@zudojs/crypto 0.0.1 → 1.0.0

package/dist/cryptoToken/cryptoToken.hash.js

@@ -1,49 +1,39 @@
-import { createNodeCryptoProvider } from "../node/index.js";
+import { getDefaultCryptoProvider } from "../cryptoProvider/cryptoProvider.default.js";
 import { encode } from "../cryptoEncoding/cryptoEncoding.core.js";
-let defaultProvider;
-/**
- * Returns a lazily created default crypto provider.
- *
- * The provider abstraction keeps token hashing free of direct
- * `node:crypto` usage while still allowing callers to inject their own.
- */
-function getDefaultProvider() {
-    if (defaultProvider === undefined) {
-        defaultProvider = createNodeCryptoProvider();
-    }
-    return defaultProvider;
-}
+import { isHex } from "../cryptoEncoding/encoding/cryptoEncoding.hex.js";
+import { timingSafeEqual } from "../compare/compare.helper.js";
 /**
  * Creates a deterministic SHA-256 identifier from a token.
  *
  * The returned value does not expose the original token.
  */
-export async function hashToken(token) {
+export async function hashToken(token, provider = getDefaultCryptoProvider()) {
     assertToken(token);
-    const digest = await getDefaultProvider().hash("sha256", token);
+    const digest = await provider.hash("sha256", token);
     return encode(digest, "hex");
 }
 /**
  * Creates a Base64URL SHA-256 digest of a token.
  */
-export async function hashTokenBase64Url(token) {
+export async function hashTokenBase64Url(token, provider = getDefaultCryptoProvider()) {
     assertToken(token);
-    const digest = await getDefaultProvider().hash("sha256", token);
+    const digest = await provider.hash("sha256", token);
     return encode(digest, "base64url");
 }
 /**
- * Compares a token with a stored hash.
+ * Compares a token with a stored hex SHA-256 hash.
  *
- * Comparison is performed with a constant-time XOR accumulation to
- * avoid timing side-channels.
+ * The comparison is constant time and case-insensitive on the hex digits,
+ * so hashes upper-cased by a database or copied from another tool still
+ * match. Returns false for a malformed token or stored hash.
  */
-export async function verifyTokenHash(token, expectedHash) {
+export async function verifyTokenHash(token, expectedHash, provider) {
+    if (typeof expectedHash !== "string" || !isHex(expectedHash)) {
+        return false;
+    }
     try {
-        const actual = await hashToken(token);
-        if (actual.length !== expectedHash.length) {
-            return false;
-        }
-        return constantTimeEqual(actual, expectedHash);
+        const actual = await hashToken(token, provider);
+        return timingSafeEqual(Buffer.from(actual, "hex"), Buffer.from(expectedHash.toLowerCase(), "hex"));
     }
     catch {
         return false;
@@ -54,22 +44,8 @@ export async function verifyTokenHash(token, expectedHash) {
  *
  * This is useful when a raw bearer token must never be persisted.
  */
-export async function hashTokenForStorage(token) {
-    return hashToken(token);
-}
-/**
- * Compares two hex-encoded strings in constant time.
- */
-function constantTimeEqual(left, right) {
-    let mismatch = 0;
-    const length = left.length;
-    if (length !== right.length) {
-        return false;
-    }
-    for (let i = 0; i < length; i += 1) {
-        mismatch |= left.charCodeAt(i) ^ right.charCodeAt(i);
-    }
-    return mismatch === 0;
+export async function hashTokenForStorage(token, provider) {
+    return hashToken(token, provider);
 }
 /**
  * Validates the basic shape of an opaque token.

package/dist/cryptoUtils/cryptoUtils.compare.d.ts

@@ -1,11 +1,13 @@
 /**
  * Compares two byte arrays in constant time.
  *
- * Different lengths return false immediately.
+ * Different lengths return false immediately. Alias of `timingSafeEqual`.
  */
 export declare function secureEqual(left: Uint8Array, right: Uint8Array): boolean;
 /**
  * Performs a constant-time comparison of two strings.
+ *
+ * Alias of `timingSafeEqualString`.
  */
 export declare function secureStringEqual(left: string, right: string): boolean;
 //# sourceMappingURL=cryptoUtils.compare.d.ts.map

package/dist/cryptoUtils/cryptoUtils.compare.js

@@ -1,27 +1,18 @@
-import { timingSafeEqual } from "../compare/compare.helper.js";
+import { timingSafeEqual, timingSafeEqualString, } from "../compare/compare.helper.js";
 /**
  * Compares two byte arrays in constant time.
  *
- * Different lengths return false immediately.
+ * Different lengths return false immediately. Alias of `timingSafeEqual`.
  */
 export function secureEqual(left, right) {
-    if (left.byteLength !== right.byteLength) {
-        return false;
-    }
     return timingSafeEqual(left, right);
 }
 /**
  * Performs a constant-time comparison of two strings.
+ *
+ * Alias of `timingSafeEqualString`.
  */
 export function secureStringEqual(left, right) {
-    if (typeof left !== "string" || typeof right !== "string") {
-        return false;
-    }
-    const leftBytes = new TextEncoder().encode(left);
-    const rightBytes = new TextEncoder().encode(right);
-    if (leftBytes.byteLength !== rightBytes.byteLength) {
-        return false;
-    }
-    return timingSafeEqual(leftBytes, rightBytes);
+    return timingSafeEqualString(left, right);
 }
 //# sourceMappingURL=cryptoUtils.compare.js.map

package/dist/cryptoUtils/cryptoUtils.number.d.ts

@@ -1,5 +1,8 @@
 /**
  * Converts a number into an unsigned big-endian byte array.
+ *
+ * The default width of 6 bytes (48 bits) is the largest width for which
+ * every safe integer conversion is exact.
  */
 export declare function numberToBytes(value: number, byteLength?: number): Uint8Array;
 /**

package/dist/cryptoUtils/cryptoUtils.number.js

@@ -1,17 +1,23 @@
+const MAX_BYTE_LENGTH = 6;
 /**
  * Converts a number into an unsigned big-endian byte array.
+ *
+ * The default width of 6 bytes (48 bits) is the largest width for which
+ * every safe integer conversion is exact.
  */
-export function numberToBytes(value, byteLength = 8) {
+export function numberToBytes(value, byteLength = MAX_BYTE_LENGTH) {
     if (!Number.isSafeInteger(value) || value < 0) {
         throw new RangeError("value must be a non-negative safe integer.");
     }
-    if (!Number.isInteger(byteLength) || byteLength <= 0 || byteLength > 6) {
-        throw new RangeError("byteLength must be an integer between 1 and 6.");
+    if (!Number.isInteger(byteLength) ||
+        byteLength <= 0 ||
+        byteLength > MAX_BYTE_LENGTH) {
+        throw new RangeError(`byteLength must be an integer between 1 and ${MAX_BYTE_LENGTH}.`);
     }
     const result = new Uint8Array(byteLength);
     let remaining = value;
     for (let index = byteLength - 1; index >= 0; index -= 1) {
-        result[index] = remaining & 0xff;
+        result[index] = remaining % 256;
         remaining = Math.floor(remaining / 256);
     }
     if (remaining !== 0) {
@@ -23,8 +29,8 @@ export function numberToBytes(value, byteLength = 8) {
  * Converts unsigned big-endian bytes into a number.
  */
 export function bytesToNumber(value) {
-    if (value.byteLength === 0 || value.byteLength > 6) {
-        throw new RangeError("Byte array length must be between 1 and 6.");
+    if (value.byteLength === 0 || value.byteLength > MAX_BYTE_LENGTH) {
+        throw new RangeError(`Byte array length must be between 1 and ${MAX_BYTE_LENGTH}.`);
     }
     let result = 0;
     for (const byte of value) {

package/dist/cryptoUtils/cryptoUtils.validation.d.ts

@@ -7,11 +7,11 @@ export declare function isBytes(value: unknown): value is Uint8Array;
  */
 export declare function isArrayBuffer(value: unknown): value is ArrayBuffer;
 /**
- * Returns whether a string contains only hexadecimal characters.
+ * Returns whether a string is valid hexadecimal. Alias of `isHex`.
  */
 export declare function isHexString(value: string): boolean;
 /**
- * Returns whether a string is a valid Base64URL value.
+ * Returns whether a string is valid, canonical Base64URL. Alias of `isBase64Url`.
  */
 export declare function isBase64UrlString(value: string): boolean;
 //# sourceMappingURL=cryptoUtils.validation.d.ts.map

package/dist/cryptoUtils/cryptoUtils.validation.js

@@ -1,3 +1,5 @@
+import { isHex } from "../cryptoEncoding/encoding/cryptoEncoding.hex.js";
+import { isBase64Url } from "../cryptoEncoding/encoding/cryptoEncoding.base64url.js";
 /**
  * Returns whether a value is a Uint8Array.
  */
@@ -11,19 +13,15 @@ export function isArrayBuffer(value) {
     return value instanceof ArrayBuffer;
 }
 /**
- * Returns whether a string contains only hexadecimal characters.
+ * Returns whether a string is valid hexadecimal. Alias of `isHex`.
  */
 export function isHexString(value) {
-    return (typeof value === "string" &&
-        value.length % 2 === 0 &&
-        /^[0-9a-fA-F]*$/.test(value));
+    return isHex(value);
 }
 /**
- * Returns whether a string is a valid Base64URL value.
+ * Returns whether a string is valid, canonical Base64URL. Alias of `isBase64Url`.
  */
 export function isBase64UrlString(value) {
-    return (typeof value === "string" &&
-        value.length % 4 !== 1 &&
-        /^[A-Za-z0-9_-]*$/.test(value));
+    return isBase64Url(value);
 }
 //# sourceMappingURL=cryptoUtils.validation.js.map

package/dist/cryptoUtils/encoding/cryptoUtils.base64.d.ts

@@ -1,9 +1,9 @@
 /**
- * Converts bytes into Base64.
+ * Converts bytes into Base64. Alias of `toBase64`.
  */
-export declare function bytesToBase64(value: Uint8Array): string;
+export declare const bytesToBase64: (value: Uint8Array) => string;
 /**
- * Converts Base64 into bytes.
+ * Converts Base64 into bytes. Alias of `fromBase64`.
  */
-export declare function base64ToBytes(value: string): Uint8Array;
+export declare const base64ToBytes: (value: string) => Uint8Array;
 //# sourceMappingURL=cryptoUtils.base64.d.ts.map

package/dist/cryptoUtils/encoding/cryptoUtils.base64.js

@@ -1,28 +1,10 @@
+import { toBase64, fromBase64, } from "../../cryptoEncoding/encoding/cryptoEncoding.base64.js";
 /**
- * Converts bytes into Base64.
+ * Converts bytes into Base64. Alias of `toBase64`.
  */
-export function bytesToBase64(value) {
-    const binary = Array.from(value)
-        .map((b) => String.fromCharCode(b))
-        .join("");
-    return btoa(binary);
-}
+export const bytesToBase64 = toBase64;
 /**
- * Converts Base64 into bytes.
+ * Converts Base64 into bytes. Alias of `fromBase64`.
  */
-export function base64ToBytes(value) {
-    if (typeof value !== "string") {
-        throw new TypeError("Base64 value must be a string.");
-    }
-    if (value.length % 4 !== 0 ||
-        !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) {
-        throw new TypeError("Invalid Base64 value.");
-    }
-    const binary = atob(value);
-    const result = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i += 1) {
-        result[i] = binary.charCodeAt(i);
-    }
-    return result;
-}
+export const base64ToBytes = fromBase64;
 //# sourceMappingURL=cryptoUtils.base64.js.map

package/dist/cryptoUtils/encoding/cryptoUtils.base64url.d.ts

@@ -1,9 +1,9 @@
 /**
- * Converts bytes into URL-safe Base64 without padding.
+ * Converts bytes into URL-safe Base64 without padding. Alias of `toBase64Url`.
  */
-export declare function bytesToBase64Url(value: Uint8Array): string;
+export declare const bytesToBase64Url: (value: Uint8Array) => string;
 /**
- * Converts URL-safe Base64 into bytes.
+ * Converts URL-safe Base64 into bytes. Alias of `fromBase64Url`.
  */
-export declare function base64UrlToBytes(value: string): Uint8Array;
+export declare const base64UrlToBytes: (value: string) => Uint8Array;
 //# sourceMappingURL=cryptoUtils.base64url.d.ts.map

package/dist/cryptoUtils/encoding/cryptoUtils.base64url.js

@@ -1,37 +1,10 @@
+import { toBase64Url, fromBase64Url, } from "../../cryptoEncoding/encoding/cryptoEncoding.base64url.js";
 /**
- * Converts bytes into URL-safe Base64 without padding.
+ * Converts bytes into URL-safe Base64 without padding. Alias of `toBase64Url`.
  */
-export function bytesToBase64Url(value) {
-    const binary = Array.from(value)
-        .map((b) => String.fromCharCode(b))
-        .join("");
-    return btoa(binary)
-        .replace(/\+/g, "-")
-        .replace(/\//g, "_")
-        .replace(/=+$/, "");
-}
+export const bytesToBase64Url = toBase64Url;
 /**
- * Converts URL-safe Base64 into bytes.
+ * Converts URL-safe Base64 into bytes. Alias of `fromBase64Url`.
  */
-export function base64UrlToBytes(value) {
-    if (typeof value !== "string") {
-        throw new TypeError("Base64URL value must be a string.");
-    }
-    if (!/^[A-Za-z0-9_-]*$/.test(value)) {
-        throw new TypeError("Invalid Base64URL value.");
-    }
-    if (value.length % 4 === 1) {
-        throw new TypeError("Invalid Base64URL length.");
-    }
-    let base64 = value.replace(/-/g, "+").replace(/_/g, "/");
-    while (base64.length % 4) {
-        base64 += "=";
-    }
-    const binary = atob(base64);
-    const result = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i += 1) {
-        result[i] = binary.charCodeAt(i);
-    }
-    return result;
-}
+export const base64UrlToBytes = fromBase64Url;
 //# sourceMappingURL=cryptoUtils.base64url.js.map

package/dist/cryptoUtils/encoding/cryptoUtils.hex.d.ts

@@ -1,9 +1,9 @@
 /**
- * Converts bytes into a hexadecimal string.
+ * Converts bytes into a hexadecimal string. Alias of `toHex`.
  */
-export declare function bytesToHex(value: Uint8Array): string;
+export declare const bytesToHex: (value: Uint8Array) => string;
 /**
- * Converts a hexadecimal string into bytes.
+ * Converts a hexadecimal string into bytes. Alias of `fromHex`.
  */
-export declare function hexToBytes(value: string): Uint8Array;
+export declare const hexToBytes: (value: string) => Uint8Array;
 //# sourceMappingURL=cryptoUtils.hex.d.ts.map

package/dist/cryptoUtils/encoding/cryptoUtils.hex.js

@@ -1,25 +1,10 @@
+import { toHex, fromHex } from "../../cryptoEncoding/encoding/cryptoEncoding.hex.js";
 /**
- * Converts bytes into a hexadecimal string.
+ * Converts bytes into a hexadecimal string. Alias of `toHex`.
  */
-export function bytesToHex(value) {
-    return Array.from(value)
-        .map((b) => b.toString(16).padStart(2, "0"))
-        .join("");
-}
+export const bytesToHex = toHex;
 /**
- * Converts a hexadecimal string into bytes.
+ * Converts a hexadecimal string into bytes. Alias of `fromHex`.
  */
-export function hexToBytes(value) {
-    if (typeof value !== "string") {
-        throw new TypeError("Hex value must be a string.");
-    }
-    if (value.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(value)) {
-        throw new TypeError("Invalid hexadecimal value.");
-    }
-    const result = new Uint8Array(value.length / 2);
-    for (let i = 0; i < value.length; i += 2) {
-        result[i / 2] = parseInt(value.slice(i, i + 2), 16);
-    }
-    return result;
-}
+export const hexToBytes = fromHex;
 //# sourceMappingURL=cryptoUtils.hex.js.map

package/dist/index.d.ts

@@ -2,13 +2,12 @@
  * @zudojs/crypto
  *
  * Cryptographic primitives for the Zudojs framework.
- * Provides symmetric/asymmetric encryption, hashing, password hashing,
+ * Provides symmetric encryption, hashing, password hashing,
  * digital signatures, key derivation, and secure random generation.
  */
 export * from "./compare/index.js";
 export * from "./cryptoProvider/index.js";
 export * from "./node/index.js";
-export * from "./cryptoAlgorithm/index.js";
 export * from "./cryptoCipher/index.js";
 export * from "./cryptoConstants/index.js";
 export * from "./cryptoEncoding/index.js";

package/dist/index.js

@@ -2,13 +2,12 @@
  * @zudojs/crypto
  *
  * Cryptographic primitives for the Zudojs framework.
- * Provides symmetric/asymmetric encryption, hashing, password hashing,
+ * Provides symmetric encryption, hashing, password hashing,
  * digital signatures, key derivation, and secure random generation.
  */
 export * from "./compare/index.js";
 export * from "./cryptoProvider/index.js";
 export * from "./node/index.js";
-export * from "./cryptoAlgorithm/index.js";
 export * from "./cryptoCipher/index.js";
 export * from "./cryptoConstants/index.js";
 export * from "./cryptoEncoding/index.js";

package/dist/node/nodeCryptoProvider/nodeCryptoProvider.core.d.ts

@@ -1,4 +1,4 @@
-import type { CryptoProvider, HashAlgorithm, HmacAlgorithm, SignatureAlgorithm, KeyDerivationAlgorithm, CryptoInput, EncryptedData, DeriveKeyOptions } from "../../cryptoProvider/index.js";
+import type { CryptoProvider, HashAlgorithm, HmacAlgorithm, CryptoInput, EncryptedData, EncryptOptions, DecryptOptions, SignOptions, VerifyOptions, DeriveKeyOptions, PasswordHashProviderOptions } from "../../cryptoProvider/index.js";
 import type { CryptoCapabilities } from "../../cryptoProvider/cryptoProvider.type.js";
 export declare class NodeCryptoProvider implements CryptoProvider {
     readonly name = "node";
@@ -8,35 +8,12 @@ export declare class NodeCryptoProvider implements CryptoProvider {
     randomUUID(): Promise<string>;
     hash(algorithm: HashAlgorithm, data: CryptoInput): Promise<Uint8Array>;
     hmac(algorithm: HmacAlgorithm, key: CryptoInput, data: CryptoInput): Promise<Uint8Array>;
-    encrypt(options: {
-        key: CryptoInput;
-        plaintext: CryptoInput;
-        associatedData?: CryptoInput;
-        nonce?: Uint8Array;
-    }): Promise<EncryptedData>;
-    decrypt(options: {
-        key: CryptoInput;
-        encrypted: EncryptedData;
-        associatedData?: CryptoInput;
-    }): Promise<Uint8Array>;
-    sign(options: {
-        key: CryptoInput;
-        data: CryptoInput;
-        algorithm?: SignatureAlgorithm;
-    }): Promise<Uint8Array>;
-    verify(options: {
-        key: CryptoInput;
-        data: CryptoInput;
-        signature: Uint8Array;
-        algorithm?: SignatureAlgorithm;
-    }): Promise<boolean>;
+    encrypt(options: EncryptOptions): Promise<EncryptedData>;
+    decrypt(options: DecryptOptions): Promise<Uint8Array>;
+    sign(options: SignOptions): Promise<Uint8Array>;
+    verify(options: VerifyOptions): Promise<boolean>;
     deriveKey(options: DeriveKeyOptions): Promise<Uint8Array>;
-    hashPassword(password: CryptoInput, options?: {
-        algorithm?: KeyDerivationAlgorithm;
-        memoryCost?: number;
-        timeCost?: number;
-        parallelism?: number;
-    }): Promise<string>;
+    hashPassword(password: CryptoInput, options?: PasswordHashProviderOptions): Promise<string>;
     verifyPassword(password: CryptoInput, hash: string): Promise<boolean>;
 }
 //# sourceMappingURL=nodeCryptoProvider.core.d.ts.map

package/dist/node/nodeCryptoProvider/nodeCryptoProvider.core.js

@@ -4,7 +4,6 @@ import { sign as signImpl, verify as verifyImpl, } from "./primitives/nodeCrypto
 import { deriveKey as deriveKeyImpl } from "./operations/nodeCryptoProvider.derivation.js";
 import { hashPassword as hashPasswordImpl, verifyPassword as verifyPasswordImpl, } from "./operations/nodeCryptoProvider.password.js";
 import { randomBytesImpl, randomIntImpl, randomUUIDImpl, } from "./primitives/nodeCryptoProvider.random.js";
-import { cryptoHashError, cryptoCipherError, cryptoSignatureError, cryptoKeyDerivationError, } from "@zudojs/errors";
 export class NodeCryptoProvider {
     name = "node";
     capabilities = {

package/dist/node/nodeCryptoProvider/nodeCryptoProvider.helper.d.ts

@@ -1,8 +1,13 @@
 import type { HashAlgorithm, HmacAlgorithm } from "../../cryptoProvider/index.js";
-import type { SignatureAlgorithm } from "../../cryptoProvider/index.js";
+/**
+ * Normalizes any `CryptoInput` into bytes (strings are UTF-8 encoded).
+ */
 export declare function toBytes(input: Uint8Array | string | ArrayBuffer): Uint8Array;
+/**
+ * Maps a package hash algorithm name to the OpenSSL digest name.
+ *
+ * Only the allowlisted algorithms are accepted; anything else (md5, sha1,
+ * arbitrary strings from configuration) throws.
+ */
 export declare function nodeHashAlgorithm(algorithm: HashAlgorithm | HmacAlgorithm): string;
-export declare function nodeSignatureAlgorithm(algorithm: SignatureAlgorithm): string;
-export declare function toBase64Url(bytes: Uint8Array): string;
-export declare function fromBase64Url(value: string): Uint8Array;
 //# sourceMappingURL=nodeCryptoProvider.helper.d.ts.map

package/dist/node/nodeCryptoProvider/nodeCryptoProvider.helper.js

@@ -1,3 +1,6 @@
+/**
+ * Normalizes any `CryptoInput` into bytes (strings are UTF-8 encoded).
+ */
 export function toBytes(input) {
     if (input instanceof Uint8Array) {
         return input;
@@ -5,51 +8,30 @@ export function toBytes(input) {
     if (typeof input === "string") {
         return new Uint8Array(Buffer.from(input, "utf8"));
     }
-    return new Uint8Array(input);
-}
-export function nodeHashAlgorithm(algorithm) {
-    const map = {
-        sha256: "sha256",
-        sha384: "sha384",
-        sha512: "sha512",
-        "sha3-256": "sha3-256",
-        "sha3-384": "sha3-384",
-        "sha3-512": "sha3-512",
-    };
-    return map[algorithm] ?? algorithm;
-}
-export function nodeSignatureAlgorithm(algorithm) {
-    switch (algorithm) {
-        case "rsa-sha256":
-            return "RSA-SHA256";
-        case "rsa-sha384":
-            return "RSA-SHA384";
-        case "rsa-sha512":
-            return "RSA-SHA512";
-        case "ecdsa-sha256":
-            return "ecdsa-SHA256";
-        case "ecdsa-sha384":
-            return "ecdsa-SHA384";
-        case "ecdsa-sha512":
-            return "ecdsa-SHA512";
-        case "ed25519":
-            return "ed25519";
-        default:
-            throw new TypeError(`Unsupported signature algorithm: ${algorithm}.`);
+    if (input instanceof ArrayBuffer) {
+        return new Uint8Array(input);
     }
+    throw new TypeError("Input must be a string, Uint8Array, or ArrayBuffer.");
 }
-export function toBase64Url(bytes) {
-    return Buffer.from(bytes)
-        .toString("base64")
-        .replace(/\+/g, "-")
-        .replace(/\//g, "_")
-        .replace(/=/g, "");
-}
-export function fromBase64Url(value) {
-    let base64 = value.replace(/-/g, "+").replace(/_/g, "/");
-    while (base64.length % 4 !== 0) {
-        base64 += "=";
+const NODE_HASH_ALGORITHMS = Object.freeze({
+    sha256: "sha256",
+    sha384: "sha384",
+    sha512: "sha512",
+    "sha3-256": "sha3-256",
+    "sha3-384": "sha3-384",
+    "sha3-512": "sha3-512",
+});
+/**
+ * Maps a package hash algorithm name to the OpenSSL digest name.
+ *
+ * Only the allowlisted algorithms are accepted; anything else (md5, sha1,
+ * arbitrary strings from configuration) throws.
+ */
+export function nodeHashAlgorithm(algorithm) {
+    const name = typeof algorithm === "string" ? NODE_HASH_ALGORITHMS[algorithm] : undefined;
+    if (name === undefined) {
+        throw new TypeError(`Unsupported hash algorithm: ${String(algorithm)}.`);
     }
-    return new Uint8Array(Buffer.from(base64, "base64"));
+    return name;
 }
 //# sourceMappingURL=nodeCryptoProvider.helper.js.map

package/dist/node/nodeCryptoProvider/operations/nodeCryptoProvider.derivation.d.ts

@@ -1,3 +1,10 @@
 import type { DeriveKeyOptions } from "../../../cryptoProvider/index.js";
+/**
+ * Computes a memory bound for scrypt from its parameters.
+ *
+ * OpenSSL requires roughly `128 * N * r` bytes plus `128 * r * p`; we
+ * double that for margin and never go below Node's own 32 MiB default.
+ */
+export declare function defaultScryptMaxMemory(N: number, r: number, p: number): number;
 export declare function deriveKey(options: DeriveKeyOptions): Promise<Uint8Array>;
 //# sourceMappingURL=nodeCryptoProvider.derivation.d.ts.map