@yielded/crypto 0.1.0-beta.30 → 0.1.0-beta.32

package/dist/internal/node.mjs

@@ -1,7 +1,8 @@
 import { CryptoUnavailable, UnsupportedAlgorithm } from "../Errors.mjs";
 import { makeLayer } from "./layer.mjs";
+import { layer as layer$1 } from "./scrypt.mjs";
 import { xchacha } from "./xchacha.mjs";
-import { Effect, Result } from "effect";
+import { Effect, Layer, Result } from "effect";
 import * as crypto from "node:crypto";
 //#region src/internal/node.ts
 const argon2 = Effect.fnUntraced(function* (input) {
@@ -23,11 +24,11 @@ const argon2 = Effect.fnUntraced(function* (input) {
 		if (Result.isFailure(registration)) resume(Effect.fail(registration.failure));
 	}).pipe(Effect.uninterruptible);
 });
-/** Node-compatible WebCrypto/Argon2id with the portable XChaCha20-Poly1305 extension. */
+/** Node-compatible WebCrypto and native password KDFs with portable XChaCha20-Poly1305. */
 const layer = (limits = {}) => makeLayer(crypto.webcrypto.subtle, limits, {
 	argon2,
 	xchacha
-});
+}).pipe(Layer.provide(layer$1));
 //#endregion
 export { layer };
 

package/dist/internal/node.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"node.mjs","names":[],"sources":["../../src/internal/node.ts"],"sourcesContent":["// @effect-diagnostics-next-line nodeBuiltinImport:off -- This platform adapter needs native Argon2 and WebCrypto, which Effect Crypto does not expose.\nimport * as crypto from \"node:crypto\";\n\nimport { Effect, Result } from \"effect\";\n\nimport { CryptoUnavailable, UnsupportedAlgorithm } from \"../Errors\";\nimport type { Limits } from \"../Kdf\";\nimport type { Argon2, Argon2Parameters } from \"./kdf\";\nimport { makeLayer } from \"./layer\";\nimport { xchacha } from \"./xchacha\";\n\nconst argon2: Argon2 = Effect.fnUntraced(function* (input: Argon2Parameters) {\n  // Namespace import keeps this module loadable on Node versions without Argon2.\n  if (typeof crypto.argon2 !== \"function\") return yield* UnsupportedAlgorithm.make({});\n\n  // Node cannot cancel this work. Keep borrowed buffers and admission until the\n  // callback completes, including when its caller has requested interruption.\n  return yield* Effect.callback<Uint8Array, CryptoUnavailable>((resume) => {\n    const registration = Result.try({\n      try: () =>\n        crypto.argon2(\n          \"argon2id\",\n          {\n            message: input.password,\n            nonce: input.salt,\n            parallelism: input.parallelism,\n            memory: input.memoryKiB,\n            passes: input.passes,\n            tagLength: input.length,\n            secret: input.secret,\n            associatedData: input.associatedData,\n          },\n          (error, key) =>\n            resume(error === null ? Effect.succeed(key) : Effect.fail(CryptoUnavailable.make({}))),\n        ),\n      catch: () => CryptoUnavailable.make({}),\n    });\n\n    if (Result.isFailure(registration)) resume(Effect.fail(registration.failure));\n  }).pipe(Effect.uninterruptible);\n});\n\n/** Node-compatible WebCrypto/Argon2id with the portable XChaCha20-Poly1305 extension. */\nexport const layer = (limits: Partial<Limits> = {}) =>\n  // Node's declarations include additional key usages absent from lib.dom. The\n  // standard operations used here share the WebCrypto ABI; no payload is cast.\n  makeLayer(crypto.webcrypto.subtle as SubtleCrypto, limits, { argon2, xchacha });\n"],"mappings":";;;;;;AAWA,MAAM,SAAiB,OAAO,WAAW,WAAW,OAAyB;CAE3E,IAAI,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;CAInF,OAAO,OAAO,OAAO,UAAyC,WAAW;EACvE,MAAM,eAAe,OAAO,IAAI;GAC9B,WACE,OAAO,OACL,YACA;IACE,SAAS,MAAM;IACf,OAAO,MAAM;IACb,aAAa,MAAM;IACnB,QAAQ,MAAM;IACd,QAAQ,MAAM;IACd,WAAW,MAAM;IACjB,QAAQ,MAAM;IACd,gBAAgB,MAAM;GACxB,IACC,OAAO,QACN,OAAO,UAAU,OAAO,OAAO,QAAQ,GAAG,IAAI,OAAO,KAAK,kBAAkB,KAAK,CAAC,CAAC,CAAC,CAAC,CACzF;GACF,aAAa,kBAAkB,KAAK,CAAC,CAAC;EACxC,CAAC;EAED,IAAI,OAAO,UAAU,YAAY,GAAG,OAAO,OAAO,KAAK,aAAa,OAAO,CAAC;CAC9E,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe;AAChC,CAAC;;AAGD,MAAa,SAAS,SAA0B,CAAC,MAG/C,UAAU,OAAO,UAAU,QAAwB,QAAQ;CAAE;CAAQ;AAAQ,CAAC"}
+{"version":3,"file":"node.mjs","names":["Scrypt.layer"],"sources":["../../src/internal/node.ts"],"sourcesContent":["// @effect-diagnostics-next-line nodeBuiltinImport:off -- This platform adapter needs native Argon2 and WebCrypto, which Effect Crypto does not expose.\nimport * as crypto from \"node:crypto\";\n\nimport { Effect, Layer, Result } from \"effect\";\n\nimport { CryptoUnavailable, UnsupportedAlgorithm } from \"../Errors\";\nimport type { Limits } from \"../Kdf\";\nimport type { Argon2, Argon2Parameters } from \"./kdf\";\nimport { makeLayer } from \"./layer\";\nimport * as Scrypt from \"./scrypt\";\nimport { xchacha } from \"./xchacha\";\n\nconst argon2: Argon2 = Effect.fnUntraced(function* (input: Argon2Parameters) {\n  // Namespace import keeps this module loadable on Node versions without Argon2.\n  if (typeof crypto.argon2 !== \"function\") return yield* UnsupportedAlgorithm.make({});\n\n  // Node cannot cancel this work. Keep borrowed buffers and admission until the\n  // callback completes, including when its caller has requested interruption.\n  return yield* Effect.callback<Uint8Array, CryptoUnavailable>((resume) => {\n    const registration = Result.try({\n      try: () =>\n        crypto.argon2(\n          \"argon2id\",\n          {\n            message: input.password,\n            nonce: input.salt,\n            parallelism: input.parallelism,\n            memory: input.memoryKiB,\n            passes: input.passes,\n            tagLength: input.length,\n            secret: input.secret,\n            associatedData: input.associatedData,\n          },\n          (error, key) =>\n            resume(error === null ? Effect.succeed(key) : Effect.fail(CryptoUnavailable.make({}))),\n        ),\n      catch: () => CryptoUnavailable.make({}),\n    });\n\n    if (Result.isFailure(registration)) resume(Effect.fail(registration.failure));\n  }).pipe(Effect.uninterruptible);\n});\n\n/** Node-compatible WebCrypto and native password KDFs with portable XChaCha20-Poly1305. */\nexport const layer = (limits: Partial<Limits> = {}) =>\n  // Node's declarations include additional key usages absent from lib.dom. The\n  // standard operations used here share the WebCrypto ABI; no payload is cast.\n  makeLayer(crypto.webcrypto.subtle as SubtleCrypto, limits, { argon2, xchacha }).pipe(\n    Layer.provide(Scrypt.layer),\n  );\n"],"mappings":";;;;;;;AAYA,MAAM,SAAiB,OAAO,WAAW,WAAW,OAAyB;CAE3E,IAAI,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;CAInF,OAAO,OAAO,OAAO,UAAyC,WAAW;EACvE,MAAM,eAAe,OAAO,IAAI;GAC9B,WACE,OAAO,OACL,YACA;IACE,SAAS,MAAM;IACf,OAAO,MAAM;IACb,aAAa,MAAM;IACnB,QAAQ,MAAM;IACd,QAAQ,MAAM;IACd,WAAW,MAAM;IACjB,QAAQ,MAAM;IACd,gBAAgB,MAAM;GACxB,IACC,OAAO,QACN,OAAO,UAAU,OAAO,OAAO,QAAQ,GAAG,IAAI,OAAO,KAAK,kBAAkB,KAAK,CAAC,CAAC,CAAC,CAAC,CACzF;GACF,aAAa,kBAAkB,KAAK,CAAC,CAAC;EACxC,CAAC;EAED,IAAI,OAAO,UAAU,YAAY,GAAG,OAAO,OAAO,KAAK,aAAa,OAAO,CAAC;CAC9E,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe;AAChC,CAAC;;AAGD,MAAa,SAAS,SAA0B,CAAC,MAG/C,UAAU,OAAO,UAAU,QAAwB,QAAQ;CAAE;CAAQ;AAAQ,CAAC,CAAC,CAAC,KAC9E,MAAM,QAAQA,OAAY,CAC5B"}

package/dist/internal/scrypt-backend.mjs

@@ -0,0 +1,10 @@
+import { UnsupportedAlgorithm } from "../Errors.mjs";
+import { Context, Effect, Layer } from "effect";
+//#region src/internal/scrypt-backend.ts
+/** Raw derivation selected by a platform Layer; Kdf owns validation and admission. */
+var ScryptBackend = class extends Context.Service()("@yielded/crypto/internal/scrypt-backend") {};
+const layerUnsupported = Layer.succeed(ScryptBackend, { derive: () => Effect.fail(UnsupportedAlgorithm.make({})) });
+//#endregion
+export { ScryptBackend, layerUnsupported };
+
+//# sourceMappingURL=scrypt-backend.mjs.map

package/dist/internal/scrypt-backend.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrypt-backend.mjs","names":[],"sources":["../../src/internal/scrypt-backend.ts"],"sourcesContent":["import { Context, Effect, Layer } from \"effect\";\n\nimport { type OperationError, UnsupportedAlgorithm } from \"../Errors\";\n\nexport interface ScryptParameters {\n  readonly password: Uint8Array<ArrayBuffer>;\n  readonly salt: Uint8Array<ArrayBuffer>;\n  readonly cost: number;\n  readonly blockSize: number;\n  readonly parallelism: number;\n  readonly length: number;\n  readonly maximumMemoryBytes: number;\n}\n\n/** Raw derivation selected by a platform Layer; Kdf owns validation and admission. */\nexport class ScryptBackend extends Context.Service<\n  ScryptBackend,\n  {\n    readonly derive: (input: ScryptParameters) => Effect.Effect<Uint8Array, OperationError>;\n  }\n>()(\"@yielded/crypto/internal/scrypt-backend\") {}\n\nexport const layerUnsupported = Layer.succeed(ScryptBackend, {\n  derive: () => Effect.fail(UnsupportedAlgorithm.make({})),\n});\n"],"mappings":";;;;AAeA,IAAa,gBAAb,cAAmC,QAAQ,QAKzC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC;AAEhD,MAAa,mBAAmB,MAAM,QAAQ,eAAe,EAC3D,cAAc,OAAO,KAAK,qBAAqB,KAAK,CAAC,CAAC,CAAC,EACzD,CAAC"}

package/dist/internal/scrypt.mjs

@@ -0,0 +1,25 @@
+import { CryptoUnavailable, UnsupportedAlgorithm } from "../Errors.mjs";
+import { ScryptBackend } from "./scrypt-backend.mjs";
+import { Effect, Layer, Result } from "effect";
+import * as crypto from "node:crypto";
+//#region src/internal/scrypt.ts
+const derive = Effect.fnUntraced(function* (input) {
+	if (typeof crypto.scrypt !== "function") return yield* UnsupportedAlgorithm.make({});
+	return yield* Effect.callback((resume) => {
+		const registration = Result.try({
+			try: () => crypto.scrypt(input.password, input.salt, input.length, {
+				N: input.cost,
+				r: input.blockSize,
+				p: input.parallelism,
+				maxmem: input.maximumMemoryBytes
+			}, (error, key) => resume(error ? Effect.fail(CryptoUnavailable.make({})) : Effect.succeed(key))),
+			catch: () => CryptoUnavailable.make({})
+		});
+		if (Result.isFailure(registration)) resume(Effect.fail(registration.failure));
+	}).pipe(Effect.uninterruptible);
+});
+const layer = Layer.succeed(ScryptBackend, { derive });
+//#endregion
+export { layer };
+
+//# sourceMappingURL=scrypt.mjs.map

package/dist/internal/scrypt.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrypt.mjs","names":[],"sources":["../../src/internal/scrypt.ts"],"sourcesContent":["// @effect-diagnostics-next-line nodeBuiltinImport:off -- Native scrypt is not exposed by Effect Crypto or WebCrypto.\nimport * as crypto from \"node:crypto\";\n\nimport { Effect, Layer, Result } from \"effect\";\n\nimport { CryptoUnavailable, UnsupportedAlgorithm } from \"../Errors\";\nimport { ScryptBackend, type ScryptParameters } from \"./scrypt-backend\";\n\nconst derive = Effect.fnUntraced(function* (input: ScryptParameters) {\n  if (typeof crypto.scrypt !== \"function\") return yield* UnsupportedAlgorithm.make({});\n\n  // Native work cannot be cancelled. Keep admission and borrowed buffers until\n  // its callback finishes, including when the caller requests interruption.\n  return yield* Effect.callback<Uint8Array, CryptoUnavailable>((resume) => {\n    const registration = Result.try({\n      try: () =>\n        crypto.scrypt(\n          input.password,\n          input.salt,\n          input.length,\n          {\n            N: input.cost,\n            r: input.blockSize,\n            p: input.parallelism,\n            maxmem: input.maximumMemoryBytes,\n          },\n          // Bun supplies undefined on success; Node supplies null.\n          (error, key) =>\n            resume(error ? Effect.fail(CryptoUnavailable.make({})) : Effect.succeed(key)),\n        ),\n      catch: () => CryptoUnavailable.make({}),\n    });\n\n    if (Result.isFailure(registration)) resume(Effect.fail(registration.failure));\n  }).pipe(Effect.uninterruptible);\n});\n\nexport const layer = Layer.succeed(ScryptBackend, { derive });\n"],"mappings":";;;;;AAQA,MAAM,SAAS,OAAO,WAAW,WAAW,OAAyB;CACnE,IAAI,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;CAInF,OAAO,OAAO,OAAO,UAAyC,WAAW;EACvE,MAAM,eAAe,OAAO,IAAI;GAC9B,WACE,OAAO,OACL,MAAM,UACN,MAAM,MACN,MAAM,QACN;IACE,GAAG,MAAM;IACT,GAAG,MAAM;IACT,GAAG,MAAM;IACT,QAAQ,MAAM;GAChB,IAEC,OAAO,QACN,OAAO,QAAQ,OAAO,KAAK,kBAAkB,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,QAAQ,GAAG,CAAC,CAChF;GACF,aAAa,kBAAkB,KAAK,CAAC,CAAC;EACxC,CAAC;EAED,IAAI,OAAO,UAAU,YAAY,GAAG,OAAO,OAAO,KAAK,aAAa,OAAO,CAAC;CAC9E,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe;AAChC,CAAC;AAED,MAAa,QAAQ,MAAM,QAAQ,eAAe,EAAE,OAAO,CAAC"}

package/dist/platform-workerd.d.mts

@@ -0,0 +1,14 @@
+import { InvalidInput } from "./Errors.mjs";
+import { Aead } from "./Aead.mjs";
+import { Hmac } from "./Hmac.mjs";
+import { Kdf, Limits } from "./Kdf.mjs";
+import { KdfAdmission } from "./KdfAdmission.mjs";
+import { Signature } from "./Signature.mjs";
+import { Layer } from "effect";
+//#region src/platform-workerd.d.ts
+/** Workers WebCrypto, Wasm Argon2id and native scrypt.
+ * Bundle with Wrangler and enable Node.js compatibility.
+ */
+export declare const layer: (subtle: SubtleCrypto, limits?: Partial<Limits>) => Layer.Layer<Aead | Hmac | Kdf | Signature, InvalidInput, KdfAdmission>;
+//#endregion
+//# sourceMappingURL=platform-workerd.d.mts.map

package/dist/platform-workerd.mjs

@@ -0,0 +1,18 @@
+import { makeLayer } from "./internal/layer.mjs";
+import { layer as layer$1 } from "./internal/scrypt.mjs";
+import { xchacha } from "./internal/xchacha.mjs";
+import { makeArgon2 } from "./internal/argon2-wasm.mjs";
+import { Layer } from "effect";
+import module from "./internal/argon2.wasm";
+//#region src/platform-workerd.ts
+/** Workers WebCrypto, Wasm Argon2id and native scrypt.
+* Bundle with Wrangler and enable Node.js compatibility.
+*/
+const layer = (subtle, limits = {}) => makeLayer(subtle, limits, {
+	argon2: makeArgon2(module),
+	xchacha
+}).pipe(Layer.provide(layer$1));
+//#endregion
+export { layer };
+
+//# sourceMappingURL=platform-workerd.mjs.map

package/dist/platform-workerd.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-workerd.mjs","names":["Scrypt.layer"],"sources":["../src/platform-workerd.ts"],"sourcesContent":["import { Layer } from \"effect\";\n\nimport { makeArgon2 } from \"./internal/argon2-wasm\";\nimport module from \"./internal/argon2.wasm\";\nimport { makeLayer } from \"./internal/layer\";\nimport * as Scrypt from \"./internal/scrypt\";\nimport { xchacha } from \"./internal/xchacha\";\nimport type { Limits } from \"./Kdf\";\n\n/** Workers WebCrypto, Wasm Argon2id and native scrypt.\n * Bundle with Wrangler and enable Node.js compatibility.\n */\nexport const layer = (subtle: SubtleCrypto, limits: Partial<Limits> = {}) =>\n  makeLayer(subtle, limits, { argon2: makeArgon2(module), xchacha }).pipe(\n    Layer.provide(Scrypt.layer),\n  );\n"],"mappings":";;;;;;;;;;AAYA,MAAa,SAAS,QAAsB,SAA0B,CAAC,MACrE,UAAU,QAAQ,QAAQ;CAAE,QAAQ,WAAW,MAAM;CAAG;AAAQ,CAAC,CAAC,CAAC,KACjE,MAAM,QAAQA,OAAY,CAC5B"}

package/package.json

@@ -1 +1 @@
-{"name":"@yielded/crypto","version":"0.1.0-beta.30","devDependencies":{"@effect/vitest":"4.0.0","@types/node":"26.1.2","effect":"4.0.0","typescript":"7.0.2","vite-plus":"0.3.3"},"peerDependencies":{"effect":"^4.0.0"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./Aead":{"types":"./dist/Aead.d.mts","default":"./dist/Aead.mjs"},"./Errors":{"types":"./dist/Errors.d.mts","default":"./dist/Errors.mjs"},"./Hmac":{"types":"./dist/Hmac.d.mts","default":"./dist/Hmac.mjs"},"./Kdf":{"types":"./dist/Kdf.d.mts","default":"./dist/Kdf.mjs"},"./KdfAdmission":{"types":"./dist/KdfAdmission.d.mts","default":"./dist/KdfAdmission.mjs"},"./Signature":{"types":"./dist/Signature.d.mts","default":"./dist/Signature.mjs"},"./WebCrypto":{"types":"./dist/WebCrypto.d.mts","default":"./dist/WebCrypto.mjs"},"./platform-node":{"types":"./dist/platform-node.d.mts","default":"./dist/platform-node.mjs"},"./platform-bun":{"types":"./dist/platform-bun.d.mts","default":"./dist/platform-bun.mjs"},"./Portable":{"types":"./dist/Portable.d.mts","default":"./dist/Portable.mjs"}},"description":"Effect cryptography services with explicit native and portable backends.","homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/crypto"},"files":["dist","src","THIRD_PARTY_NOTICES.md"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test"}}
+{"name":"@yielded/crypto","version":"0.1.0-beta.32","devDependencies":{"@effect/vitest":"4.0.0","@types/node":"26.1.2","effect":"4.0.0","typescript":"7.0.2","vite":"npm:@voidzero-dev/vite-plus-core@1.1.0","vite-plus":"1.1.0","vitest":"5.0.3"},"peerDependencies":{"effect":"^4.0.0"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./Aead":{"types":"./dist/Aead.d.mts","default":"./dist/Aead.mjs"},"./Errors":{"types":"./dist/Errors.d.mts","default":"./dist/Errors.mjs"},"./Hmac":{"types":"./dist/Hmac.d.mts","default":"./dist/Hmac.mjs"},"./Kdf":{"types":"./dist/Kdf.d.mts","default":"./dist/Kdf.mjs"},"./KdfAdmission":{"types":"./dist/KdfAdmission.d.mts","default":"./dist/KdfAdmission.mjs"},"./Signature":{"types":"./dist/Signature.d.mts","default":"./dist/Signature.mjs"},"./WebCrypto":{"types":"./dist/WebCrypto.d.mts","default":"./dist/WebCrypto.mjs"},"./platform-node":{"types":"./dist/platform-node.d.mts","default":"./dist/platform-node.mjs"},"./platform-bun":{"types":"./dist/platform-bun.d.mts","default":"./dist/platform-bun.mjs"},"./platform-workerd":{"types":"./dist/platform-workerd.d.mts","default":"./dist/platform-workerd.mjs"},"./Portable":{"types":"./dist/Portable.d.mts","default":"./dist/Portable.mjs"}},"description":"Effect cryptography services with explicit native and portable backends.","homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/crypto"},"files":["dist","src","THIRD_PARTY_NOTICES.md"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","build:wasm":"clang --target=wasm32 -O3 -msimd128 -ffreestanding -fno-builtin -nostdlib -Wl,--no-entry -Wl,--import-memory -Wl,--export=argon2_block -Wl,--export=__heap_base -Wl,--strip-all src/internal/argon2-block.c -o src/internal/argon2.wasm","check":"tsc --noEmit -p tsconfig.json","test":"vp test"}}

package/src/Kdf.ts

@@ -22,6 +22,17 @@ export const Argon2idInput = Schema.Struct({
 
 export type Argon2idInput = typeof Argon2idInput.Type;
 
+export const ScryptInput = Schema.Struct({
+  password: secret,
+  salt: bytes,
+  cost: Schema.Int.check(Schema.isBetween({ minimum: 2, maximum: 0x80000000 })),
+  blockSize: uint32,
+  parallelism: uint32,
+  length: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 0x7fffffff })),
+});
+
+export type ScryptInput = typeof ScryptInput.Type;
+
 export const Pbkdf2Input = Schema.Struct({
   password: secret,
   salt: bytes,
@@ -42,7 +53,10 @@ export const HkdfInput = Schema.Struct({
 
 export type HkdfInput = typeof HkdfInput.Type;
 
-/** Resource ceilings, not a password-strength policy. Limits apply per permit. */
+/** Resource ceilings, not a password-strength policy. Limits apply per permit.
+ * Scrypt bounds its allocation by maximumMemoryKiB and N*r*p/8 by
+ * maximumMemoryPasses. maximumPasses/maximumParallelism apply to Argon2id.
+ */
 export const Limits = Schema.Struct({
   maximumMemoryKiB: positive,
   maximumPasses: positive,
@@ -67,7 +81,8 @@ export const defaultLimits: Limits = Object.freeze({
 
 /**
  * Byte-preserving derivation; no text normalization, PHC parsing or password policy.
- * Argon2id uses version 19; PBKDF2 and HKDF use SHA-256. A backend captures shared
+ * Argon2id uses version 19; PBKDF2 and HKDF use SHA-256. Scrypt names N/r/p as
+ * cost/blockSize/parallelism. A backend captures shared
  * KdfAdmission when its Layer is built and retains admission until work and cleanup
  * finish, including when a native operation cannot be cancelled.
  */
@@ -77,6 +92,9 @@ export class Kdf extends Context.Service<
     readonly argon2id: (
       input: Argon2idInput,
     ) => Effect.Effect<Redacted.Redacted<Uint8Array>, OperationError | KdfBusy>;
+    readonly scrypt: (
+      input: ScryptInput,
+    ) => Effect.Effect<Redacted.Redacted<Uint8Array>, OperationError | KdfBusy>;
     readonly pbkdf2: (
       input: Pbkdf2Input,
     ) => Effect.Effect<Redacted.Redacted<Uint8Array>, OperationError | KdfBusy>;

package/src/Portable.ts

@@ -1,8 +1,11 @@
+import { Layer } from "effect";
+
 import { argon2 } from "./internal/argon2";
 import { makeLayer } from "./internal/layer";
+import { layerUnsupported } from "./internal/scrypt-backend";
 import { xchacha } from "./internal/xchacha";
 import type { Limits } from "./Kdf";
 
 /** WebCrypto with owned, portable Argon2id and XChaCha20-Poly1305 implementations. */
 export const layer = (subtle: SubtleCrypto, limits: Partial<Limits> = {}) =>
-  makeLayer(subtle, limits, { argon2, xchacha });
+  makeLayer(subtle, limits, { argon2, xchacha }).pipe(Layer.provide(layerUnsupported));

package/src/WebCrypto.ts

@@ -3,11 +3,12 @@ import { Crypto, Effect, Layer, PlatformError } from "effect";
 import { Hmac } from "./Hmac";
 import { makeHmac } from "./internal/hmac";
 import { makeLayer } from "./internal/layer";
+import { layerUnsupported } from "./internal/scrypt-backend";
 import type { Limits } from "./Kdf";
 
 /** Supply the host capability explicitly; no implicit global backend selection. */
 export const layer = (subtle: SubtleCrypto, limits: Partial<Limits> = {}) =>
-  makeLayer(subtle, limits);
+  makeLayer(subtle, limits).pipe(Layer.provide(layerUnsupported));
 
 /** HMAC alone has no KDF admission requirement. */
 export const layerHmac = (subtle: SubtleCrypto): Layer.Layer<Hmac> =>

package/src/internal/argon2-block.c

@@ -0,0 +1,76 @@
+#include <stdint.h>
+#include <wasm_simd128.h>
+
+/* Argon2id v19 block compression; see ../../THIRD_PARTY_NOTICES.md.
+ * Build with vp run @yielded/crypto#build:wasm. Imports only linear memory.
+ */
+#define INLINE static inline __attribute__((always_inline))
+
+/* Two independent RFC 9106 BlaMka operations, with unsigned 32-bit products. */
+INLINE v128_t blamka(v128_t a, v128_t b) {
+  v128_t low_a = wasm_i32x4_shuffle(a, a, 0, 2, 0, 2);
+  v128_t low_b = wasm_i32x4_shuffle(b, b, 0, 2, 0, 2);
+  v128_t product = wasm_u64x2_extmul_low_u32x4(low_a, low_b);
+  return wasm_i64x2_add(wasm_i64x2_add(a, b), wasm_i64x2_shl(product, 1));
+}
+
+INLINE void g(v128_t *a, v128_t *b, v128_t *c, v128_t *d) {
+  *a = blamka(*a, *b);
+  v128_t x = wasm_v128_xor(*d, *a);
+  *d = wasm_i32x4_shuffle(x, x, 1, 0, 3, 2);
+  *c = blamka(*c, *d);
+  x = wasm_v128_xor(*b, *c);
+  *b = wasm_i8x16_shuffle(x, x, 3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10);
+  *a = blamka(*a, *b);
+  x = wasm_v128_xor(*d, *a);
+  *d = wasm_i8x16_shuffle(x, x, 2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9);
+  *c = blamka(*c, *d);
+  x = wasm_v128_xor(*b, *c);
+  *b = wasm_v128_or(wasm_i64x2_shl(x, 1), wasm_u64x2_shr(x, 63));
+}
+
+INLINE void p(uint64_t *v,
+  unsigned a0, unsigned a1, unsigned b0, unsigned b1,
+  unsigned c0, unsigned c1, unsigned d0, unsigned d1) {
+  v128_t a = wasm_v128_load(v + a0), aa = wasm_v128_load(v + a1);
+  v128_t b = wasm_v128_load(v + b0), bb = wasm_v128_load(v + b1);
+  v128_t c = wasm_v128_load(v + c0), cc = wasm_v128_load(v + c1);
+  v128_t d = wasm_v128_load(v + d0), dd = wasm_v128_load(v + d1);
+  g(&a, &b, &c, &d);
+  g(&aa, &bb, &cc, &dd);
+  v128_t diagonal_b = wasm_i64x2_shuffle(b, bb, 1, 2);
+  v128_t diagonal_bb = wasm_i64x2_shuffle(bb, b, 1, 2);
+  v128_t diagonal_d = wasm_i64x2_shuffle(dd, d, 1, 2);
+  v128_t diagonal_dd = wasm_i64x2_shuffle(d, dd, 1, 2);
+  g(&a, &diagonal_b, &cc, &diagonal_d);
+  g(&aa, &diagonal_bb, &c, &diagonal_dd);
+  wasm_v128_store(v + a0, a);
+  wasm_v128_store(v + a1, aa);
+  wasm_v128_store(v + b0, wasm_i64x2_shuffle(diagonal_bb, diagonal_b, 1, 2));
+  wasm_v128_store(v + b1, wasm_i64x2_shuffle(diagonal_b, diagonal_bb, 1, 2));
+  wasm_v128_store(v + c0, c);
+  wasm_v128_store(v + c1, cc);
+  wasm_v128_store(v + d0, wasm_i64x2_shuffle(diagonal_d, diagonal_dd, 1, 2));
+  wasm_v128_store(v + d1, wasm_i64x2_shuffle(diagonal_dd, diagonal_d, 1, 2));
+}
+
+void argon2_block(uint64_t *scratch, uint32_t *memory,
+  unsigned x_offset, unsigned y_offset, unsigned out_offset, unsigned xor_old) {
+  uint64_t *x = (uint64_t *)(memory + x_offset);
+  uint64_t *y = (uint64_t *)(memory + y_offset);
+  uint64_t *out = (uint64_t *)(memory + out_offset);
+  for (unsigned i = 0; i < 128; i++) scratch[i] = x[i] ^ y[i];
+  /* Preserve R (and the previous destination on later passes) before permuting. */
+  if (xor_old)
+    for (unsigned i = 0; i < 128; i++) out[i] ^= scratch[i];
+  else
+    for (unsigned i = 0; i < 128; i++) out[i] = scratch[i];
+  for (unsigned i = 0; i < 128; i += 16)
+    p(scratch, i, i+2, i+4, i+6, i+8, i+10, i+12, i+14);
+  for (unsigned i = 0; i < 16; i += 2)
+    p(scratch, i, i+16, i+32, i+48, i+64, i+80, i+96, i+112);
+  for (unsigned i = 0; i < 128; i++) {
+    out[i] ^= scratch[i];
+    scratch[i] = 0;
+  }
+}

package/src/internal/argon2-core.ts

@@ -317,16 +317,29 @@ export interface State {
 }
 
 // Allocate before absorbing secrets. Kdf has already applied Schema/resource limits.
-export const allocate = (input: Argon2Parameters): State => {
+export const allocate = (
+  input: Argon2Parameters,
+  backing?: { readonly buffer: ArrayBuffer; readonly byteOffset: number },
+): State => {
   const blocks = 4 * input.parallelism * Math.floor(input.memoryKiB / (4 * input.parallelism));
   const laneLength = blocks / input.parallelism;
+  let offset = backing?.byteOffset ?? 0;
+
+  const words = (length: number) => {
+    if (backing === undefined) return new Uint32Array(length);
+    const view = new Uint32Array(backing.buffer, offset, length);
+
+    offset += view.byteLength;
+
+    return view;
+  };
 
   return {
-    memory: new Uint32Array(blocks * 256),
-    scratch: new Uint32Array(256),
-    address: new Uint32Array(3 * 256),
-    initial: new Uint32Array(18),
-    final: new Uint32Array(256),
+    memory: words(blocks * 256),
+    scratch: words(256),
+    address: words(3 * 256),
+    initial: words(18),
+    final: words(256),
     blocks,
     laneLength,
     segmentLength: laneLength / 4,
@@ -402,7 +415,11 @@ export const initialize = (state: State, input: Argon2Parameters): void => {
 };
 
 /** Yield block boundaries to the Effect driver; all scratch belongs to this derivation. */
-export function* fill(state: State, input: Argon2Parameters): Generator<void, void> {
+export function* fill(
+  state: State,
+  input: Argon2Parameters,
+  compress: typeof block = block,
+): Generator<void, void> {
   const { memory: B, scratch, address, laneLength: laneLen, segmentLength: segmentLen } = state;
   const p = input.parallelism;
 
@@ -424,8 +441,8 @@ export function* fill(state: State, input: Argon2Parameters): Generator<void, vo
 
         if (start === 2 && dataIndependent) {
           address[256 + 12]++;
-          block(scratch, address, 256, 512, 0, false);
-          block(scratch, address, 0, 512, 0, false);
+          compress(scratch, address, 256, 512, 0, false);
+          compress(scratch, address, 0, 512, 0, false);
         }
         let offset = lane * laneLen + s * segmentLen + start;
 
@@ -439,8 +456,8 @@ export function* fill(state: State, input: Argon2Parameters): Generator<void, vo
 
             if (addressIndex === 0) {
               address[256 + 12]++;
-              block(scratch, address, 256, 512, 0, false);
-              block(scratch, address, 0, 512, 0, false);
+              compress(scratch, address, 256, 512, 0, false);
+              compress(scratch, address, 0, 512, 0, false);
             }
             randL = address[2 * addressIndex];
             randH = address[2 * addressIndex + 1];
@@ -451,7 +468,14 @@ export function* fill(state: State, input: Argon2Parameters): Generator<void, vo
           const refLane = r === 0 && s === 0 ? lane : randH % p;
           const refPos = indexAlpha(r, s, laneLen, segmentLen, index, randL, refLane === lane);
 
-          block(scratch, B, 256 * prev, 256 * (laneLen * refLane + refPos), offset * 256, needXor);
+          compress(
+            scratch,
+            B,
+            256 * prev,
+            256 * (laneLen * refLane + refPos),
+            offset * 256,
+            needXor,
+          );
           yield;
         }
       }

package/src/internal/argon2-wasm.ts

@@ -0,0 +1,59 @@
+import { Effect } from "effect";
+
+import { derive } from "./argon2";
+import { allocate, type fill } from "./argon2-core";
+import { nativeError } from "./common";
+import type { Argon2 } from "./kdf";
+
+/** ABI of the package's owned argon2.wasm, built from argon2-block.c. */
+interface Exports extends WebAssembly.Exports {
+  readonly __heap_base: WebAssembly.Global;
+  readonly argon2_block: (
+    scratch: number,
+    memory: number,
+    x: number,
+    y: number,
+    out: number,
+    xor: number,
+  ) => void;
+}
+
+export const makeArgon2 =
+  (module: WebAssembly.Module): Argon2 =>
+  (input) =>
+    Effect.acquireUseRelease(
+      Effect.try({
+        try: () => {
+          // Each admitted derivation owns an instance. Two extra pages cover the
+          // module's 64 KiB stack, scratch, address, initial and final buffers.
+          const memory = new WebAssembly.Memory({
+            initial: 2,
+            maximum: Math.ceil(input.memoryKiB / 64) + 2,
+          });
+
+          const exports = new WebAssembly.Instance(module, { env: { memory } }).exports as Exports;
+          const byteOffset = Number(exports.__heap_base.value);
+          const block = exports.argon2_block;
+          const bytes = byteOffset + (input.memoryKiB + 5) * 1024 + 72;
+
+          memory.grow(Math.max(0, Math.ceil(bytes / 65536) - 2));
+          const state = allocate(input, { buffer: memory.buffer, byteOffset });
+
+          const compress: NonNullable<Parameters<typeof fill>[2]> = (
+            scratch,
+            words,
+            x,
+            y,
+            out,
+            xor,
+          ) => block(scratch.byteOffset, words.byteOffset, x, y, out, Number(xor));
+
+          return { memory, state, compress };
+        },
+        catch: nativeError,
+      }),
+      ({ state, compress }) => derive(input, state, compress),
+      // Clear the entire linear memory, including any compiler stack spills,
+      // before Kdf releases admission on completion, failure or interruption.
+      ({ memory }) => Effect.sync(() => new Uint8Array(memory.buffer).fill(0)),
+    );

package/src/internal/argon2.ts

@@ -1,32 +1,37 @@
 import { Clock, Effect } from "effect";
 
-import { allocate, destroy, fill, initialize, output } from "./argon2-core";
-import type { Argon2 } from "./kdf";
+import { allocate, destroy, fill, initialize, output, type State } from "./argon2-core";
+import type { Argon2, Argon2Parameters } from "./kdf";
+
+export const derive = Effect.fnUntraced(function* (
+  input: Argon2Parameters,
+  state: State,
+  compress?: Parameters<typeof fill>[2],
+) {
+  const clock = yield* Clock.Clock;
+
+  initialize(state, input);
+  const blocks = fill(state, input, compress);
+
+  for (;;) {
+    const started = clock.monotonicTimeNanosUnsafe();
+
+    // Workers freeze clocks during CPU work. Cap each slice as well so
+    // interruption and other fibers still get a turn on those runtimes.
+    for (let processed = 0; processed < 2048; processed += 256) {
+      for (let batch = 0; batch < 256; batch++) {
+        if (blocks.next().done) return output(state, input);
+      }
+      if (clock.monotonicTimeNanosUnsafe() - started >= 8_000_000n) break;
+    }
+    yield* Effect.yieldNow;
+  }
+});
 
 /** Effect schedules time slices; admission remains held through buffer cleanup. */
 export const argon2: Argon2 = (input) =>
   Effect.acquireUseRelease(
     Effect.sync(() => allocate(input)),
-    (state) =>
-      Effect.gen(function* () {
-        const clock = yield* Clock.Clock;
-
-        initialize(state, input);
-        const blocks = fill(state, input);
-
-        for (;;) {
-          const started = clock.monotonicTimeNanosUnsafe();
-
-          // Workers freeze clocks during CPU work. Cap each slice as well so
-          // interruption and other fibers still get a turn on those runtimes.
-          for (let processed = 0; processed < 2048; processed += 256) {
-            for (let batch = 0; batch < 256; batch++) {
-              if (blocks.next().done) return output(state, input);
-            }
-            if (clock.monotonicTimeNanosUnsafe() - started >= 8_000_000n) break;
-          }
-          yield* Effect.yieldNow;
-        }
-      }),
+    (state) => derive(input, state),
     (state) => Effect.sync(() => destroy(state)),
   );

package/src/internal/kdf.ts

@@ -1,9 +1,10 @@
 import { Effect, Redacted, Schema } from "effect";
 
 import { InvalidInput, type OperationError, UnsupportedAlgorithm } from "../Errors";
-import { Argon2idInput, HkdfInput, Kdf, type Limits, Pbkdf2Input } from "../Kdf";
+import { Argon2idInput, HkdfInput, Kdf, type Limits, Pbkdf2Input, ScryptInput } from "../Kdf";
 import { KdfAdmission } from "../KdfAdmission";
 import { copy, decode, importError, nativeError, withSecret } from "./common";
+import { ScryptBackend } from "./scrypt-backend";
 
 export interface Argon2Parameters {
   readonly password: Uint8Array<ArrayBuffer>;
@@ -24,6 +25,7 @@ export const makeKdf = Effect.fnUntraced(function* (
   argon2?: Argon2,
 ) {
   const admission = yield* KdfAdmission;
+  const scrypt = yield* ScryptBackend;
   const boundedBytes = Schema.Uint8Array.check(Schema.isMaxLength(limits.maximumInputBytes));
 
   const output = Schema.Int.check(
@@ -34,6 +36,42 @@ export const makeKdf = Effect.fnUntraced(function* (
   const outputLength = (input: number) => decode(output, input, "parameters");
 
   return Kdf.of({
+    scrypt: (input) =>
+      admission.run(
+        Effect.gen(function* () {
+          const value = yield* decode(ScryptInput, input, "parameters");
+
+          yield* outputLength(value.length);
+          yield* inputBytes(Redacted.value(value.password));
+          yield* inputBytes(value.salt);
+
+          const memoryBytes = 128 * value.blockSize * (value.cost + value.parallelism + 2);
+
+          if (
+            !Number.isInteger(Math.log2(value.cost)) ||
+            Math.log2(value.cost) >= 16 * value.blockSize ||
+            value.blockSize * value.parallelism >= 2 ** 30 ||
+            memoryBytes > limits.maximumMemoryKiB * 1024 ||
+            (value.cost * value.blockSize * value.parallelism) / 8 > limits.maximumMemoryPasses
+          )
+            return yield* InvalidInput.make({ reason: "parameters" });
+          const salt = yield* copy(value.salt);
+
+          return yield* withSecret(value.password, (password) =>
+            scrypt
+              .derive({
+                password,
+                salt,
+                cost: value.cost,
+                blockSize: value.blockSize,
+                parallelism: value.parallelism,
+                length: value.length,
+                maximumMemoryBytes: limits.maximumMemoryKiB * 1024,
+              })
+              .pipe(Effect.map(Redacted.make)),
+          );
+        }),
+      ),
     pbkdf2: (input) =>
       admission.run(
         Effect.gen(function* () {

package/src/internal/layer.ts

@@ -13,7 +13,10 @@ import { makeSignature } from "./signature";
 export const makeLayer = (
   subtle: SubtleCrypto,
   input: Partial<Limits>,
-  extensions: { readonly argon2?: Argon2; readonly xchacha?: XChaCha } = {},
+  extensions: {
+    readonly argon2?: Argon2;
+    readonly xchacha?: XChaCha;
+  } = {},
 ) => {
   const snapshot = { ...defaultLimits, ...input };
 

package/src/internal/node.ts

@@ -1,12 +1,13 @@
 // @effect-diagnostics-next-line nodeBuiltinImport:off -- This platform adapter needs native Argon2 and WebCrypto, which Effect Crypto does not expose.
 import * as crypto from "node:crypto";
 
-import { Effect, Result } from "effect";
+import { Effect, Layer, Result } from "effect";
 
 import { CryptoUnavailable, UnsupportedAlgorithm } from "../Errors";
 import type { Limits } from "../Kdf";
 import type { Argon2, Argon2Parameters } from "./kdf";
 import { makeLayer } from "./layer";
+import * as Scrypt from "./scrypt";
 import { xchacha } from "./xchacha";
 
 const argon2: Argon2 = Effect.fnUntraced(function* (input: Argon2Parameters) {
@@ -40,8 +41,10 @@ const argon2: Argon2 = Effect.fnUntraced(function* (input: Argon2Parameters) {
   }).pipe(Effect.uninterruptible);
 });
 
-/** Node-compatible WebCrypto/Argon2id with the portable XChaCha20-Poly1305 extension. */
+/** Node-compatible WebCrypto and native password KDFs with portable XChaCha20-Poly1305. */
 export const layer = (limits: Partial<Limits> = {}) =>
   // Node's declarations include additional key usages absent from lib.dom. The
   // standard operations used here share the WebCrypto ABI; no payload is cast.
-  makeLayer(crypto.webcrypto.subtle as SubtleCrypto, limits, { argon2, xchacha });
+  makeLayer(crypto.webcrypto.subtle as SubtleCrypto, limits, { argon2, xchacha }).pipe(
+    Layer.provide(Scrypt.layer),
+  );

package/src/internal/scrypt-backend.ts

@@ -0,0 +1,25 @@
+import { Context, Effect, Layer } from "effect";
+
+import { type OperationError, UnsupportedAlgorithm } from "../Errors";
+
+export interface ScryptParameters {
+  readonly password: Uint8Array<ArrayBuffer>;
+  readonly salt: Uint8Array<ArrayBuffer>;
+  readonly cost: number;
+  readonly blockSize: number;
+  readonly parallelism: number;
+  readonly length: number;
+  readonly maximumMemoryBytes: number;
+}
+
+/** Raw derivation selected by a platform Layer; Kdf owns validation and admission. */
+export class ScryptBackend extends Context.Service<
+  ScryptBackend,
+  {
+    readonly derive: (input: ScryptParameters) => Effect.Effect<Uint8Array, OperationError>;
+  }
+>()("@yielded/crypto/internal/scrypt-backend") {}
+
+export const layerUnsupported = Layer.succeed(ScryptBackend, {
+  derive: () => Effect.fail(UnsupportedAlgorithm.make({})),
+});