i + 32,\n      i + 33,\n      i + 48,\n      i + 49,\n      i + 64,\n      i + 65,\n      i + 80,\n      i + 81,\n      i + 96,\n      i + 97,\n      i + 112,\n      i + 113,\n    );\n  }\n\n  // RFC 9106 step 6: passes after the first XOR the old destination block into the new G(X, Y).\n  if (needXor) for (let i = 0; i < 256; i++) x[outPos + i] ^= A2_BUF[i] ^ x[xPos + i] ^ x[yPos + i];\n  else for (let i = 0; i < 256; i++) x[outPos + i] = A2_BUF[i] ^ x[xPos + i] ^ x[yPos + i];\n  A2_BUF.fill(0);\n}\n\n// Used only inside argon2Blocks!\nfunction indexAlpha(\n  r: number,\n  s: number,\n  laneLen: number,\n  segmentLen: number,\n  index: number,\n  randL: number,\n  sameLane: boolean = false,\n) {\n  // RFC 9106 §3.4.2 Figures 12-13: map `J1` / `J2` into the current lane's reference area `W`.\n  let area: number;\n\n  if (r === 0) {\n    if (s === 0) area = index - 1;\n    else if (sameLane) area = s * segmentLen + index - 1;\n    else area = s * segmentLen + (index === 0 ? -1 : 0);\n  } else if (sameLane) area = laneLen - segmentLen + index - 1;\n  else area = laneLen - segmentLen + (index === 0 ? -1 : 0);\n  const startPos = r !== 0 && s !== ARGON2_SYNC_POINTS - 1 ? (s + 1) * segmentLen : 0;\n  // RFC 9106 Figure 13: `mul(randL, randL).h` is `floor(J_1^2 / 2^32)`, and the outer high-half\n  // multiply computes `floor(|W| * x / 2^32)` without floating-point math.\n  const rel = area - 1 - mul(area, mul(randL, randL).h).h;\n\n  return (startPos + rel) % laneLen;\n}\n\nconst bytesOfWords = (words: Uint32Array): Uint8Array => {\n  const bytes = new Uint8Array(words.length * 4);\n  const view = new DataView(bytes.buffer);\n\n  for (let i = 0; i < words.length; i++) view.setUint32(i * 4, words[i], true);\n\n  return bytes;\n};\n\nconst hash = (data: Uint8Array, length = 64) => {\n  const state = new Blake2b(length);\n\n  try {\n    return state.update(data).digest();\n  } finally {\n    state.destroy();\n  }\n};\n\n// RFC 9106 H': preserve byte tails, including output lengths not divisible by four.\nfunction variableHash(words: Uint32Array, length: number): Uint8Array {\n  const data = bytesOfWords(words);\n  const prefix = new Uint8Array(4);\n\n  new DataView(prefix.buffer).setUint32(0, length, true);\n  const state = new Blake2b(Math.min(length, 64));\n  let previous: Uint8Array | undefined;\n  let out: Uint8Array | undefined;\n\n  try {\n    previous = state.update(prefix).update(data).digest();\n    if (length <= 64) {\n      const result = previous;\n\n      previous = undefined;\n\n      return result;\n    }\n    out = new Uint8Array(length);\n    out.set(previous.subarray(0, 32));\n    let position = 32;\n\n    for (; length - position > 64; position += 32) {\n      const next = hash(previous);\n\n      previous.fill(0);\n      previous = next;\n      out.set(previous.subarray(0, 32), position);\n    }\n    const last = hash(previous, length - position);\n\n    out.set(last, position);\n    last.fill(0);\n\n    return out;\n  } catch (error) {\n    out?.fill(0);\n    throw error;\n  } finally {\n    state.destroy();\n    previous?.fill(0);\n    prefix.fill(0);\n    data.fill(0);\n  }\n}\n\nexport interface State {\n  readonly memory: Uint32Array;\n  readonly scratch: Uint32Array;\n  readonly address: Uint32Array;\n  readonly initial: Uint32Array;\n  readonly final: Uint32Array;\n  readonly blocks: number;\n  readonly laneLength: number;\n  readonly segmentLength: number;\n}\n\n// Allocate before absorbing secrets. Kdf has already applied Schema/resource limits.\nexport const allocate = (\n  input: Argon2Parameters,\n  backing?: { readonly buffer: ArrayBuffer; readonly byteOffset: number },\n): State => {\n  const blocks = 4 * input.parallelism * Math.floor(input.memoryKiB / (4 * input.parallelism));\n  const laneLength = blocks / input.parallelism;\n  let offset = backing?.byteOffset ?? 0;\n\n  const words = (length: number) => {\n    if (backing === undefined) return new Uint32Array(length);\n    const view = new Uint32Array(backing.buffer, offset, length);\n\n    offset += view.byteLength;\n\n    return view;\n  };\n\n  return {\n    memory: words(blocks * 256),\n    scratch: words(256),\n    address: words(3 * 256),\n    initial: words(18),\n    final: words(256),\n    blocks,\n    laneLength,\n    segmentLength: laneLength / 4,\n  };\n};\n\nexport const destroy = (state: State): void => {\n  state.memory.fill(0);\n  state.scratch.fill(0);\n  state.address.fill(0);\n  state.initial.fill(0);\n  state.final.fill(0);\n};\n\nexport const initialize = (state: State, input: Argon2Parameters): void => {\n  const h = new Blake2b();\n  const scalar = new Uint8Array(4);\n  const view = new DataView(scalar.buffer);\n\n  const number = (value: number) => {\n    view.setUint32(0, value, true);\n    h.update(scalar);\n  };\n\n  try {\n    for (const value of [input.parallelism, input.length, input.memoryKiB, input.passes, 19, 2])\n      number(value);\n    for (const data of [\n      input.password,\n      input.salt,\n      input.secret ?? new Uint8Array(),\n      input.associatedData,\n    ]) {\n      number(data.length);\n      h.update(data);\n    }\n    const initial = h.digest();\n\n    try {\n      const hashView = new DataView(initial.buffer, initial.byteOffset, initial.byteLength);\n\n      for (let i = 0; i < 16; i++) state.initial[i] = hashView.getUint32(i * 4, true);\n    } finally {\n      initial.fill(0);\n    }\n    for (let lane = 0; lane < input.parallelism; lane++) {\n      state.initial[17] = lane;\n      for (let first = 0; first < 2; first++) {\n        state.initial[16] = first;\n        const expanded = variableHash(state.initial, 1024);\n\n        try {\n          const expandedView = new DataView(\n            expanded.buffer,\n            expanded.byteOffset,\n            expanded.byteLength,\n          );\n\n          const offset = (lane * state.laneLength + first) * 256;\n\n          for (let i = 0; i < 256; i++)\n            state.memory[offset + i] = expandedView.getUint32(i * 4, true);\n        } finally {\n          expanded.fill(0);\n        }\n      }\n    }\n  } finally {\n    h.destroy();\n    scalar.fill(0);\n    state.initial.fill(0);\n  }\n};\n\n/** Yield block boundaries to the Effect driver; all scratch belongs to this derivation. */\nexport function* fill(\n  state: State,\n  input: Argon2Parameters,\n  compress: typeof block = block,\n): Generator<void, void> {\n  const { memory: B, scratch, address, laneLength: laneLen, segmentLength: segmentLen } = state;\n  const p = input.parallelism;\n\n  address[256 + 6] = state.blocks;\n  address[256 + 8] = input.passes;\n  address[256 + 10] = 2;\n  for (let r = 0; r < input.passes; r++) {\n    const needXor = r !== 0;\n\n    address[256] = r;\n    for (let s = 0; s < ARGON2_SYNC_POINTS; s++) {\n      address[256 + 4] = s;\n      const dataIndependent = r === 0 && s < 2;\n\n      for (let lane = 0; lane < p; lane++) {\n        address[256 + 2] = lane;\n        address[256 + 12] = 0;\n        const start = r === 0 && s === 0 ? 2 : 0;\n\n        if (start === 2 && dataIndependent) {\n          address[256 + 12]++;\n          compress(scratch, address, 256, 512, 0, false);\n          compress(scratch, address, 0, 512, 0, false);\n        }\n        let offset = lane * laneLen + s * segmentLen + start;\n\n        for (let index = start; index < segmentLen; index++, offset++) {\n          const prev = offset % laneLen ? offset - 1 : offset + laneLen - 1;\n          let randL: number;\n          let randH: number;\n\n          if (dataIndependent) {\n            const addressIndex = index % 128;\n\n            if (addressIndex === 0) {\n              address[256 + 12]++;\n              compress(scratch, address, 256, 512, 0, false);\n              compress(scratch, address, 0, 512, 0, false);\n            }\n            randL = address[2 * addressIndex];\n            randH = address[2 * addressIndex + 1];\n          } else {\n            randL = B[256 * prev];\n            randH = B[256 * prev + 1];\n          }\n          const refLane = r === 0 && s === 0 ? lane : randH % p;\n          const refPos = indexAlpha(r, s, laneLen, segmentLen, index, randL, refLane === lane);\n\n          compress(\n            scratch,\n            B,\n            256 * prev,\n            256 * (laneLen * refLane + refPos),\n            offset * 256,\n            needXor,\n          );\n          yield;\n        }\n      }\n    }\n  }\n}\n\nexport const output = (state: State, input: Argon2Parameters): Uint8Array => {\n  for (let lane = 0; lane < input.parallelism; lane++) {\n    const offset = 256 * (state.laneLength * lane + state.laneLength - 1);\n\n    for (let word = 0; word < 256; word++) state.final[word] ^= state.memory[offset + word];\n  }\n\n  return variableHash(state.final, input.length);\n};\n"],"mappings":";;;;;;;;AASA,MAAM,qBAAqB;AAG3B,SAAS,IAAI,GAAW,GAAW;CAEjC,MAAM,KAAK,IAAI;CACf,MAAM,KAAK,MAAM;CACjB,MAAM,KAAK,IAAI;CACf,MAAM,KAAK,MAAM;CACjB,MAAM,KAAK,KAAK,KAAK,IAAI,EAAE;CAC3B,MAAM,KAAK,KAAK,KAAK,IAAI,EAAE;CAC3B,MAAM,KAAK,KAAK,KAAK,IAAI,EAAE;CAC3B,MAAM,KAAK,KAAK,KAAK,IAAI,EAAE;CAC3B,MAAM,SAAS,OAAO,OAAO,KAAK,SAAU;CAI5C,OAAO;EAAE,GAHK,MAAM,OAAO,OAAO,UAAU,MAAO;EAGjC,GAFL,SAAS,KAAO,KAAK;CAET;AAC3B;AAGA,SAAS,MAAM,GAAW,GAAmB;CAC3C,MAAM,KAAK,IAAI,OACb,KAAK,MAAM,IACX,KAAK,IAAI,OACT,KAAK,MAAM;CAEb,MAAM,SAAS,KAAK,KAAK,IAAI,EAAE,MAAM,OAAO,KAAK,KAAK,IAAI,EAAE,IAAI,SAAU,KAAK,KAAK,IAAI,EAAE;CAE1F,OAAQ,KAAK,KAAK,IAAI,EAAE,KAAK,KAAK,KAAK,IAAI,EAAE,MAAM,OAAO,UAAU,MAAO;AAC7E;AASA,SAAS,EAAE,QAAqB,GAAW,GAAW,GAAW,GAAW;CAC1E,IAAI,KAAK,OAAO,IAAI,IAClB,KAAK,OAAO,IAAI,IAAI;CAEtB,IAAI,KAAK,OAAO,IAAI,IAClB,KAAK,OAAO,IAAI,IAAI;CAEtB,IAAI,KAAK,OAAO,IAAI,IAClB,KAAK,OAAO,IAAI,IAAI;CAEtB,IAAI,KAAK,OAAO,IAAI,IAClB,KAAK,OAAO,IAAI,IAAI;CAEtB,IAAI,KAAK,GACP,KAAK,GACL,KAAK,GACL,KAAK,GACL,KAAK;CAGP,KAAK,KAAK,KAAK,IAAI,EAAE;CACrB,KAAK,MAAM,IAAI,EAAE;CACjB,MAAM,OAAO,MAAM,OAAO,MAAO,MAAM,MAAO;CAC9C,KAAM,KAAK,MAAO,MAAM,IAAM,OAAO,OAAS,KAAK,aAAe,KAAM;CACxE,KAAK,KAAK;CACV,KAAK,KAAK;CACV,KAAK,KAAK;CACV,KAAK,QAAQ,IAAI,EAAE;CACnB,KAAK,QAAQ,IAAI,EAAE;CAGnB,KAAK,KAAK,KAAK,IAAI,EAAE;CACrB,KAAK,MAAM,IAAI,EAAE;CACjB,MAAM,OAAO,MAAM,OAAO,MAAO,MAAM,MAAO;CAC9C,KAAM,KAAK,MAAO,MAAM,IAAM,OAAO,OAAS,KAAK,aAAe,KAAM;CACxE,KAAK,KAAK;CACV,KAAK,KAAK;CACV,KAAK,KAAK;CACV,KAAK,OAAO,IAAI,IAAI,EAAE;CACtB,KAAK,OAAO,IAAI,IAAI,EAAE;CAGtB,KAAK,KAAK,KAAK,IAAI,EAAE;CACrB,KAAK,MAAM,IAAI,EAAE;CACjB,MAAM,OAAO,MAAM,OAAO,MAAO,MAAM,MAAO;CAC9C,KAAM,KAAK,MAAO,MAAM,IAAM,OAAO,OAAS,KAAK,aAAe,KAAM;CACxE,KAAK,KAAK;CACV,KAAK,KAAK;CACV,KAAK,KAAK;CACV,KAAK,OAAO,IAAI,IAAI,EAAE;CACtB,KAAK,OAAO,IAAI,IAAI,EAAE;CAGtB,KAAK,KAAK,KAAK,IAAI,EAAE;CACrB,KAAK,MAAM,IAAI,EAAE;CACjB,MAAM,OAAO,MAAM,OAAO,MAAO,MAAM,MAAO;CAC9C,KAAM,KAAK,MAAO,MAAM,IAAM,OAAO,OAAS,KAAK,aAAe,KAAM;CACxE,KAAK,KAAK;CACV,KAAK,KAAK;CACV,KAAK,KAAK;CACV,KAAK,OAAO,IAAI,IAAI,EAAE;CACtB,KAAK,OAAO,IAAI,IAAI,EAAE;CAEtB,OAAO,IAAI,KAAK;CAChB,OAAO,IAAI,IAAI,KAAK;CACpB,OAAO,IAAI,KAAK;CAChB,OAAO,IAAI,IAAI,KAAK;CACpB,OAAO,IAAI,KAAK;CAChB,OAAO,IAAI,IAAI,KAAK;CACpB,OAAO,IAAI,KAAK;CAChB,OAAO,IAAI,IAAI,KAAK;AACtB;AAKA,SAAS,EACP,QACA,KACA,KACA,KACA,KACA,KACA,KACA,KACA,KACA,KACA,KACA,KACA,KACA,KACA,KACA,KACA,KACA;CAEA,EAAE,QAAQ,KAAK,KAAK,KAAK,GAAG;CAC5B,EAAE,QAAQ,KAAK,KAAK,KAAK,GAAG;CAC5B,EAAE,QAAQ,KAAK,KAAK,KAAK,GAAG;CAC5B,EAAE,QAAQ,KAAK,KAAK,KAAK,GAAG;CAC5B,EAAE,QAAQ,KAAK,KAAK,KAAK,GAAG;CAC5B,EAAE,QAAQ,KAAK,KAAK,KAAK,GAAG;CAC5B,EAAE,QAAQ,KAAK,KAAK,KAAK,GAAG;CAC5B,EAAE,QAAQ,KAAK,KAAK,KAAK,GAAG;AAC9B;AAEA,SAAS,MACP,QACA,GACA,MACA,MACA,QACA,SACA;CACA,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,KAAK,OAAO,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO;CAEjE,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,KAAK,IAC5B,EACE,QACA,GACA,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,EACN;CAGF,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK,GAC3B,EACE,QACA,GACA,IAAI,GACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,IACJ,IAAI,KACJ,IAAI,GACN;CAIF,IAAI,SAAS,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,KAAK,EAAE,SAAS,MAAM,OAAO,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO;MAC1F,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,KAAK,EAAE,SAAS,KAAK,OAAO,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO;CACtF,OAAO,KAAK,CAAC;AACf;AAGA,SAAS,WACP,GACA,GACA,SACA,YACA,OACA,OACA,WAAoB,OACpB;CAEA,IAAI;CAEJ,IAAI,MAAM,GAAG;EACX,IAAI,MAAM,GAAG,OAAO,QAAQ;OACvB,IAAI,UAAU,OAAO,IAAI,aAAa,QAAQ;OAC9C,OAAO,IAAI,cAAc,UAAU,IAAI,KAAK;CACnD,OAAO,IAAI,UAAU,OAAO,UAAU,aAAa,QAAQ;MACtD,OAAO,UAAU,cAAc,UAAU,IAAI,KAAK;CAMvD,SALiB,MAAM,KAAK,MAAM,KAA0B,IAAI,KAAK,aAAa,MAGtE,OAAO,IAAI,IAAI,MAAM,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAE5B;AAC5B;AAEA,MAAM,gBAAgB,UAAmC;CACvD,MAAM,QAAQ,IAAI,WAAW,MAAM,SAAS,CAAC;CAC7C,MAAM,OAAO,IAAI,SAAS,MAAM,MAAM;CAEtC,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,KAAK,UAAU,IAAI,GAAG,MAAM,IAAI,IAAI;CAE3E,OAAO;AACT;AAEA,MAAM,QAAQ,MAAkB,SAAS,OAAO;CAC9C,MAAM,QAAQ,IAAI,QAAQ,MAAM;CAEhC,IAAI;EACF,OAAO,MAAM,OAAO,IAAI,CAAC,CAAC,OAAO;CACnC,UAAU;EACR,MAAM,QAAQ;CAChB;AACF;AAGA,SAAS,aAAa,OAAoB,QAA4B;CACpE,MAAM,OAAO,aAAa,KAAK;CAC/B,MAAM,yBAAS,IAAI,WAAW,CAAC;CAE/B,IAAI,SAAS,OAAO,MAAM,CAAC,CAAC,UAAU,GAAG,QAAQ,IAAI;CACrD,MAAM,QAAQ,IAAI,QAAQ,KAAK,IAAI,QAAQ,EAAE,CAAC;CAC9C,IAAI;CACJ,IAAI;CAEJ,IAAI;EACF,WAAW,MAAM,OAAO,MAAM,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO;EACpD,IAAI,UAAU,IAAI;GAChB,MAAM,SAAS;GAEf,WAAW,KAAA;GAEX,OAAO;EACT;EACA,MAAM,IAAI,WAAW,MAAM;EAC3B,IAAI,IAAI,SAAS,SAAS,GAAG,EAAE,CAAC;EAChC,IAAI,WAAW;EAEf,OAAO,SAAS,WAAW,IAAI,YAAY,IAAI;GAC7C,MAAM,OAAO,KAAK,QAAQ;GAE1B,SAAS,KAAK,CAAC;GACf,WAAW;GACX,IAAI,IAAI,SAAS,SAAS,GAAG,EAAE,GAAG,QAAQ;EAC5C;EACA,MAAM,OAAO,KAAK,UAAU,SAAS,QAAQ;EAE7C,IAAI,IAAI,MAAM,QAAQ;EACtB,KAAK,KAAK,CAAC;EAEX,OAAO;CACT,SAAS,OAAO;EACd,KAAK,KAAK,CAAC;EACX,MAAM;CACR,UAAU;EACR,MAAM,QAAQ;EACd,UAAU,KAAK,CAAC;EAChB,OAAO,KAAK,CAAC;EACb,KAAK,KAAK,CAAC;CACb;AACF;AAcA,MAAa,YACX,OACA,YACU;CACV,MAAM,SAAS,IAAI,MAAM,cAAc,KAAK,MAAM,MAAM,aAAa,IAAI,MAAM,YAAY;CAC3F,MAAM,aAAa,SAAS,MAAM;CAClC,IAAI,SAAS,SAAS,cAAc;CAEpC,MAAM,SAAS,WAAmB;EAChC,IAAI,YAAY,KAAA,GAAW,OAAO,IAAI,YAAY,MAAM;EACxD,MAAM,OAAO,IAAI,YAAY,QAAQ,QAAQ,QAAQ,MAAM;EAE3D,UAAU,KAAK;EAEf,OAAO;CACT;CAEA,OAAO;EACL,QAAQ,MAAM,SAAS,GAAG;EAC1B,SAAS,MAAM,GAAG;EAClB,SAAS,MAAM,GAAO;EACtB,SAAS,MAAM,EAAE;EACjB,OAAO,MAAM,GAAG;EAChB;EACA;EACA,eAAe,aAAa;CAC9B;AACF;AAEA,MAAa,WAAW,UAAuB;CAC7C,MAAM,OAAO,KAAK,CAAC;CACnB,MAAM,QAAQ,KAAK,CAAC;CACpB,MAAM,QAAQ,KAAK,CAAC;CACpB,MAAM,QAAQ,KAAK,CAAC;CACpB,MAAM,MAAM,KAAK,CAAC;AACpB;AAEA,MAAa,cAAc,OAAc,UAAkC;CACzE,MAAM,IAAI,IAAI,QAAQ;CACtB,MAAM,yBAAS,IAAI,WAAW,CAAC;CAC/B,MAAM,OAAO,IAAI,SAAS,OAAO,MAAM;CAEvC,MAAM,UAAU,UAAkB;EAChC,KAAK,UAAU,GAAG,OAAO,IAAI;EAC7B,EAAE,OAAO,MAAM;CACjB;CAEA,IAAI;EACF,KAAK,MAAM,SAAS;GAAC,MAAM;GAAa,MAAM;GAAQ,MAAM;GAAW,MAAM;GAAQ;GAAI;EAAC,GACxF,OAAO,KAAK;EACd,KAAK,MAAM,QAAQ;GACjB,MAAM;GACN,MAAM;GACN,MAAM,0BAAU,IAAI,WAAW;GAC/B,MAAM;EACR,GAAG;GACD,OAAO,KAAK,MAAM;GAClB,EAAE,OAAO,IAAI;EACf;EACA,MAAM,UAAU,EAAE,OAAO;EAEzB,IAAI;GACF,MAAM,WAAW,IAAI,SAAS,QAAQ,QAAQ,QAAQ,YAAY,QAAQ,UAAU;GAEpF,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK,MAAM,QAAQ,KAAK,SAAS,UAAU,IAAI,GAAG,IAAI;EAChF,UAAU;GACR,QAAQ,KAAK,CAAC;EAChB;EACA,KAAK,IAAI,OAAO,GAAG,OAAO,MAAM,aAAa,QAAQ;GACnD,MAAM,QAAQ,MAAM;GACpB,KAAK,IAAI,QAAQ,GAAG,QAAQ,GAAG,SAAS;IACtC,MAAM,QAAQ,MAAM;IACpB,MAAM,WAAW,aAAa,MAAM,SAAS,IAAI;IAEjD,IAAI;KACF,MAAM,eAAe,IAAI,SACvB,SAAS,QACT,SAAS,YACT,SAAS,UACX;KAEA,MAAM,UAAU,OAAO,MAAM,aAAa,SAAS;KAEnD,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,KACvB,MAAM,OAAO,SAAS,KAAK,aAAa,UAAU,IAAI,GAAG,IAAI;IACjE,UAAU;KACR,SAAS,KAAK,CAAC;IACjB;GACF;EACF;CACF,UAAU;EACR,EAAE,QAAQ;EACV,OAAO,KAAK,CAAC;EACb,MAAM,QAAQ,KAAK,CAAC;CACtB;AACF;;AAGA,UAAiB,KACf,OACA,OACA,WAAyB,OACF;CACvB,MAAM,EAAE,QAAQ,GAAG,SAAS,SAAS,YAAY,SAAS,eAAe,eAAe;CACxF,MAAM,IAAI,MAAM;CAEhB,QAAQ,OAAW,MAAM;CACzB,QAAQ,OAAW,MAAM;CACzB,QAAQ,OAAY;CACpB,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;EACrC,MAAM,UAAU,MAAM;EAEtB,QAAQ,OAAO;EACf,KAAK,IAAI,IAAI,GAAG,IAAI,oBAAoB,KAAK;GAC3C,QAAQ,OAAW;GACnB,MAAM,kBAAkB,MAAM,KAAK,IAAI;GAEvC,KAAK,IAAI,OAAO,GAAG,OAAO,GAAG,QAAQ;IACnC,QAAQ,OAAW;IACnB,QAAQ,OAAY;IACpB,MAAM,QAAQ,MAAM,KAAK,MAAM,IAAI,IAAI;IAEvC,IAAI,UAAU,KAAK,iBAAiB;KAClC,QAAQ,IAAS;KACjB,SAAS,SAAS,SAAS,KAAK,KAAK,GAAG,KAAK;KAC7C,SAAS,SAAS,SAAS,GAAG,KAAK,GAAG,KAAK;IAC7C;IACA,IAAI,SAAS,OAAO,UAAU,IAAI,aAAa;IAE/C,KAAK,IAAI,QAAQ,OAAO,QAAQ,YAAY,SAAS,UAAU;KAC7D,MAAM,OAAO,SAAS,UAAU,SAAS,IAAI,SAAS,UAAU;KAChE,IAAI;KACJ,IAAI;KAEJ,IAAI,iBAAiB;MACnB,MAAM,eAAe,QAAQ;MAE7B,IAAI,iBAAiB,GAAG;OACtB,QAAQ,IAAS;OACjB,SAAS,SAAS,SAAS,KAAK,KAAK,GAAG,KAAK;OAC7C,SAAS,SAAS,SAAS,GAAG,KAAK,GAAG,KAAK;MAC7C;MACA,QAAQ,QAAQ,IAAI;MACpB,QAAQ,QAAQ,IAAI,eAAe;KACrC,OAAO;MACL,QAAQ,EAAE,MAAM;MAChB,QAAQ,EAAE,MAAM,OAAO;KACzB;KACA,MAAM,UAAU,MAAM,KAAK,MAAM,IAAI,OAAO,QAAQ;KACpD,MAAM,SAAS,WAAW,GAAG,GAAG,SAAS,YAAY,OAAO,OAAO,YAAY,IAAI;KAEnF,SACE,SACA,GACA,MAAM,MACN,OAAO,UAAU,UAAU,SAC3B,SAAS,KACT,OACF;KACA;IACF;GACF;EACF;CACF;AACF;AAEA,MAAa,UAAU,OAAc,UAAwC;CAC3E,KAAK,IAAI,OAAO,GAAG,OAAO,MAAM,aAAa,QAAQ;EACnD,MAAM,SAAS,OAAO,MAAM,aAAa,OAAO,MAAM,aAAa;EAEnE,KAAK,IAAI,OAAO,GAAG,OAAO,KAAK,QAAQ,MAAM,MAAM,SAAS,MAAM,OAAO,SAAS;CACpF;CAEA,OAAO,aAAa,MAAM,OAAO,MAAM,MAAM;AAC/C"}

package/dist/internal/argon2-wasm.mjs

@@ -0,0 +1,33 @@
+import { nativeError } from "./common.mjs";
+import { allocate } from "./argon2-core.mjs";
+import { derive } from "./argon2.mjs";
+import { Effect } from "effect";
+//#region src/internal/argon2-wasm.ts
+const makeArgon2 = (module) => (input) => Effect.acquireUseRelease(Effect.try({
+	try: () => {
+		const memory = new WebAssembly.Memory({
+			initial: 2,
+			maximum: Math.ceil(input.memoryKiB / 64) + 2
+		});
+		const exports = new WebAssembly.Instance(module, { env: { memory } }).exports;
+		const byteOffset = Number(exports.__heap_base.value);
+		const block = exports.argon2_block;
+		const bytes = byteOffset + (input.memoryKiB + 5) * 1024 + 72;
+		memory.grow(Math.max(0, Math.ceil(bytes / 65536) - 2));
+		const state = allocate(input, {
+			buffer: memory.buffer,
+			byteOffset
+		});
+		const compress = (scratch, words, x, y, out, xor) => block(scratch.byteOffset, words.byteOffset, x, y, out, Number(xor));
+		return {
+			memory,
+			state,
+			compress
+		};
+	},
+	catch: nativeError
+}), ({ state, compress }) => derive(input, state, compress), ({ memory }) => Effect.sync(() => new Uint8Array(memory.buffer).fill(0)));
+//#endregion
+export { makeArgon2 };
+
+//# sourceMappingURL=argon2-wasm.mjs.map

package/dist/internal/argon2-wasm.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"argon2-wasm.mjs","names":[],"sources":["../../src/internal/argon2-wasm.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport { derive } from \"./argon2\";\nimport { allocate, type fill } from \"./argon2-core\";\nimport { nativeError } from \"./common\";\nimport type { Argon2 } from \"./kdf\";\n\n/** ABI of the package's owned argon2.wasm, built from argon2-block.c. */\ninterface Exports extends WebAssembly.Exports {\n  readonly __heap_base: WebAssembly.Global;\n  readonly argon2_block: (\n    scratch: number,\n    memory: number,\n    x: number,\n    y: number,\n    out: number,\n    xor: number,\n  ) => void;\n}\n\nexport const makeArgon2 =\n  (module: WebAssembly.Module): Argon2 =>\n  (input) =>\n    Effect.acquireUseRelease(\n      Effect.try({\n        try: () => {\n          // Each admitted derivation owns an instance. Two extra pages cover the\n          // module's 64 KiB stack, scratch, address, initial and final buffers.\n          const memory = new WebAssembly.Memory({\n            initial: 2,\n            maximum: Math.ceil(input.memoryKiB / 64) + 2,\n          });\n\n          const exports = new WebAssembly.Instance(module, { env: { memory } }).exports as Exports;\n          const byteOffset = Number(exports.__heap_base.value);\n          const block = exports.argon2_block;\n          const bytes = byteOffset + (input.memoryKiB + 5) * 1024 + 72;\n\n          memory.grow(Math.max(0, Math.ceil(bytes / 65536) - 2));\n          const state = allocate(input, { buffer: memory.buffer, byteOffset });\n\n          const compress: NonNullable<Parameters<typeof fill>[2]> = (\n            scratch,\n            words,\n            x,\n            y,\n            out,\n            xor,\n          ) => block(scratch.byteOffset, words.byteOffset, x, y, out, Number(xor));\n\n          return { memory, state, compress };\n        },\n        catch: nativeError,\n      }),\n      ({ state, compress }) => derive(input, state, compress),\n      // Clear the entire linear memory, including any compiler stack spills,\n      // before Kdf releases admission on completion, failure or interruption.\n      ({ memory }) => Effect.sync(() => new Uint8Array(memory.buffer).fill(0)),\n    );\n"],"mappings":";;;;;AAoBA,MAAa,cACV,YACA,UACC,OAAO,kBACL,OAAO,IAAI;CACT,WAAW;EAGT,MAAM,SAAS,IAAI,YAAY,OAAO;GACpC,SAAS;GACT,SAAS,KAAK,KAAK,MAAM,YAAY,EAAE,IAAI;EAC7C,CAAC;EAED,MAAM,UAAU,IAAI,YAAY,SAAS,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;EACtE,MAAM,aAAa,OAAO,QAAQ,YAAY,KAAK;EACnD,MAAM,QAAQ,QAAQ;EACtB,MAAM,QAAQ,cAAc,MAAM,YAAY,KAAK,OAAO;EAE1D,OAAO,KAAK,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,KAAK,IAAI,CAAC,CAAC;EACrD,MAAM,QAAQ,SAAS,OAAO;GAAE,QAAQ,OAAO;GAAQ;EAAW,CAAC;EAEnE,MAAM,YACJ,SACA,OACA,GACA,GACA,KACA,QACG,MAAM,QAAQ,YAAY,MAAM,YAAY,GAAG,GAAG,KAAK,OAAO,GAAG,CAAC;EAEvE,OAAO;GAAE;GAAQ;GAAO;EAAS;CACnC;CACA,OAAO;AACT,CAAC,IACA,EAAE,OAAO,eAAe,OAAO,OAAO,OAAO,QAAQ,IAGrD,EAAE,aAAa,OAAO,WAAW,IAAI,WAAW,OAAO,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CACzE"}

package/dist/internal/argon2.mjs

@@ -1,11 +1,10 @@
 import { allocate, destroy, fill, initialize, output } from "./argon2-core.mjs";
 import { Clock, Effect } from "effect";
 //#region src/internal/argon2.ts
-/** Effect schedules time slices; admission remains held through buffer cleanup. */
-const argon2 = (input) => Effect.acquireUseRelease(Effect.sync(() => allocate(input)), (state) => Effect.gen(function* () {
+const derive = Effect.fnUntraced(function* (input, state, compress) {
 	const clock = yield* Clock.Clock;
 	initialize(state, input);
-	const blocks = fill(state, input);
+	const blocks = fill(state, input, compress);
 	for (;;) {
 		const started = clock.monotonicTimeNanosUnsafe();
 		for (let processed = 0; processed < 2048; processed += 256) {
@@ -14,8 +13,10 @@ const argon2 = (input) => Effect.acquireUseRelease(Effect.sync(() => allocate(in
 		}
 		yield* Effect.yieldNow;
 	}
-}), (state) => Effect.sync(() => destroy(state)));
+});
+/** Effect schedules time slices; admission remains held through buffer cleanup. */
+const argon2 = (input) => Effect.acquireUseRelease(Effect.sync(() => allocate(input)), (state) => derive(input, state), (state) => Effect.sync(() => destroy(state)));
 //#endregion
-export { argon2 };
+export { argon2, derive };
 
 //# sourceMappingURL=argon2.mjs.map

package/dist/internal/argon2.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"argon2.mjs","names":[],"sources":["../../src/internal/argon2.ts"],"sourcesContent":["import { Clock, Effect } from \"effect\";\n\nimport { allocate, destroy, fill, initialize, output } from \"./argon2-core\";\nimport type { Argon2 } from \"./kdf\";\n\n/** Effect schedules time slices; admission remains held through buffer cleanup. */\nexport const argon2: Argon2 = (input) =>\n  Effect.acquireUseRelease(\n    Effect.sync(() => allocate(input)),\n    (state) =>\n      Effect.gen(function* () {\n        const clock = yield* Clock.Clock;\n\n        initialize(state, input);\n        const blocks = fill(state, input);\n\n        for (;;) {\n          const started = clock.monotonicTimeNanosUnsafe();\n\n          // Workers freeze clocks during CPU work. Cap each slice as well so\n          // interruption and other fibers still get a turn on those runtimes.\n          for (let processed = 0; processed < 2048; processed += 256) {\n            for (let batch = 0; batch < 256; batch++) {\n              if (blocks.next().done) return output(state, input);\n            }\n            if (clock.monotonicTimeNanosUnsafe() - started >= 8_000_000n) break;\n          }\n          yield* Effect.yieldNow;\n        }\n      }),\n    (state) => Effect.sync(() => destroy(state)),\n  );\n"],"mappings":";;;;AAMA,MAAa,UAAkB,UAC7B,OAAO,kBACL,OAAO,WAAW,SAAS,KAAK,CAAC,IAChC,UACC,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO,MAAM;CAE3B,WAAW,OAAO,KAAK;CACvB,MAAM,SAAS,KAAK,OAAO,KAAK;CAEhC,SAAS;EACP,MAAM,UAAU,MAAM,yBAAyB;EAI/C,KAAK,IAAI,YAAY,GAAG,YAAY,MAAM,aAAa,KAAK;GAC1D,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,SAC/B,IAAI,OAAO,KAAK,CAAC,CAAC,MAAM,OAAO,OAAO,OAAO,KAAK;GAEpD,IAAI,MAAM,yBAAyB,IAAI,WAAW,UAAY;EAChE;EACA,OAAO,OAAO;CAChB;AACF,CAAC,IACF,UAAU,OAAO,WAAW,QAAQ,KAAK,CAAC,CAC7C"}
+{"version":3,"file":"argon2.mjs","names":[],"sources":["../../src/internal/argon2.ts"],"sourcesContent":["import { Clock, Effect } from \"effect\";\n\nimport { allocate, destroy, fill, initialize, output, type State } from \"./argon2-core\";\nimport type { Argon2, Argon2Parameters } from \"./kdf\";\n\nexport const derive = Effect.fnUntraced(function* (\n  input: Argon2Parameters,\n  state: State,\n  compress?: Parameters<typeof fill>[2],\n) {\n  const clock = yield* Clock.Clock;\n\n  initialize(state, input);\n  const blocks = fill(state, input, compress);\n\n  for (;;) {\n    const started = clock.monotonicTimeNanosUnsafe();\n\n    // Workers freeze clocks during CPU work. Cap each slice as well so\n    // interruption and other fibers still get a turn on those runtimes.\n    for (let processed = 0; processed < 2048; processed += 256) {\n      for (let batch = 0; batch < 256; batch++) {\n        if (blocks.next().done) return output(state, input);\n      }\n      if (clock.monotonicTimeNanosUnsafe() - started >= 8_000_000n) break;\n    }\n    yield* Effect.yieldNow;\n  }\n});\n\n/** Effect schedules time slices; admission remains held through buffer cleanup. */\nexport const argon2: Argon2 = (input) =>\n  Effect.acquireUseRelease(\n    Effect.sync(() => allocate(input)),\n    (state) => derive(input, state),\n    (state) => Effect.sync(() => destroy(state)),\n  );\n"],"mappings":";;;AAKA,MAAa,SAAS,OAAO,WAAW,WACtC,OACA,OACA,UACA;CACA,MAAM,QAAQ,OAAO,MAAM;CAE3B,WAAW,OAAO,KAAK;CACvB,MAAM,SAAS,KAAK,OAAO,OAAO,QAAQ;CAE1C,SAAS;EACP,MAAM,UAAU,MAAM,yBAAyB;EAI/C,KAAK,IAAI,YAAY,GAAG,YAAY,MAAM,aAAa,KAAK;GAC1D,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,SAC/B,IAAI,OAAO,KAAK,CAAC,CAAC,MAAM,OAAO,OAAO,OAAO,KAAK;GAEpD,IAAI,MAAM,yBAAyB,IAAI,WAAW,UAAY;EAChE;EACA,OAAO,OAAO;CAChB;AACF,CAAC;;AAGD,MAAa,UAAkB,UAC7B,OAAO,kBACL,OAAO,WAAW,SAAS,KAAK,CAAC,IAChC,UAAU,OAAO,OAAO,KAAK,IAC7B,UAAU,OAAO,WAAW,QAAQ,KAAK,CAAC,CAC7C"}