effect 4.0.7 → 4.1.0

package/src/crypto/internal/der.ts

@@ -0,0 +1,110 @@
+/**
+ * The few DER operations `KeyFormat` needs to turn PKCS#1 and SEC1 private
+ * keys into PKCS#8, and to find the public point of an EC private key.
+ */
+
+/** @internal */
+export interface Element {
+  readonly tag: number
+  /** The offset of the tag. */
+  readonly offset: number
+  /** The offset of the contents. */
+  readonly start: number
+  /** The offset after the contents. */
+  readonly end: number
+}
+
+/**
+ * Reads the element at `offset`, returning `undefined` when it does not fit
+ * in `end` or its length is not in definite form of at most 3 bytes.
+ *
+ * @internal
+ */
+export const read = (bytes: Uint8Array, offset: number, end = bytes.length): Element | undefined => {
+  if (offset + 2 > end) return undefined
+  const tag = bytes[offset]
+  const first = bytes[offset + 1]
+  let start = offset + 2
+  let length = first
+  if (first >= 0x80) {
+    const size = first & 0x7f
+    if (size === 0 || size > 3 || start + size > end) return undefined
+    length = 0
+    for (let i = 0; i < size; i++) length = length * 256 + bytes[start++]
+  }
+  return start + length > end ? undefined : { tag, offset, start, end: start + length }
+}
+
+/**
+ * Reads a whole input as one element, with nothing after it.
+ *
+ * @internal
+ */
+export const readOnly = (bytes: Uint8Array, tag: number): Element | undefined => {
+  const element = read(bytes, 0)
+  return element !== undefined && element.tag === tag && element.end === bytes.length ? element : undefined
+}
+
+/**
+ * Reads the elements inside a constructed element, returning `undefined`
+ * when they do not fill it exactly.
+ *
+ * @internal
+ */
+export const children = (bytes: Uint8Array, parent: Element): ReadonlyArray<Element> | undefined => {
+  const out: Array<Element> = []
+  let offset = parent.start
+  while (offset < parent.end) {
+    const element = read(bytes, offset, parent.end)
+    if (element === undefined) return undefined
+    out.push(element)
+    offset = element.end
+  }
+  return out
+}
+
+/** @internal */
+export const slice = (bytes: Uint8Array, element: Element): Uint8Array => bytes.subarray(element.offset, element.end)
+
+const length = (n: number): Array<number> =>
+  n < 0x80
+    ? [n]
+    : n < 0x100
+    ? [0x81, n]
+    : n < 0x10000
+    ? [0x82, n >> 8, n & 0xff]
+    : [0x83, n >> 16, (n >> 8) & 0xff, n & 0xff]
+
+/**
+ * Encodes an element from its tag and contents.
+ *
+ * @internal
+ */
+export const encode = (tag: number, ...contents: ReadonlyArray<Uint8Array>): Uint8Array => {
+  const size = contents.reduce((sum, part) => sum + part.length, 0)
+  const header = [tag, ...length(size)]
+  const out = new Uint8Array(header.length + size)
+  out.set(header)
+  let offset = header.length
+  for (const part of contents) {
+    out.set(part, offset)
+    offset += part.length
+  }
+  return out
+}
+
+/** @internal */
+export const sequence = 0x30
+
+/** @internal */
+export const octetString = 0x04
+
+/** @internal */
+export const integer = 0x02
+
+/** @internal */
+export const objectIdentifier = 0x06
+
+/** @internal */
+export const equals = (a: Uint8Array, b: Uint8Array): boolean =>
+  a.length === b.length && a.every((byte, i) => byte === b[i])

package/src/crypto/internal/digest.ts

@@ -0,0 +1,16 @@
+import * as Effect from "../../Effect.ts"
+import type { Algorithm } from "../Digest.ts"
+import * as internal from "./webCrypto.ts"
+
+/** @internal */
+export const webCryptoDigest = (crypto: Crypto, algorithm: Algorithm, data: Uint8Array): Effect.Effect<Uint8Array> => {
+  const implementation = algorithm.implementation
+  if (implementation !== undefined) {
+    return Effect.sync(() => implementation(data))
+  }
+  return Effect.suspend(() => {
+    const subtle = crypto?.subtle
+    if (subtle === undefined) return Effect.die(internal.subtleUnavailable())
+    return Effect.promise(async () => new Uint8Array(await subtle.digest(algorithm.name, data as BufferSource)))
+  })
+}

package/src/crypto/internal/key.ts

@@ -0,0 +1,235 @@
+import * as Effect from "../../Effect.ts"
+import * as Equal from "../../Equal.ts"
+import { format } from "../../Formatter.ts"
+import { NodeInspectSymbol } from "../../Inspectable.ts"
+import * as Predicate from "../../Predicate.ts"
+import type * as CryptoError from "../CryptoError.ts"
+import * as internal from "./webCrypto.ts"
+
+/**
+ * What a key holds: bytes, which every layer accepts, or a `CryptoKey` from a
+ * `*FromCryptoKey` constructor.
+ *
+ * @internal
+ */
+export type Material =
+  | { readonly _tag: "Bytes"; readonly bytes: Uint8Array }
+  | { readonly _tag: "CryptoKey"; readonly cryptoKey: CryptoKey }
+
+/**
+ * The property holding a key's material. Only this package reads it: platform
+ * layers pass primitives to a family's `layerWebCryptoWith` instead, and
+ * third-party layers use the family's public `toBytes`.
+ *
+ * This is not a secrecy mechanism. Being non-enumerable keeps the material out
+ * of `JSON.stringify` and `inspect`, but anyone holding a key can reach it
+ * through `Object.getOwnPropertySymbols`.
+ *
+ * @internal
+ */
+export const MaterialId: unique symbol = Symbol("~effect/crypto/Key/material") as never
+
+/**
+ * Copies bytes into a plain `Uint8Array` with its own buffer. A subclass's
+ * `slice` may not copy: a Node.js `Buffer`'s returns a view of the same memory.
+ *
+ * @internal
+ */
+export const copyBytes = (bytes: Uint8Array): Uint8Array => new Uint8Array(bytes)
+
+/** @internal */
+export const material = (key: object): Material => (key as { readonly [MaterialId]: Material })[MaterialId]
+
+/**
+ * Builds a key prototype that displays only its algorithm.
+ *
+ * @internal
+ */
+export const redactedProto = (typeId: string, label: string): object => ({
+  [typeId]: typeId,
+  toJSON(this: { readonly algorithm: { readonly name: string } }) {
+    return { _id: label, algorithm: this.algorithm.name }
+  },
+  toString(this: { toJSON(): unknown }) {
+    return format(this.toJSON())
+  },
+  [NodeInspectSymbol](this: { toJSON(): unknown }) {
+    return this.toJSON()
+  }
+})
+
+/**
+ * Builds a key. Keys compare by reference: comparing key bytes is not constant
+ * time, and structural equality would let secret keys act as `HashMap` keys.
+ */
+const make = <K>(proto: object, algorithm: unknown, material: Material): K =>
+  Equal.byReferenceUnsafe(Object.create(proto, {
+    algorithm: { value: algorithm, enumerable: true },
+    [MaterialId]: { value: material }
+  }))
+
+/** @internal */
+export const makeBytes = <K>(proto: object, algorithm: unknown, bytes: Uint8Array): K =>
+  make(proto, algorithm, { _tag: "Bytes", bytes })
+
+/**
+ * Checks the length of a symmetric key against its algorithm.
+ *
+ * @internal
+ */
+export const checkKeyLength =
+  (algorithm: { readonly name: string; readonly keyLength: number }) => (bytes: Uint8Array): string | undefined =>
+    bytes.length === algorithm.keyLength
+      ? undefined
+      : `Expected a ${algorithm.keyLength}-byte key for ${algorithm.name}, not ${bytes.length} bytes`
+
+/**
+ * Copies raw key bytes into a byte-backed key, rejecting other values and
+ * bytes that fail `check`.
+ *
+ * @internal
+ */
+export const fromBytes = <K>(
+  module: string,
+  method: string,
+  proto: object,
+  algorithm: unknown,
+  bytes: Uint8Array,
+  check: (bytes: Uint8Array) => string | undefined
+): Effect.Effect<K, CryptoError.CryptoError> =>
+  Effect.suspend(() => {
+    if (!(bytes instanceof Uint8Array)) return internal.invalidKey(module, method, "Expected the key as a Uint8Array")
+    const problem = check(bytes)
+    return problem === undefined
+      ? Effect.succeed(makeBytes<K>(proto, algorithm, copyBytes(bytes)))
+      : internal.invalidKey(module, method, problem)
+  })
+
+/**
+ * What a `CryptoKey` must match to back a typed key.
+ *
+ * `usagePolicy: "all"` requires every expected usage. `"any"` is for RSA-OAEP,
+ * where the layer chooses an available usage for the key's role.
+ *
+ * @internal
+ */
+export interface ExpectedCryptoKey {
+  readonly type: KeyType
+  readonly name: string
+  readonly usages: ReadonlyArray<KeyUsage>
+  readonly usagePolicy: "all" | "any"
+  readonly check?: ((algorithm: KeyAlgorithm) => string | undefined) | undefined
+}
+
+/**
+ * Checks that an AES `CryptoKey` has the algorithm's length.
+ *
+ * @internal
+ */
+export const checkAesLength = (name: string, keyLength: number) => (algorithm: KeyAlgorithm): string | undefined => {
+  const length = (algorithm as AesKeyAlgorithm).length
+  return length === keyLength * 8 ? undefined : `Expected a ${keyLength * 8}-bit ${name} key, not ${length} bits`
+}
+
+const checkCryptoKey = (cryptoKey: CryptoKey, expected: ExpectedCryptoKey): string | undefined => {
+  if (
+    !Predicate.hasProperty(cryptoKey, "type") || !Predicate.hasProperty(cryptoKey, "algorithm") ||
+    !Predicate.hasProperty(cryptoKey, "usages") || !Array.isArray(cryptoKey.usages)
+  ) {
+    return "Expected a CryptoKey"
+  }
+  if (cryptoKey.algorithm.name !== expected.name) {
+    return `Expected a ${expected.name} key, not ${cryptoKey.algorithm.name}`
+  }
+  if (cryptoKey.type !== expected.type) return `Expected a ${expected.type} key, not ${cryptoKey.type}`
+  const problem = expected.check?.(cryptoKey.algorithm)
+  if (problem !== undefined) return problem
+  const usages: ReadonlyArray<string> = cryptoKey.usages
+  if (expected.usagePolicy === "all") {
+    if (!expected.usages.every((usage) => usages.includes(usage))) {
+      return `Expected a key with the usages ${expected.usages.join(" and ")}, not ${usages.join(", ") || "none"}`
+    }
+  } else if (!expected.usages.some((usage) => usages.includes(usage))) {
+    return `Expected a key with one of the usages ${expected.usages.join(", ")}`
+  }
+  return undefined
+}
+
+/**
+ * The algorithm of a key imported from `cryptoKey`. An RSA algorithm's
+ * `modulusLength` is only read by key generation, so the key reports the real
+ * size of `cryptoKey` instead.
+ *
+ * @internal
+ */
+export const importedAlgorithm = (algorithm: unknown, cryptoKey: CryptoKey): unknown => {
+  const modulusLength = (cryptoKey.algorithm as Partial<RsaKeyAlgorithm>).modulusLength
+  return Predicate.hasProperty(algorithm, "modulusLength") && modulusLength !== undefined &&
+      algorithm.modulusLength !== modulusLength
+    ? { ...algorithm, modulusLength }
+    : algorithm
+}
+
+/**
+ * Synchronously validates and wraps a `CryptoKey`.
+ *
+ * @internal
+ */
+export const fromCryptoKey = <K>(
+  module: string,
+  method: string,
+  proto: object,
+  algorithm: unknown,
+  cryptoKey: CryptoKey,
+  expected: ExpectedCryptoKey
+): Effect.Effect<K, CryptoError.CryptoError> =>
+  Effect.suspend(() => {
+    const problem = checkCryptoKey(cryptoKey, expected)
+    return problem === undefined
+      ? Effect.succeed(make<K>(proto, importedAlgorithm(algorithm, cryptoKey), { _tag: "CryptoKey", cryptoKey }))
+      : internal.invalidKey(module, method, problem)
+  })
+
+/** @internal */
+export const exportRaw = async (subtle: SubtleCrypto, cryptoKey: CryptoKey): Promise<Uint8Array> =>
+  new Uint8Array(await subtle.exportKey("raw", cryptoKey))
+
+/**
+ * Exports a key's stored representation as fresh bytes. `CryptoKey`-backed
+ * keys are exported on the `WebCrypto` reference with `exportKey`.
+ *
+ * @internal
+ */
+export const toBytes = (
+  module: string,
+  key: { readonly algorithm: { readonly name: string } },
+  exportKey: (subtle: SubtleCrypto, cryptoKey: CryptoKey) => Promise<Uint8Array>
+): Effect.Effect<Uint8Array, CryptoError.CryptoError> =>
+  Effect.suspend(() => {
+    const stored = material(key)
+    if (stored._tag === "Bytes") return Effect.succeed(copyBytes(stored.bytes))
+    if (!stored.cryptoKey.extractable) return internal.notExtractable(module, "toBytes")
+    return internal.runWithReference(module, "toBytes", key.algorithm.name, (subtle) =>
+      exportKey(subtle, stored.cryptoKey))
+  })
+
+/**
+ * A per-layer cache of the `CryptoKey`s imported from byte-backed keys.
+ *
+ * @internal
+ */
+export const makeCache = (
+  importKey: (subtle: SubtleCrypto, bytes: Uint8Array, algorithm: any) => Promise<CryptoKey>
+) => {
+  const cache = new WeakMap<object, CryptoKey>()
+  return async (subtle: SubtleCrypto, key: { readonly algorithm: unknown }): Promise<CryptoKey> => {
+    const stored = material(key)
+    if (stored._tag === "CryptoKey") return stored.cryptoKey
+    let cryptoKey = cache.get(key)
+    if (cryptoKey === undefined) {
+      cryptoKey = await importKey(subtle, stored.bytes, key.algorithm)
+      cache.set(key, cryptoKey)
+    }
+    return cryptoKey
+  }
+}

package/src/crypto/internal/md5.ts

@@ -0,0 +1,170 @@
+/**
+ * MD5 (RFC 1321), vendored from `@noble/hashes`.
+ *
+ * Upstream: https://github.com/paulmillr/noble-hashes
+ * Version: 2.4.0, commit 663c2aeeffc308ac0cded59bd32f7c212adacfc2
+ * Files: `src/legacy.ts` (`_MD5`), `src/_md.ts` (`HashMD`, `Chi`), and the
+ * helpers it uses from `src/utils.ts` and `src/_u64.ts`.
+ *
+ * Changes from upstream: merged into one file, removed the `Hash` interface,
+ * cloning, input assertions, and `destroy` bookkeeping, and exposed only a
+ * one-shot `md5(data)` function. The compression function and padding are
+ * unchanged.
+ *
+ * The MIT License (MIT)
+ *
+ * Copyright (c) 2022 Paul Miller (https://paulmillr.com)
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ *
+ * @internal
+ */
+
+// utils.ts
+const createView = (arr: Uint8Array): DataView => new DataView(arr.buffer, arr.byteOffset, arr.byteLength)
+const rotl = (word: number, shift: number): number => (word << shift) | ((word >>> (32 - shift)) >>> 0)
+
+// _u64.ts
+const setU64FromNum = (view: DataView, byteOffset: number, n: number, isLE: boolean): void => {
+  const h = (n / 2 ** 32) | 0
+  const l = n >>> 0
+  view.setUint32(byteOffset, isLE ? l : h, isLE)
+  view.setUint32(byteOffset + 4, isLE ? h : l, isLE)
+}
+
+// _md.ts
+const Chi = (a: number, b: number, c: number): number => (a & b) ^ (~a & c)
+
+// legacy.ts
+const p32 = Math.pow(2, 32)
+const K = Array.from({ length: 64 }, (_, i) => Math.floor(p32 * Math.abs(Math.sin(i + 1))))
+const MD5_IV = Uint32Array.from([0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476])
+const MD5_W = new Uint32Array(16)
+const MD5_SHIFTS = (() => {
+  const S = [
+    [7, 12, 17, 22],
+    [5, 9, 14, 20],
+    [4, 11, 16, 23],
+    [6, 10, 15, 21]
+  ]
+  return Uint8Array.from({ length: 64 }, (_, i) => S[Math.floor(i / 16)][i % 4])
+})()
+
+const blockLen = 64
+const outputLen = 16
+const padOffset = 8
+const isLE = true
+
+class MD5 {
+  private A = MD5_IV[0] | 0
+  private B = MD5_IV[1] | 0
+  private C = MD5_IV[2] | 0
+  private D = MD5_IV[3] | 0
+
+  private buffer = new Uint8Array(blockLen)
+  private view = createView(this.buffer)
+  private length = 0
+  private pos = 0
+
+  private get(): [number, number, number, number] {
+    const { A, B, C, D } = this
+    return [A, B, C, D]
+  }
+  private set(A: number, B: number, C: number, D: number): void {
+    this.A = A | 0
+    this.B = B | 0
+    this.C = C | 0
+    this.D = D | 0
+  }
+  private process(view: DataView, offset: number): void {
+    for (let i = 0; i < 16; i++, offset += 4) MD5_W[i] = view.getUint32(offset, true)
+    let { A, B, C, D } = this
+    for (let i = 0; i < 64; i++) {
+      let F, g
+      if (i < 16) {
+        F = Chi(B, C, D)
+        g = i
+      } else if (i < 32) {
+        // RFC 1321 round 2 uses G(B,C,D) = (B & D) | (C & ~D), which is `Chi(D, B, C)`.
+        F = Chi(D, B, C)
+        g = (5 * i + 1) % 16
+      } else if (i < 48) {
+        F = B ^ C ^ D
+        g = (3 * i + 5) % 16
+      } else {
+        F = C ^ (B | ~D)
+        g = (7 * i) % 16
+      }
+      F = F + A + K[i] + MD5_W[g]
+      A = D
+      D = C
+      C = B
+      B = B + rotl(F, MD5_SHIFTS[i])
+    }
+    A = (A + this.A) | 0
+    B = (B + this.B) | 0
+    C = (C + this.C) | 0
+    D = (D + this.D) | 0
+    this.set(A, B, C, D)
+  }
+  update(data: Uint8Array): this {
+    const { view, buffer } = this
+    const len = data.length
+    for (let pos = 0; pos < len;) {
+      const take = Math.min(blockLen - this.pos, len - pos)
+      if (take === blockLen) {
+        const dataView = createView(data)
+        for (; blockLen <= len - pos; pos += blockLen) this.process(dataView, pos)
+        continue
+      }
+      buffer.set(data.subarray(pos, pos + take), this.pos)
+      this.pos += take
+      pos += take
+      if (this.pos === blockLen) {
+        this.process(view, 0)
+        this.pos = 0
+      }
+    }
+    this.length += data.length
+    return this
+  }
+  digest(): Uint8Array {
+    const { buffer, view } = this
+    let { pos } = this
+    buffer[pos++] = 0b10000000
+    buffer.fill(0, pos)
+    if (padOffset > blockLen - pos) {
+      this.process(view, 0)
+      buffer.fill(0)
+    }
+    setU64FromNum(view, blockLen - 8, this.length * 8, isLE)
+    this.process(view, 0)
+    MD5_W.fill(0)
+    const out = new Uint8Array(outputLen)
+    const oview = createView(out)
+    const state = this.get()
+    for (let i = 0; i < outputLen / 4; i++) oview.setUint32(4 * i, state[i], isLE)
+    this.set(0, 0, 0, 0)
+    buffer.fill(0)
+    return out
+  }
+}
+
+/** @internal */
+export const md5 = (data: Uint8Array): Uint8Array => new MD5().update(data).digest()

package/src/crypto/internal/webCrypto.ts

@@ -0,0 +1,150 @@
+import * as Effect from "../../Effect.ts"
+import * as Predicate from "../../Predicate.ts"
+import * as CryptoError from "../CryptoError.ts"
+import { WebCrypto } from "../WebCrypto.ts"
+
+/** @internal */
+export const subtleUnavailable = (): Error =>
+  new Error("crypto.subtle is unavailable; browsers expose it only in secure contexts")
+
+/** @internal */
+export const fail = (
+  module: string,
+  method: string,
+  reason: CryptoError.CryptoErrorReason
+): Effect.Effect<never, CryptoError.CryptoError> => Effect.fail(new CryptoError.CryptoError({ module, method, reason }))
+
+/** @internal */
+export const invalidKey = (module: string, method: string, description: string) =>
+  fail(module, method, new CryptoError.InvalidKey({ description }))
+
+/** @internal */
+export const notExtractable = (module: string, method: string) =>
+  fail(module, method, new CryptoError.NotExtractable({ description: "The CryptoKey is not extractable" }))
+
+/**
+ * Moves an error raised by another module's function onto `module.method`.
+ *
+ * @internal
+ */
+export const rehome = (module: string, method: string) => (error: CryptoError.CryptoError) =>
+  fail(module, method, error.reason)
+
+/**
+ * Thrown inside {@link run} to fail with a typed reason instead of a defect,
+ * for checks that need the imported `CryptoKey`.
+ *
+ * @internal
+ */
+export class Failure {
+  readonly reason: CryptoError.CryptoErrorReason
+  constructor(reason: CryptoError.CryptoErrorReason) {
+    this.reason = reason
+  }
+}
+
+/** @internal */
+export const isOperationError = (cause: unknown): boolean =>
+  Predicate.hasProperty(cause, "name") && cause.name === "OperationError"
+
+/**
+ * Maps an exception thrown by `crypto.subtle` in `module.layerWebCrypto` to a
+ * `CryptoError`.
+ *
+ * A {@link Failure} carries its own reason. `DataError` and
+ * `InvalidAccessError` are `InvalidKey`, and `NotSupportedError` is
+ * `Unsupported`, naming the algorithm and the layer. An `OperationError`
+ * becomes the reason from `onOperationError`, such as `DecryptionFailed` for a
+ * decryption. Any other exception is rethrown, which `Effect.tryPromise` turns
+ * into a defect.
+ *
+ * @internal
+ */
+export const webCryptoError = (
+  module: string,
+  method: string,
+  algorithm: string,
+  cause: unknown,
+  onOperationError?: () => CryptoError.CryptoErrorReason
+): CryptoError.CryptoError =>
+  toCryptoError(module, method, `${module}.layerWebCrypto`, algorithm, cause, onOperationError)
+
+const toCryptoError = (
+  module: string,
+  method: string,
+  provider: string,
+  algorithm: string,
+  cause: unknown,
+  onOperationError?: () => CryptoError.CryptoErrorReason
+): CryptoError.CryptoError => {
+  const reason = reasonFor(method, provider, algorithm, cause, onOperationError)
+  if (reason === undefined) throw cause
+  return new CryptoError.CryptoError({ module, method, reason })
+}
+
+const reasonFor = (
+  method: string,
+  provider: string,
+  algorithm: string,
+  cause: unknown,
+  onOperationError: (() => CryptoError.CryptoErrorReason) | undefined
+): CryptoError.CryptoErrorReason | undefined => {
+  if (cause instanceof Failure) return cause.reason
+  switch (Predicate.hasProperty(cause, "name") ? cause.name : undefined) {
+    case "DataError":
+      return new CryptoError.InvalidKey({ description: "Invalid key data", cause })
+    case "InvalidAccessError":
+      return new CryptoError.InvalidKey({ description: `The key cannot be used for ${method}`, cause })
+    case "NotSupportedError":
+      return new CryptoError.Unsupported({ description: `${provider} does not provide ${algorithm}`, cause })
+    case "OperationError":
+      return onOperationError?.()
+    default:
+      return undefined
+  }
+}
+
+/**
+ * Runs `f` on the `subtle` of a `Crypto` object in `module.layerWebCrypto`,
+ * dying when it is missing, as in an insecure browser context. Exceptions go
+ * through `onError`, which defaults to {@link webCryptoError}.
+ *
+ * @internal
+ */
+export const run = <A>(
+  module: string,
+  method: string,
+  algorithm: string,
+  crypto: Crypto | undefined,
+  f: (subtle: SubtleCrypto) => Promise<A>,
+  onError: (cause: unknown) => CryptoError.CryptoError = (cause) => webCryptoError(module, method, algorithm, cause)
+): Effect.Effect<A, CryptoError.CryptoError> =>
+  Effect.suspend(() => {
+    const subtle = crypto?.subtle
+    if (subtle === undefined) return Effect.die(subtleUnavailable())
+    return Effect.tryPromise({ try: () => f(subtle), catch: onError })
+  })
+
+/**
+ * {@link run} on the `WebCrypto` reference, for the top-level functions that
+ * have no layer to read it from. `crypto.subtle` is named as the provider
+ * that declined an algorithm.
+ *
+ * @internal
+ */
+export const runWithReference = <A>(
+  module: string,
+  method: string,
+  algorithm: string,
+  f: (subtle: SubtleCrypto) => Promise<A>
+): Effect.Effect<A, CryptoError.CryptoError> =>
+  WebCrypto.use((crypto) =>
+    run(
+      module,
+      method,
+      algorithm,
+      crypto,
+      f,
+      (cause) => toCryptoError(module, method, "crypto.subtle", algorithm, cause)
+    )
+  )

package/src/encoding/Base64Url.ts

@@ -102,13 +102,16 @@ export const encodePadded: (input: Uint8Array | string) => string = (input) =>
 export const decode = (str: string): Result.Result<Uint8Array, EncodingError> => {
   const stripped = str.replace(/[\n\r]/g, "")
   const length = stripped.length
-  if (length % 4 === 1) {
+  const padded = stripped.endsWith("=")
+  if (padded ? length % 4 !== 0 : length % 4 === 1) {
     return Result.fail(
       new EncodingError({
         module: "Base64Url",
         kind: "Decode",
         input: stripped,
-        message: `Length should be a multiple of 4, but is ${length}`
+        message: padded
+          ? `Padded length should be a multiple of 4, but is ${length}`
+          : `Unpadded length should not be 1 more than a multiple of 4, but is ${length}`
       })
     )
   }