eyeprolog 1.5.8 → 1.5.9

package/README.md

@@ -61,7 +61,7 @@ Normal mode executes top-level `Conclusion :+ Premise` rules through the bundled
 
 Bundled `src/lib/` predicates autoload in files, CLI/API goals, and the REPL; use `--no-autoload` to require explicit imports, and explicitly import libraries that introduce operators before using their syntax. See [*The Art of EyeProlog*](the-art-of-eyeprolog.md) for the full semantics.
 
-The Trealla/Scryer compatibility surface now also includes chars-based term I/O and Base64 helpers, rational-form conversion in `library(arithmetic)`, `sleep/1`, the shared `library(iso_ext)` control/term re-exports, and focused `library(files)` and `library(os)` modules. Filesystem and OS side effects require Node; browser calls report an unavailable host resource instead. Non-integral `number_to_rational/2` results are represented structurally as `rdiv(Numerator,Denominator)` until rational numbers become processor numeric values.
+The Trealla/Scryer compatibility surface now also includes chars-based term I/O and Base64 helpers, rational-form conversion in `library(arithmetic)`, `sleep/1`, the shared `library(iso_ext)` control/term re-exports, focused `library(files)` and `library(os)` modules, and Scryer-compatible `library(crypto)`. The crypto module covers hashing/HMAC, HKDF, PBKDF2 password hashes, ChaCha20-Poly1305, Ed25519, X25519, and secp256k1 helpers; hashing/KDF/encryption and Ed25519/X25519 use Node's cryptographic backend, secure random bytes also use Web Crypto when available, and unsupported browser operations report `resource_error(crypto)`. Filesystem and OS side effects likewise require Node. Non-integral `number_to_rational/2` results are represented structurally as `rdiv(Numerator,Denominator)` until rational numbers become processor numeric values.
 
 ## Links
 

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.5.8",
+  "version": "1.5.9",
   "description": "EyeProlog turns facts and rules into answers and proofs.",
   "type": "module",
   "main": "./index.js",

package/src/crypto-host.js

@@ -0,0 +1,628 @@
+// Host adapters for library(crypto).
+//
+// The public compatibility surface lives in src/lib/crypto.pl.  Keep the
+// runtime-specific cryptographic operations here so the Prolog module remains
+// source-compatible with Scryer's library while Node's audited crypto backend
+// performs the sensitive primitives.
+
+import { isNode } from './platform.js';
+import {
+  ATOM, COMPOUND, NUMBER, VAR, atom, compound, copyResolved, deref,
+  listFromItems, numberTerm, properListItems, unify,
+} from './term.js';
+import { PrologError } from './errors.js';
+
+let nodeCrypto = null;
+if (isNode) nodeCrypto = await import('node:crypto');
+
+const HASH_ALGORITHMS = new Map([
+  ['ripemd160', 'ripemd160'],
+  ['sha256', 'sha256'],
+  ['sha384', 'sha384'],
+  ['sha512', 'sha512'],
+  ['sha512_256', 'sha512-256'],
+  ['sha3_224', 'sha3-224'],
+  ['sha3_256', 'sha3-256'],
+  ['sha3_384', 'sha3-384'],
+  ['sha3_512', 'sha3-512'],
+  ['blake2s256', 'blake2s256'],
+  ['blake2b512', 'blake2b512'],
+]);
+const HMAC_ALGORITHMS = new Set(['sha256', 'sha384', 'sha512']);
+const HKDF_ALGORITHMS = new Set(['sha256', 'sha384', 'sha512']);
+const ED25519_PRIVATE_PREFIX = hexBuffer('302e020100300506032b657004220420');
+const ED25519_PUBLIC_PREFIX = hexBuffer('302a300506032b6570032100');
+const X25519_PRIVATE_PREFIX = hexBuffer('302e020100300506032b656e04220420');
+const X25519_PUBLIC_PREFIX = hexBuffer('302a300506032b656e032100');
+const SECP256K1_P = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2fn;
+const SECP256K1_N = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141n;
+const SECP256K1_GX = 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798n;
+const SECP256K1_GY = 0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8n;
+
+function hexBuffer(text) {
+  if (typeof Buffer === 'undefined') return null;
+  return Buffer.from(text, 'hex');
+}
+
+function requireCrypto() {
+  if (!isNode || nodeCrypto == null || typeof Buffer === 'undefined') {
+    throw new PrologError('resource_error(crypto)');
+  }
+  return nodeCrypto;
+}
+
+function listItems(term, env) {
+  const value = deref(term, env);
+  if (value.type === VAR) throw new PrologError('instantiation_error');
+  const items = properListItems(value, env);
+  if (items == null) throw new PrologError('type_error(list)', copyResolved(value, env));
+  return items;
+}
+
+function characterListText(term, env, { octets = false, allowIntegers = false } = {}) {
+  const items = listItems(term, env);
+  let text = '';
+  for (const itemTerm of items) {
+    const item = deref(itemTerm, env);
+    if (item.type === VAR) throw new PrologError('instantiation_error');
+    if (allowIntegers && item.type === NUMBER && /^\d+$/.test(item.name)) {
+      const code = Number(item.name);
+      if (!Number.isInteger(code) || code < 0 || code > 255) {
+        throw new PrologError('type_error(byte)', copyResolved(item, env));
+      }
+      text += String.fromCodePoint(code);
+      continue;
+    }
+    if (item.type !== ATOM || Array.from(item.name).length !== 1) {
+      throw new PrologError('type_error(character)', copyResolved(item, env));
+    }
+    const code = item.name.codePointAt(0);
+    if (octets && code > 255) throw new PrologError('domain_error(octet_character)', copyResolved(item, env));
+    text += item.name;
+  }
+  return text;
+}
+
+function bytesFromList(term, env, expectedLength = null) {
+  const items = listItems(term, env);
+  const bytes = [];
+  for (const itemTerm of items) {
+    const item = deref(itemTerm, env);
+    if (item.type === VAR) throw new PrologError('instantiation_error');
+    if (item.type !== NUMBER || !/^\d+$/.test(item.name)) {
+      throw new PrologError('type_error(integer)', copyResolved(item, env));
+    }
+    const value = Number(item.name);
+    if (!Number.isInteger(value) || value < 0 || value > 255) {
+      throw new PrologError('type_error(byte)', copyResolved(item, env));
+    }
+    bytes.push(value);
+  }
+  if (expectedLength != null && bytes.length !== expectedLength) {
+    throw new PrologError('domain_error(byte_length)', copyResolved(term, env));
+  }
+  return typeof Buffer === 'undefined' ? Uint8Array.from(bytes) : Buffer.from(bytes);
+}
+
+function byteChars(term, env, expectedLength = null) {
+  const text = characterListText(term, env, { octets: true });
+  const bytes = Buffer.from(Array.from(text, (ch) => ch.codePointAt(0)));
+  if (expectedLength != null && bytes.length !== expectedLength) {
+    throw new PrologError('domain_error(byte_length)', copyResolved(term, env));
+  }
+  return bytes;
+}
+
+function charsTerm(text) {
+  return listFromItems(Array.from(String(text), atom));
+}
+
+function byteCharsTerm(bytes) {
+  return listFromItems(Array.from(bytes, (value) => atom(String.fromCodePoint(value))));
+}
+
+function byteListTerm(bytes) {
+  return listFromItems(Array.from(bytes, (value) => numberTerm(value)));
+}
+
+function optionsList(term, env) {
+  const options = listItems(term, env).map((item) => deref(item, env));
+  if (options.some((option) => option.type === VAR)) throw new PrologError('instantiation_error');
+  return options;
+}
+
+function findOption(options, name) {
+  return options.find((option) => option.type === COMPOUND && option.name === name && option.arity === 1) ?? null;
+}
+
+function atomOption(options, name, env, fallback, allowed, next = null, bindVariableToDefault = false) {
+  const option = findOption(options, name);
+  if (option == null) return fallback;
+  const value = deref(option.args[0], env);
+  if (value.type === VAR) {
+    if (!bindVariableToDefault) throw new PrologError('instantiation_error');
+    if (next != null && !unify(option.args[0], atom(fallback), next)) return null;
+    return fallback;
+  }
+  if (value.type !== ATOM) throw new PrologError('type_error(atom)', copyResolved(value, env));
+  if (allowed != null && !allowed.has(value.name)) {
+    throw new PrologError(`domain_error(${name})`, copyResolved(value, env));
+  }
+  return value.name;
+}
+
+function integerTermValue(term, env) {
+  const value = deref(term, env);
+  if (value.type === VAR) throw new PrologError('instantiation_error');
+  if (value.type !== NUMBER || !/^-?\d+$/.test(value.name)) {
+    throw new PrologError('type_error(integer)', copyResolved(value, env));
+  }
+  return BigInt(value.name);
+}
+
+function smallInteger(term, env, { min = null, max = null } = {}) {
+  const value = integerTermValue(term, env);
+  if (min != null && value < BigInt(min)) throw new PrologError('domain_error(not_less_than_zero)', copyResolved(term, env));
+  if (max != null && value > BigInt(max)) throw new PrologError('representation_error(max_integer)', copyResolved(term, env));
+  const number = Number(value);
+  if (!Number.isSafeInteger(number)) throw new PrologError('representation_error(max_integer)', copyResolved(term, env));
+  return number;
+}
+
+function encodingBytes(term, env, encoding) {
+  if (encoding === 'octet') {
+    const text = characterListText(term, env, { octets: true, allowIntegers: true });
+    return Buffer.from(Array.from(text, (ch) => ch.codePointAt(0)));
+  }
+  const text = characterListText(term, env);
+  return Buffer.from(text, 'utf8');
+}
+
+function flexibleBytes(term, env) {
+  const items = listItems(term, env);
+  if (items.every((itemTerm) => {
+    const item = deref(itemTerm, env);
+    return item.type === NUMBER && /^\d+$/.test(item.name) && Number(item.name) >= 0 && Number(item.name) <= 255;
+  })) return bytesFromList(term, env);
+  return Buffer.from(characterListText(term, env), 'utf8');
+}
+
+function hexText(bytes) {
+  return Array.from(bytes, (value) => Number(value).toString(16).padStart(2, '0')).join('');
+}
+
+function decodeHex(term, env) {
+  const text = characterListText(term, env);
+  if (text.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(text)) {
+    throw new PrologError('domain_error(hex_encoding)', copyResolved(term, env));
+  }
+  const values = [];
+  for (let index = 0; index < text.length; index += 2) values.push(Number.parseInt(text.slice(index, index + 2), 16));
+  return typeof Buffer === 'undefined' ? Uint8Array.from(values) : Buffer.from(values);
+}
+
+function bindResult(target, value, env) {
+  const next = env.clone();
+  return unify(target, value, next) ? next : null;
+}
+
+function* hexBytesBuiltin({ goal, env }) {
+  const hex = deref(goal.args[0], env);
+  if (hex.type !== VAR) {
+    const bytes = decodeHex(goal.args[0], env);
+    const next = bindResult(goal.args[1], byteListTerm(bytes), env);
+    if (next) yield next;
+    return;
+  }
+  const bytes = bytesFromList(goal.args[1], env);
+  const next = bindResult(goal.args[0], charsTerm(hexText(bytes)), env);
+  if (next) yield next;
+}
+
+function* randomBytesBuiltin({ goal, env }) {
+  const length = smallInteger(goal.args[0], env, { min: 0, max: 0x7fffffff });
+  let bytes;
+  if (isNode && nodeCrypto != null) bytes = nodeCrypto.randomBytes(length);
+  else if (globalThis.crypto?.getRandomValues != null) {
+    bytes = new Uint8Array(length);
+    // Web Crypto limits one getRandomValues() request to 65536 bytes.
+    for (let offset = 0; offset < bytes.length; offset += 65536) {
+      globalThis.crypto.getRandomValues(bytes.subarray(offset, Math.min(bytes.length, offset + 65536)));
+    }
+  } else {
+    throw new PrologError('resource_error(crypto)');
+  }
+  const next = bindResult(goal.args[1], byteListTerm(bytes), env);
+  if (next) yield next;
+}
+
+function* dataHashBuiltin({ goal, env }) {
+  const crypto = requireCrypto();
+  const options = optionsList(goal.args[2], env);
+  const next = env.clone();
+  const algorithm = atomOption(options, 'algorithm', env, 'sha256', new Set(HASH_ALGORITHMS.keys()), next, true);
+  if (algorithm == null) return;
+  const encoding = atomOption(options, 'encoding', env, 'utf8', new Set(['utf8', 'octet']));
+  const data = encodingBytes(goal.args[0], env, encoding);
+  const hmac = findOption(options, 'hmac');
+  let digest;
+  if (hmac != null) {
+    if (!HMAC_ALGORITHMS.has(algorithm)) {
+      throw new PrologError('domain_error(hmac_algorithm)', atom(algorithm));
+    }
+    const key = bytesFromList(hmac.args[0], env);
+    digest = crypto.createHmac(HASH_ALGORITHMS.get(algorithm), key).update(data).digest();
+    const hashValue = deref(goal.args[1], env);
+    if (hashValue.type !== VAR) {
+      const expected = decodeHex(goal.args[1], env);
+      if (expected.length !== digest.length || !crypto.timingSafeEqual(expected, digest)) return;
+      yield next;
+      return;
+    }
+  } else {
+    digest = crypto.createHash(HASH_ALGORITHMS.get(algorithm)).update(data).digest();
+  }
+  if (unify(goal.args[1], charsTerm(hexText(digest)), next)) yield next;
+}
+
+function* hkdfBuiltin({ goal, env }) {
+  const crypto = requireCrypto();
+  const options = optionsList(goal.args[3], env);
+  const next = env.clone();
+  const algorithm = atomOption(options, 'algorithm', env, 'sha256', HKDF_ALGORITHMS, next, true);
+  if (algorithm == null) return;
+  const encoding = atomOption(options, 'encoding', env, 'utf8', new Set(['utf8', 'octet']));
+  const length = smallInteger(goal.args[1], env, { min: 0, max: 0x7fffffff });
+  const data = encodingBytes(goal.args[0], env, encoding);
+  const saltOption = findOption(options, 'salt');
+  const salt = saltOption == null ? Buffer.alloc(0) : bytesFromList(saltOption.args[0], env);
+  const infoOption = findOption(options, 'info');
+  const info = infoOption == null ? Buffer.alloc(0) : flexibleBytes(infoOption.args[0], env);
+  let derived;
+  try { derived = Buffer.from(crypto.hkdfSync(HASH_ALGORITHMS.get(algorithm), data, salt, info, length)); }
+  catch { throw new PrologError('resource_error(crypto)'); }
+  if (unify(goal.args[2], byteListTerm(derived), next)) yield next;
+}
+
+function passwordBytes(term, env) {
+  return flexibleBytes(term, env);
+}
+
+function base64NoPadding(bytes) {
+  return Buffer.from(bytes).toString('base64').replace(/=+$/u, '');
+}
+
+function decodeBase64NoPadding(text) {
+  if (!/^[A-Za-z0-9+/]*$/u.test(text)) return null;
+  try { return Buffer.from(text, 'base64'); } catch { return null; }
+}
+
+function passwordHashString(password, salt, iterations, crypto) {
+  const hash = crypto.pbkdf2Sync(password, salt, iterations, 64, 'sha512');
+  return `$pbkdf2-sha512$t=${iterations}$${base64NoPadding(salt)}$${base64NoPadding(hash)}`;
+}
+
+function* passwordHash2Builtin({ goal, env }) {
+  const crypto = requireCrypto();
+  const password = passwordBytes(goal.args[0], env);
+  const hashValue = deref(goal.args[1], env);
+  if (hashValue.type === VAR) {
+    const salt = crypto.randomBytes(16);
+    const output = passwordHashString(password, salt, 2 ** 17, crypto);
+    const next = bindResult(goal.args[1], charsTerm(output), env);
+    if (next) yield next;
+    return;
+  }
+  const encoded = characterListText(goal.args[1], env);
+  const match = /^\$pbkdf2-sha512\$t=(\d+)\$([A-Za-z0-9+/]+)\$([A-Za-z0-9+/]+)$/u.exec(encoded);
+  if (!match) return;
+  const iterations = Number(match[1]);
+  if (!Number.isSafeInteger(iterations) || iterations <= 0) return;
+  const salt = decodeBase64NoPadding(match[2]);
+  const expected = decodeBase64NoPadding(match[3]);
+  if (salt == null || expected == null) return;
+  const actual = crypto.pbkdf2Sync(password, salt, iterations, expected.length, 'sha512');
+  if (actual.length === expected.length && crypto.timingSafeEqual(actual, expected)) yield env;
+}
+
+function* passwordHash3Builtin({ goal, env }) {
+  const crypto = requireCrypto();
+  const password = passwordBytes(goal.args[0], env);
+  const options = optionsList(goal.args[2], env);
+  const algorithmOption = findOption(options, 'algorithm');
+  if (algorithmOption != null) {
+    const algorithm = deref(algorithmOption.args[0], env);
+    if (algorithm.type === VAR) {
+      // Scryer's option/3 call unifies this variable with its only supported algorithm.
+    } else if (algorithm.type !== ATOM || algorithm.name !== 'pbkdf2-sha512') {
+      throw new PrologError('domain_error(password_hash_algorithm)', copyResolved(algorithm, env));
+    }
+  }
+  const costOption = findOption(options, 'cost');
+  const cost = costOption == null ? 17 : smallInteger(costOption.args[0], env, { min: 0, max: 30 });
+  const iterations = 2 ** cost;
+  const saltOption = findOption(options, 'salt');
+  const salt = saltOption == null ? crypto.randomBytes(16) : bytesFromList(saltOption.args[0], env);
+  const output = passwordHashString(password, salt, iterations, crypto);
+  const next = env.clone();
+  if (algorithmOption != null && deref(algorithmOption.args[0], env).type === VAR &&
+      !unify(algorithmOption.args[0], atom('pbkdf2-sha512'), next)) return;
+  if (unify(goal.args[1], charsTerm(output), next)) yield next;
+}
+
+function chachaInputs(goal, env, options, decrypt = false) {
+  const algorithm = deref(goal.args[1], env);
+  if (algorithm.type === VAR) throw new PrologError('instantiation_error');
+  if (algorithm.type !== ATOM) throw new PrologError('type_error(atom)', copyResolved(algorithm, env));
+  if (algorithm.name !== 'chacha20-poly1305') {
+    throw new PrologError('domain_error(chacha20-poly1305)', copyResolved(algorithm, env));
+  }
+  const key = bytesFromList(goal.args[2], env, 32);
+  const iv = bytesFromList(goal.args[3], env, 12);
+  const encoding = atomOption(options, 'encoding', env, 'utf8', new Set(['utf8', 'octet']));
+  const aadOption = findOption(options, 'aad');
+  const aad = aadOption == null ? Buffer.alloc(0) : encodingBytes(aadOption.args[0], env, encoding);
+  const tagOption = findOption(options, 'tag');
+  let tag = null;
+  if (decrypt) {
+    if (tagOption == null) tag = Buffer.alloc(0);
+    else tag = bytesFromList(tagOption.args[0], env);
+    if (tag.length !== 16) throw new PrologError('domain_error(authentication_tag)');
+  } else if (tagOption != null && deref(tagOption.args[0], env).type !== VAR) {
+    bytesFromList(tagOption.args[0], env, 16);
+  }
+  return { key, iv, encoding, aad, tagOption, tag };
+}
+
+function* encryptBuiltin({ goal, env }) {
+  const crypto = requireCrypto();
+  const options = optionsList(goal.args[5], env);
+  const { key, iv, encoding, aad, tagOption } = chachaInputs(goal, env, options, false);
+  const plain = encodingBytes(goal.args[0], env, encoding);
+  let cipher, ciphertext, tag;
+  try {
+    cipher = crypto.createCipheriv('chacha20-poly1305', key, iv, { authTagLength: 16 });
+    if (aad.length) cipher.setAAD(aad, { plaintextLength: plain.length });
+    ciphertext = Buffer.concat([cipher.update(plain), cipher.final()]);
+    tag = cipher.getAuthTag();
+  } catch { throw new PrologError('resource_error(crypto)'); }
+  const next = env.clone();
+  if (tagOption != null && !unify(tagOption.args[0], byteListTerm(tag), next)) return;
+  if (unify(goal.args[4], byteCharsTerm(ciphertext), next)) yield next;
+}
+
+function* decryptBuiltin({ goal, env }) {
+  const crypto = requireCrypto();
+  const options = optionsList(goal.args[5], env);
+  const { key, iv, encoding, aad, tag } = chachaInputs(goal, env, options, true);
+  const ciphertext = byteChars(goal.args[0], env);
+  let plain;
+  try {
+    const decipher = crypto.createDecipheriv('chacha20-poly1305', key, iv, { authTagLength: 16 });
+    if (aad.length) decipher.setAAD(aad, { plaintextLength: ciphertext.length });
+    decipher.setAuthTag(tag);
+    plain = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  } catch { return; }
+  let result;
+  if (encoding === 'octet') result = byteCharsTerm(plain);
+  else {
+    let text;
+    try { text = new TextDecoder('utf-8', { fatal: true }).decode(plain); }
+    catch { throw new PrologError('representation_error(character_code)'); }
+    result = charsTerm(text);
+  }
+  const next = bindResult(goal.args[4], result, env);
+  if (next) yield next;
+}
+
+function ed25519PrivateKey(seed) {
+  const crypto = requireCrypto();
+  return crypto.createPrivateKey({ key: Buffer.concat([ED25519_PRIVATE_PREFIX, seed]), format: 'der', type: 'pkcs8' });
+}
+
+function ed25519PublicFromSeed(seed) {
+  const crypto = requireCrypto();
+  const der = crypto.createPublicKey(ed25519PrivateKey(seed)).export({ format: 'der', type: 'spki' });
+  return Buffer.from(der).subarray(-32);
+}
+
+function ed25519Pair(seed) {
+  const publicKey = ed25519PublicFromSeed(seed);
+  return Buffer.concat([
+    Buffer.from([0x30, 81, 2, 1, 1, 0x30, 5, 6, 3, 43, 101, 112, 4, 34, 4, 32]),
+    seed,
+    Buffer.from([0x81, 33, 0]),
+    publicKey,
+  ]);
+}
+
+function* edSeedPairBuiltin({ goal, env }) {
+  requireCrypto();
+  const seed = bytesFromList(goal.args[0], env, 32);
+  const next = bindResult(goal.args[1], byteCharsTerm(ed25519Pair(seed)), env);
+  if (next) yield next;
+}
+
+function* edNewPairBuiltin({ goal, env }) {
+  const crypto = requireCrypto();
+  const next = bindResult(goal.args[0], byteCharsTerm(ed25519Pair(crypto.randomBytes(32))), env);
+  if (next) yield next;
+}
+
+function* edPublicBuiltin({ goal, env }) {
+  const pair = byteChars(goal.args[0], env);
+  if (pair.length < 32) throw new PrologError('domain_error(ed25519_keypair)', copyResolved(goal.args[0], env));
+  const next = bindResult(goal.args[1], byteCharsTerm(pair.subarray(pair.length - 32)), env);
+  if (next) yield next;
+}
+
+function dataEncodingOption(options, env) {
+  return atomOption(options, 'encoding', env, 'utf8', new Set(['utf8', 'octet']));
+}
+
+function* edSignBuiltin({ goal, env }) {
+  const crypto = requireCrypto();
+  const pair = byteChars(goal.args[0], env);
+  if (pair.length < 48) throw new PrologError('domain_error(ed25519_keypair)', copyResolved(goal.args[0], env));
+  const seed = pair.subarray(16, 48);
+  const options = optionsList(goal.args[3], env);
+  const data = encodingBytes(goal.args[1], env, dataEncodingOption(options, env));
+  let signature;
+  try { signature = crypto.sign(null, data, ed25519PrivateKey(seed)); }
+  catch { throw new PrologError('resource_error(crypto)'); }
+  const next = bindResult(goal.args[2], charsTerm(hexText(signature)), env);
+  if (next) yield next;
+}
+
+function* edVerifyBuiltin({ goal, env }) {
+  const crypto = requireCrypto();
+  const publicKey = byteChars(goal.args[0], env, 32);
+  const options = optionsList(goal.args[3], env);
+  const data = encodingBytes(goal.args[1], env, dataEncodingOption(options, env));
+  const signature = decodeHex(goal.args[2], env);
+  if (signature.length !== 64) return;
+  let ok;
+  try {
+    const key = crypto.createPublicKey({ key: Buffer.concat([ED25519_PUBLIC_PREFIX, publicKey]), format: 'der', type: 'spki' });
+    ok = crypto.verify(null, data, key, signature);
+  } catch { throw new PrologError('resource_error(crypto)'); }
+  if (ok) yield env;
+}
+
+function* curve25519GeneratorBuiltin({ goal, env }) {
+  const bytes = new Uint8Array(32); bytes[0] = 9;
+  const next = bindResult(goal.args[0], byteCharsTerm(bytes), env);
+  if (next) yield next;
+}
+
+function scalar25519Bytes(term, env) {
+  const value = deref(term, env);
+  if (value.type === NUMBER && /^\d+$/.test(value.name)) {
+    let scalar = BigInt(value.name);
+    if (scalar < 0n || scalar >= (1n << 256n)) throw new PrologError('domain_error(curve25519_scalar)', copyResolved(value, env));
+    const bytes = Buffer.alloc(32);
+    for (let index = 0; index < 32; index++) {
+      bytes[index] = Number(scalar & 255n);
+      scalar >>= 8n;
+    }
+    return bytes;
+  }
+  return bytesFromList(term, env, 32);
+}
+
+function* curve25519MultBuiltin({ goal, env }) {
+  const crypto = requireCrypto();
+  const scalar = scalar25519Bytes(goal.args[0], env);
+  const point = byteChars(goal.args[1], env, 32);
+  let result;
+  try {
+    const privateKey = crypto.createPrivateKey({ key: Buffer.concat([X25519_PRIVATE_PREFIX, scalar]), format: 'der', type: 'pkcs8' });
+    const publicKey = crypto.createPublicKey({ key: Buffer.concat([X25519_PUBLIC_PREFIX, point]), format: 'der', type: 'spki' });
+    result = crypto.diffieHellman({ privateKey, publicKey });
+  } catch { return; }
+  const next = bindResult(goal.args[2], byteCharsTerm(result), env);
+  if (next) yield next;
+}
+
+function mod(value, modulus) {
+  const result = value % modulus;
+  return result >= 0n ? result : result + modulus;
+}
+
+function modPow(base, exponent, modulus) {
+  let result = 1n, factor = mod(base, modulus), power = exponent;
+  while (power > 0n) {
+    if (power & 1n) result = mod(result * factor, modulus);
+    factor = mod(factor * factor, modulus);
+    power >>= 1n;
+  }
+  return result;
+}
+
+function modInverse(value, modulus) {
+  const normalized = mod(value, modulus);
+  if (normalized === 0n) throw new Error('inverse of zero');
+  return modPow(normalized, modulus - 2n, modulus);
+}
+
+function secpAdd(left, right) {
+  if (left == null) return right;
+  if (right == null) return left;
+  const [x1, y1] = left, [x2, y2] = right;
+  if (x1 === x2 && mod(y1 + y2, SECP256K1_P) === 0n) return null;
+  let slope;
+  if (x1 === x2 && y1 === y2) {
+    slope = mod((3n * x1 * x1) * modInverse(2n * y1, SECP256K1_P), SECP256K1_P);
+  } else {
+    slope = mod((y2 - y1) * modInverse(x2 - x1, SECP256K1_P), SECP256K1_P);
+  }
+  const x3 = mod(slope * slope - x1 - x2, SECP256K1_P);
+  const y3 = mod(slope * (x1 - x3) - y1, SECP256K1_P);
+  return [x3, y3];
+}
+
+function secpMultiply(scalar, point) {
+  let n = mod(scalar, SECP256K1_N), addend = point, result = null;
+  while (n > 0n) {
+    if (n & 1n) result = secpAdd(result, addend);
+    addend = secpAdd(addend, addend);
+    n >>= 1n;
+  }
+  return result;
+}
+
+function pointTerm(term, env) {
+  const value = deref(term, env);
+  if (value.type !== COMPOUND || value.name !== 'point' || value.arity !== 2) {
+    throw new PrologError('type_error(point)', copyResolved(value, env));
+  }
+  return [integerTermValue(value.args[0], env), integerTermValue(value.args[1], env)];
+}
+
+function secpCurveName(term, env) {
+  const value = deref(term, env);
+  if (value.type !== COMPOUND || value.name !== 'curve' || value.arity !== 8) {
+    throw new PrologError('type_error(curve)', copyResolved(value, env));
+  }
+  const name = deref(value.args[0], env);
+  if (name.type !== ATOM || name.name !== 'secp256k1') {
+    throw new PrologError('domain_error(elliptic_curve)', copyResolved(value, env));
+  }
+}
+
+function* curveScalarMultBuiltin({ goal, env }) {
+  secpCurveName(goal.args[0], env);
+  const scalar = integerTermValue(goal.args[1], env);
+  if (scalar <= 0n) throw new PrologError('domain_error(not_less_than_one)', copyResolved(goal.args[1], env));
+  const point = pointTerm(goal.args[2], env);
+  const [x, y] = point;
+  if (x < 0n || x >= SECP256K1_P || y < 0n || y >= SECP256K1_P ||
+      mod(y * y - (x * x * x + 7n), SECP256K1_P) !== 0n) {
+    throw new PrologError('domain_error(point_on_curve)', copyResolved(goal.args[2], env));
+  }
+  const result = secpMultiply(scalar, point);
+  if (result == null) throw new PrologError('domain_error(point_at_infinity)');
+  const next = bindResult(goal.args[3], compound('point', [numberTerm(result[0]), numberTerm(result[1])]), env);
+  if (next) yield next;
+}
+
+export const cryptoHostBuiltins = {
+  register(registry) {
+    registry.add('eyeprolog__hex_bytes', 2, hexBytesBuiltin, { deterministic: true, eyePrologLibrary: true });
+    registry.add('eyeprolog__crypto_n_random_bytes', 2, randomBytesBuiltin, { deterministic: true, eyePrologLibrary: true });
+    registry.add('eyeprolog__crypto_data_hash', 3, dataHashBuiltin, { deterministic: true, eyePrologLibrary: true });
+    registry.add('eyeprolog__crypto_data_hkdf', 4, hkdfBuiltin, { deterministic: true, eyePrologLibrary: true });
+    registry.add('eyeprolog__crypto_password_hash', 2, passwordHash2Builtin, { deterministic: true, eyePrologLibrary: true });
+    registry.add('eyeprolog__crypto_password_hash', 3, passwordHash3Builtin, { deterministic: true, eyePrologLibrary: true });
+    registry.add('eyeprolog__crypto_data_encrypt', 6, encryptBuiltin, { deterministic: true, eyePrologLibrary: true });
+    registry.add('eyeprolog__crypto_data_decrypt', 6, decryptBuiltin, { deterministic: true, eyePrologLibrary: true });
+    registry.add('eyeprolog__ed25519_seed_keypair', 2, edSeedPairBuiltin, { deterministic: true, eyePrologLibrary: true });
+    registry.add('eyeprolog__ed25519_new_keypair', 1, edNewPairBuiltin, { deterministic: true, eyePrologLibrary: true });
+    registry.add('eyeprolog__ed25519_keypair_public_key', 2, edPublicBuiltin, { deterministic: true, eyePrologLibrary: true });
+    registry.add('eyeprolog__ed25519_sign', 4, edSignBuiltin, { deterministic: true, eyePrologLibrary: true });
+    registry.add('eyeprolog__ed25519_verify', 4, edVerifyBuiltin, { deterministic: true, eyePrologLibrary: true });
+    registry.add('eyeprolog__curve25519_generator', 1, curve25519GeneratorBuiltin, { deterministic: true, eyePrologLibrary: true });
+    registry.add('eyeprolog__curve25519_scalar_mult', 3, curve25519MultBuiltin, { deterministic: true, eyePrologLibrary: true });
+    registry.add('eyeprolog__crypto_curve_scalar_mult', 4, curveScalarMultBuiltin, { deterministic: true, eyePrologLibrary: true });
+  },
+};

package/src/lib/crypto.pl

@@ -0,0 +1,91 @@
+/** Cryptographic predicates compatible with Scryer's library(crypto).
+
+The public predicate and data-format surface follows Scryer Prolog. Sensitive
+primitives are delegated to EyeProlog's private host adapter, which uses Node's
+cryptographic backend. Hex conversion and curve metadata retain the same Prolog
+representations as Scryer.
+*/
+
+:- module(crypto, [
+    hex_bytes/2,
+    crypto_n_random_bytes/2,
+    crypto_data_hash/3,
+    crypto_data_hkdf/4,
+    crypto_password_hash/2,
+    crypto_password_hash/3,
+    crypto_data_encrypt/6,
+    crypto_data_decrypt/6,
+    ed25519_seed_keypair/2,
+    ed25519_new_keypair/1,
+    ed25519_keypair_public_key/2,
+    ed25519_sign/4,
+    ed25519_verify/4,
+    curve25519_generator/1,
+    curve25519_scalar_mult/3,
+    crypto_name_curve/2,
+    crypto_curve_order/2,
+    crypto_curve_generator/2,
+    crypto_curve_scalar_mult/4
+]).
+
+hex_bytes(Hex, Bytes) :-
+    eyeprolog__hex_bytes(Hex, Bytes).
+
+crypto_n_random_bytes(N, Bytes) :-
+    eyeprolog__crypto_n_random_bytes(N, Bytes).
+
+crypto_data_hash(Data, Hash, Options) :-
+    eyeprolog__crypto_data_hash(Data, Hash, Options).
+
+crypto_data_hkdf(Data, Length, Bytes, Options) :-
+    eyeprolog__crypto_data_hkdf(Data, Length, Bytes, Options).
+
+crypto_password_hash(Password, Hash) :-
+    eyeprolog__crypto_password_hash(Password, Hash).
+
+crypto_password_hash(Password, Hash, Options) :-
+    eyeprolog__crypto_password_hash(Password, Hash, Options).
+
+crypto_data_encrypt(PlainText, Algorithm, Key, IV, CipherText, Options) :-
+    eyeprolog__crypto_data_encrypt(PlainText, Algorithm, Key, IV, CipherText, Options).
+
+crypto_data_decrypt(CipherText, Algorithm, Key, IV, PlainText, Options) :-
+    eyeprolog__crypto_data_decrypt(CipherText, Algorithm, Key, IV, PlainText, Options).
+
+ed25519_seed_keypair(Seed, KeyPair) :-
+    eyeprolog__ed25519_seed_keypair(Seed, KeyPair).
+
+ed25519_new_keypair(KeyPair) :-
+    eyeprolog__ed25519_new_keypair(KeyPair).
+
+ed25519_keypair_public_key(KeyPair, PublicKey) :-
+    eyeprolog__ed25519_keypair_public_key(KeyPair, PublicKey).
+
+ed25519_sign(KeyPair, Data, Signature, Options) :-
+    eyeprolog__ed25519_sign(KeyPair, Data, Signature, Options).
+
+ed25519_verify(PublicKey, Data, Signature, Options) :-
+    eyeprolog__ed25519_verify(PublicKey, Data, Signature, Options).
+
+curve25519_generator(Generator) :-
+    eyeprolog__curve25519_generator(Generator).
+
+curve25519_scalar_mult(Scalar, Point, Result) :-
+    eyeprolog__curve25519_scalar_mult(Scalar, Point, Result).
+
+crypto_curve_generator(curve(_,_,_,_,Generator,_,_,_), Generator).
+crypto_curve_order(curve(_,_,_,_,_,Order,_,_), Order).
+
+crypto_curve_scalar_mult(Curve, Scalar, Point, Result) :-
+    eyeprolog__crypto_curve_scalar_mult(Curve, Scalar, Point, Result).
+
+crypto_name_curve(secp256k1,
+                  curve(secp256k1,
+                        0x00fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f,
+                        0x0,
+                        0x7,
+                        point(0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798,
+                              0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8),
+                        0x00fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141,
+                        32,
+                        1)).

package/src/library-autoload-index.js

@@ -92,9 +92,22 @@ export const eyePrologLibraryAutoload = Object.freeze({
   "contains/2": "strings",
   "copy_term_nat/2": "terms",
   "countall/2": "iso_ext",
+  "crypto_curve_generator/2": "crypto",
+  "crypto_curve_order/2": "crypto",
+  "crypto_curve_scalar_mult/4": "crypto",
+  "crypto_data_decrypt/6": "crypto",
+  "crypto_data_encrypt/6": "crypto",
+  "crypto_data_hash/3": "crypto",
+  "crypto_data_hkdf/4": "crypto",
+  "crypto_n_random_bytes/2": "crypto",
+  "crypto_name_curve/2": "crypto",
+  "crypto_password_hash/2": "crypto",
+  "crypto_password_hash/3": "crypto",
   "cumulative/1": "clpz",
   "cumulative/2": "clpz",
   "current_time/1": "time",
+  "curve25519_generator/1": "crypto",
+  "curve25519_scalar_mult/3": "crypto",
   "debug/1": "debug",
   "debug/3": "debug",
   "del_assoc/4": "assoc",
@@ -113,6 +126,11 @@ export const eyePrologLibraryAutoload = Object.freeze({
   "domain_error/2": "error",
   "domain_error/3": "error",
   "drop/3": "lists",
+  "ed25519_keypair_public_key/2": "crypto",
+  "ed25519_new_keypair/1": "crypto",
+  "ed25519_seed_keypair/2": "crypto",
+  "ed25519_sign/4": "crypto",
+  "ed25519_verify/4": "crypto",
   "edges/2": "ugraphs",
   "element/3": "clpz",
   "empty_assoc/1": "assoc",
@@ -148,6 +166,7 @@ export const eyePrologLibraryAutoload = Object.freeze({
   "global_cardinality/3": "clpz",
   "group_pairs_by_key/2": "pairs",
   "gt/2": "comparison",
+  "hex_bytes/2": "crypto",
   "if_/3": "reif",
   "in/2": "clpz",
   "indomain/1": "clpz",
@@ -343,6 +362,7 @@ export const eyePrologLibraryAutoloadModules = Object.freeze([
   "clpb",
   "clpz",
   "comparison",
+  "crypto",
   "dates",
   "dcgs",
   "debug",

package/src/standard-library.js

@@ -7,6 +7,7 @@ import { attsBuiltins } from './atts.js';
 import { expansionBuiltins } from './expansion-builtins.js';
 import { scryerCompatibilityBuiltins } from './scryer-compat.js';
 import { libraryHostBuiltins } from './library-host.js';
+import { cryptoHostBuiltins } from './crypto-host.js';
 import { registerCleanupBuiltins } from './cleanup.js';
 import { fs, isNode, memoryStatistics } from './platform.js';
 import { ATOM, VAR, atom, deref, numberTerm, unify } from './term.js';
@@ -24,6 +25,7 @@ const moduleFiles = Object.freeze({
   clpb: 'clpb.pl',
   clpz: 'clpz.pl',
   comparison: 'comparison.pl',
+  crypto: 'crypto.pl',
   dates: 'dates.pl',
   dcgs: 'dcgs.pl',
   debug: 'debug.pl',
@@ -86,6 +88,11 @@ export const eyePrologNativeLibraryIndicators = Object.freeze([
   'sleep/1',
   'directory_files/2', 'delete_file/1', 'rename_file/2', 'make_directory/1', 'make_directory_path/1', 'working_directory/2',
   'getenv/2', 'setenv/2', 'unsetenv/1', 'shell/1', 'shell/2', 'pid/1', 'raw_argv/1', 'argv/1',
+  'hex_bytes/2', 'crypto_n_random_bytes/2', 'crypto_data_hash/3', 'crypto_data_hkdf/4',
+  'crypto_password_hash/2', 'crypto_password_hash/3', 'crypto_data_encrypt/6', 'crypto_data_decrypt/6',
+  'ed25519_seed_keypair/2', 'ed25519_new_keypair/1', 'ed25519_keypair_public_key/2',
+  'ed25519_sign/4', 'ed25519_verify/4', 'curve25519_generator/1', 'curve25519_scalar_mult/3',
+  'crypto_curve_scalar_mult/4',
   'put_atts/2', 'get_atts/2', 'put_attr/3', 'get_attr/3', 'del_attr/2', 'term_attributed_variables/2', 'call_residue_vars/2',
   '#>/2', '#</2', '#>=/2', '#=</2', '#=/2', '#\\=/2', '#\\/1',
   '#<==>/2', '#==>/2', '#<==/2', '#\\//2', '#\\/2', '#/\\/2',
@@ -111,6 +118,7 @@ export const eyePrologPortableLibraryIndicators = Object.freeze([
   'sat/1', 'taut/2', 'labeling/1', 'sat_count/2', 'random_labeling/2', 'weighted_maximum/3',
   'lt/2', 'gt/2', 'le/2', 'ge/2',
   'difference/3',
+  'crypto_name_curve/2', 'crypto_curve_order/2', 'crypto_curve_generator/2',
   'stable/1', 'becomes/2',
   'seq/3', 'seqq/3',
   'debug/1', 'debug/3', 'nodebug/1', 'bb_get/2', 'bb_put/2', 'bb_b_put/2', 'bb_global_get/2',
@@ -256,6 +264,7 @@ const eyePrologSharedLibraryIndicators = [
   'tfilter/3', 'tmember/2', 'tmember_t/3', 'tpartition/4',
   'start_tabling/2', 'abolish_all_tables/0', 'sleep/1', 'current_time/1', 'format_time/4', 'statistics/2',
   'getenv/2', 'setenv/2', 'unsetenv/1', 'shell/1', 'shell/2', 'pid/1', 'raw_argv/1', 'argv/1',
+  'hex_bytes/2', 'crypto_n_random_bytes/2', 'crypto_data_hash/3',
   'add_edges/3', 'add_vertices/3', 'complement/2', 'compose/3', 'connect_ugraph/3',
   'del_edges/3', 'del_vertices/3', 'edges/2', 'neighbors/3', 'neighbours/3',
   'reachable/3', 'top_sort/2', 'top_sort/3', 'transitive_closure/2',
@@ -337,6 +346,7 @@ export function createEyePrologRegistry() {
   expansionBuiltins.register(registry);
   scryerCompatibilityBuiltins.register(registry);
   libraryHostBuiltins.register(registry);
+  cryptoHostBuiltins.register(registry);
   registry.eyePrologLibrary = true;
   return registry;
 }

package/test/run-regression.mjs

@@ -5747,6 +5747,59 @@ answer(Status,Pid) :-
         assertEqual(fs.existsSync(nested), true, 'make_directory_path/1 created nested directories');
       },
     },
+    {
+      name: 'library(crypto) matches deterministic hash, HMAC, and HKDF vectors',
+      run: () => {
+        const source = `:- use_module(library(crypto)).
+answer(Bytes) :-
+  hex_bytes("501ACE",[80,26,206]),
+  crypto_data_hash("abc","ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad",[algorithm(sha256)]),
+  crypto_data_hash("abc","9c196e32dc0175f86f4b1cb89289d6619de6bee699e4c378e68309ed97a1a6ab",[algorithm(sha256),hmac([107,101,121])]),
+  crypto_data_hkdf("ikm",16,Bytes,[algorithm(sha256),salt([1,2,3]),info("ctx")]).
+`;
+        const result = run(source, { goal: 'answer(Bytes)' });
+        assertEqual(result.stdout,
+          'answer([88, 155, 48, 74, 204, 30, 221, 100, 71, 23, 177, 120, 135, 159, 145, 52]).\n',
+          'crypto vectors');
+      },
+    },
+    {
+      name: 'library(crypto) supports password verification and authenticated ChaCha20-Poly1305 round trips',
+      run: () => {
+        const source = `:- use_module(library(crypto)).
+check :-
+  crypto_password_hash("secret",Hash,[cost(4),salt([0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15])]),
+  crypto_password_hash("secret",Hash),
+  Key=[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31],
+  IV=[0,1,2,3,4,5,6,7,8,9,10,11],
+  crypto_data_encrypt("hello",'chacha20-poly1305',Key,IV,Cipher,[tag(Tag),aad("meta")]),
+  crypto_data_decrypt(Cipher,'chacha20-poly1305',Key,IV,"hello",[tag(Tag),aad("meta")]).
+`;
+        assertEqual(run(source, { goal: 'check' }).stdout, 'check.\n', 'crypto round trip');
+      },
+    },
+    {
+      name: 'library(crypto) supports Ed25519, X25519, and secp256k1 compatibility operations',
+      run: () => {
+        const source = `:- use_module(library(crypto)).
+:- use_module(library(lists), [maplist/3]).
+check :-
+  hex_bytes("9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60",Seed),
+  ed25519_seed_keypair(Seed,Pair), ed25519_keypair_public_key(Pair,Public),
+  maplist(char_code,Public,PublicBytes),
+  hex_bytes("d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a",PublicBytes),
+  ed25519_sign(Pair,[],"e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b",[]),
+  curve25519_generator(G),
+  A=[1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],
+  B=[2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],
+  curve25519_scalar_mult(A,G,AP), curve25519_scalar_mult(B,G,BP),
+  curve25519_scalar_mult(A,BP,Shared), curve25519_scalar_mult(B,AP,Shared),
+  crypto_name_curve(secp256k1,Curve), crypto_curve_generator(Curve,Generator),
+  crypto_curve_scalar_mult(Curve,2,Generator,point(89565891926547004231252920425935692360644145829622209833684329913297188986597,12158399299693830322967808612713398636155367887041628176798871954788371653930)).
+`;
+        assertEqual(run(source, { goal: 'check' }).stdout, 'check.\n', 'elliptic-curve compatibility');
+      },
+    },
     {
       name: 'library(time) and library(iso_ext) expose their shared compatibility re-exports',
       run: () => {
@@ -6354,7 +6407,7 @@ answer(ok) :-
         assertEqual(Boolean(registry.get('is', 2)), true, 'ISO is/2 exists');
         assertEqual(Boolean(registry.get('append', 3)), false, 'append/3 is not ISO core');
         assertEqual(library.eyePrologLibrary, true, 'complete registry marker');
-        assertEqual(library.defs.size, 185, 'EyeProlog registry contains ISO definitions, cleanup controls, observability extensions, WFS tnot/1, and generic library adapters');
+        assertEqual(library.defs.size, 201, 'EyeProlog registry contains ISO definitions, cleanup controls, observability extensions, WFS tnot/1, and generic library adapters');
         assertEqual(registry.get('eyeprolog__dynify', 1), null, 'Eyelet dynify adapter is absent from the ISO registry');
         assertEqual(Boolean(library.get('eyeprolog__dynify', 1)), true, 'Eyelet dynify adapter is an internal EyeProlog library primitive');
         assertEqual(registry.get('eyeprolog__eyelet_emit', 2), null, 'Eyelet event adapter is absent from the ISO registry');
@@ -6377,9 +6430,9 @@ answer(ok) :-
         assertEqual(Boolean(library.get('call_cleanup', 2)), true, 'call_cleanup/2 is an EyeProlog cleanup control');
         assertEqual(registry.get('setup_call_cleanup', 3), null, 'setup_call_cleanup/3 is absent from the ISO registry');
         assertEqual(Boolean(library.get('setup_call_cleanup', 3)), true, 'setup_call_cleanup/3 is an EyeProlog cleanup control');
-        assertEqual(registeredNativeEyePrologLibraryNames().length, 82, 'public host-supported EyeProlog library count');
-        assertEqual(eyePrologPortableLibraryIndicators.length, 243, 'portable Prolog library count');
-        assertEqual(eyePrologInteropLibraryIndicators.length, 214, 'cross-implementation interop profile count');
+        assertEqual(registeredNativeEyePrologLibraryNames().length, 98, 'public host-supported EyeProlog library count');
+        assertEqual(eyePrologPortableLibraryIndicators.length, 246, 'portable Prolog library count');
+        assertEqual(eyePrologInteropLibraryIndicators.length, 217, 'cross-implementation interop profile count');
         assertEqual(eyePrologInteropLibraryModules.length, 25, 'common explicit library module profile count');
         assertEqual(eyePrologInteropAutoload['member/2'], 'lists', 'member/2 canonical autoload');
         assertEqual(eyePrologInteropAutoload['between/3'], 'between', 'between/3 canonical internal autoload');
@@ -6392,11 +6445,11 @@ answer(ok) :-
         assertEqual(eyePrologLibraryAutoload['pairs_keys_values/3'], 'pairs', 'complete library autoload includes library(pairs)');
         assertEqual(eyePrologLibraryAutoload['stable/1'], 'eyelet', 'complete library autoload includes Eyelet stable/1');
         assertEqual(eyePrologLibraryAutoload['becomes/2'], 'eyelet', 'complete library autoload includes Eyelet becomes/2');
-        assertEqual(eyePrologLibraryAutoloadModules.length, 38, 'all bundled src/lib modules are indexed for autoload');
-        assertEqual(eyePrologNativeLibraryIndicators.length, 82, 'host-supported library count');
+        assertEqual(eyePrologLibraryAutoloadModules.length, 39, 'all bundled src/lib modules are indexed for autoload');
+        assertEqual(eyePrologNativeLibraryIndicators.length, 98, 'host-supported library count');
         assertEqual(eyePrologNativeLibraryIndicators.includes('call_nth/2'), true, 'call_nth/2 remains classified as host-supported');
         assertEqual(eyePrologNativeLibraryIndicators.includes('random/1'), true, 'stateful random/1 is classified as host-supported');
-        assertEqual(eyePrologLibraryIndicators.length, 325, 'complete non-ISO EyeProlog library surface');
+        assertEqual(eyePrologLibraryIndicators.length, 344, 'complete non-ISO EyeProlog library surface');
         assertEqual(registry.get('eyeprolog__call_nth', 2), null, 'private call_nth adapter is absent from ISO registry');
         assertEqual(Boolean(library.get('eyeprolog__call_nth', 2)), true, 'private call_nth adapter is registered for EyeProlog');
         assertEqual(Boolean(library.get('eyeprolog__call_residue_vars', 2)), true, 'private call_residue_vars adapter is registered for EyeProlog');

package/the-art-of-eyeprolog.md

@@ -6293,12 +6293,12 @@ so side effects occur in Prolog execution order.
 
 ### The EyeProlog library
 
-EyeProlog exposes **325 distinct non-ISO library and normal-extension predicate
+EyeProlog exposes **344 distinct non-ISO library and normal-extension predicate
 indicators** in addition to the 129 indicators in its isolated ISO profile.
-**243 are defined entirely as ordinary Prolog clauses** in focused modules under
-`src/lib/`; **82 use host support** for control, attributed variables,
+**246 are defined entirely as ordinary Prolog clauses** in focused modules under
+`src/lib/`; **98 use host support** for control, attributed variables,
 constraints, character conversion, filesystem/OS access, timing, or
-observability. The ISO and library catalogs therefore cover **454 distinct predicate indicators**. A normal-runtime predicate that is intentionally
+observability. The ISO and library catalogs therefore cover **473 distinct predicate indicators**. A normal-runtime predicate that is intentionally
 re-exported by a compatibility module is counted once in this library surface:
 for example `call_cleanup/2` and `setup_call_cleanup/3` are exported by
 `library(iso_ext)`, while `time/1` and `statistics/2` are available from
@@ -6309,7 +6309,7 @@ registry.
 The sources are `src/lib/aggregate.pl`, `src/lib/arithmetic.pl`,
 `src/lib/assoc.pl`, `src/lib/atts.pl`, `src/lib/between.pl`,
 `src/lib/charsio.pl`, `src/lib/clpb.pl`, `src/lib/clpz.pl`,
-`src/lib/comparison.pl`, `src/lib/dates.pl`, `src/lib/dcgs.pl`,
+`src/lib/comparison.pl`, `src/lib/crypto.pl`, `src/lib/dates.pl`, `src/lib/dcgs.pl`,
 `src/lib/debug.pl`, `src/lib/dif.pl`, `src/lib/error.pl`,
 `src/lib/eyelet.pl`, `src/lib/files.pl`, `src/lib/format.pl`,
 `src/lib/freeze.pl`, `src/lib/gensym.pl`, `src/lib/iso_ext.pl`,
@@ -6329,7 +6329,9 @@ and `freeze` modules. The published Prologue, `call_nth/2`, and `length/2`
 quads are retained as offline regressions. `src/standard-library.js` registers the module sources and private control and
 constraint adapters for Node and browser resolution. `src/library-host.js`
 contains the small character-I/O, Base64, rational-form, sleep, filesystem, and
-OS bridges used by the corresponding Prolog modules. Explicit `use_module/1-2`
+OS bridges used by the corresponding Prolog modules. `src/crypto-host.js` keeps
+the cryptographic host primitives separate from the public `library(crypto)`
+module. Explicit `use_module/1-2`
 loads remain supported; outside strict ISO mode, the bundled-library autoloader
 may also load the canonical owner of any exported `src/lib/` predicate. The
 autoload index is generated from the libraries' `module/2` declarations.
@@ -6381,6 +6383,7 @@ bindings make one aligned subterm pair sufficient. For example:
 | `library(clpb)` | `labeling/1`, `random_labeling/2`, `sat/1`, `sat_count/2`, `taut/2`, `weighted_maximum/3` | Boolean constraints and BDD reasoning; upstream Prolog source with small state adapters |
 | `library(clpz)` | `#>/2`, `#</2`, `#>=/2`, `#=</2`, `#=/2`, `#\=/2`, `#\/1`, `#<==>/2`, `#==>/2`, `#<==/2`, `#\//2`, `#\/2`, `#/\/2`, `in/2`, `ins/2`, `all_different/1`, `all_distinct/1`, `nvalue/2`, `sum/3`, `scalar_product/4`, `tuples_in/2`, `labeling/2`, `label/1`, `indomain/1`, `lex_chain/1`, `serialized/2`, `global_cardinality/2`, `global_cardinality/3`, `circuit/1`, `cumulative/1`, `cumulative/2`, `disjoint2/1`, `element/3`, `automaton/3`, `automaton/8`, `zcompare/3`, `chain/2`, `fd_var/1`, `fd_inf/2`, `fd_sup/2`, `fd_size/2`, `fd_dom/2`, `clpz_t/2`, `#=/3`, `#</3` | Constraint logic programming over integers; the final three indicators support reified compatibility libraries |
 | `library(comparison)` | `lt/2`, `gt/2`, `le/2`, `ge/2` | Generic comparison |
+| `library(crypto)` | `crypto_curve_generator/2`, `crypto_curve_order/2`, `crypto_curve_scalar_mult/4`, `crypto_data_decrypt/6`, `crypto_data_encrypt/6`, `crypto_data_hash/3`, `crypto_data_hkdf/4`, `crypto_n_random_bytes/2`, `crypto_name_curve/2`, `crypto_password_hash/2`, `crypto_password_hash/3`, `curve25519_generator/1`, `curve25519_scalar_mult/3`, `ed25519_keypair_public_key/2`, `ed25519_new_keypair/1`, `ed25519_seed_keypair/2`, `ed25519_sign/4`, `ed25519_verify/4`, `hex_bytes/2` | Scryer-compatible hashing, KDFs, authenticated encryption, Ed25519, X25519, and secp256k1 helpers |
 | `library(dates)` | `difference/3` | ISO duration differences |
 | `library(dcgs)` | `phrase/2`, `phrase/3`, `seq/3`, `seqq/3` | DCG compatibility; `seq/3` and `seqq/3` are declared as `seq //1` and `seqq //1` |
 | `library(debug)` | `*/1`, `$/1`, `$-/1`, `debug/1`, `debug/3`, `nodebug/1`, `bb_get/2`, `bb_put/2`, `bb_b_put/2`, `bb_global_get/2` | Declarative debug operators and constraint-library blackboards |
@@ -6436,7 +6439,7 @@ predicate indicators also documented by Trealla. Where Trealla exposes a
 predicate globally rather than from the same module, EyeProlog follows Scryer's
 module name so explicit Scryer-style imports remain available. The current
 module set includes `arithmetic`, `assoc`, `atts`, `charsio`, `clpb`, `clpz`,
-`debug`, `dif`, `files`, `format`, `freeze`, `gensym`, `iso_ext`, `lambda`,
+`crypto`, `debug`, `dif`, `files`, `format`, `freeze`, `gensym`, `iso_ext`, `lambda`,
 `lists`, `ordsets`, `os`, `pio`, `random`, `reif`, `tabling`, `time`, `ugraphs`,
 `uuid`, and `when`. The predicate profile is narrower than
 the union of their exports: for example, EyeProlog's explicit-state `random/3`
@@ -6450,7 +6453,9 @@ closure adaptations. `dif.pl`, `tabling.pl`, and part of `time.pl` are thin
 facades over EyeProlog runtime facilities. `charsio.pl` adds the common
 chars/term and Base64 relations, while `pio.pl` provides eager DCG I/O.
 `files.pl` and `os.pl` expose the selected Trealla/Scryer host-service
-intersection through Node adapters. The
+intersection through Node adapters. `crypto.pl` exposes Scryer's complete
+public crypto surface; its strict Trealla/Scryer overlap is `hex_bytes/2`,
+`crypto_n_random_bytes/2`, and `crypto_data_hash/3`. The
 [portable library overlap example](https://github.com/eyereasoner/eyeprolog/blob/main/examples/portable-library-overlap.pl)
 composes Boolean constraints, ordered sets, graphs, reification, delayed goals,
 generated names, character conversion, transposition, and explicit table
@@ -6478,6 +6483,16 @@ its host predicates use atoms instead. Both EyeProlog modules require the Node
 host; browser calls raise a resource error instead of simulating filesystem,
 environment, or process side effects.
 
+`library(crypto)` follows Scryer's character-list and byte-list conventions.
+It provides hexadecimal conversion, cryptographically secure random bytes,
+hashes and HMAC, HKDF, PBKDF2-SHA512 password hashes, ChaCha20-Poly1305,
+Ed25519 signing and verification, X25519 key agreement, and the Scryer
+secp256k1 curve representation/helpers. Hashing, KDF, authenticated encryption, Ed25519, and X25519 use Node's
+cryptographic backend; `crypto_n_random_bytes/2` can also use Web Crypto's
+CSPRNG. Operations without a suitable backend raise `resource_error(crypto)`.
+`hex_bytes/2` and the static curve metadata remain usable without that backend. As in Scryer, new key-agreement code should prefer X25519 over
+the older generic secp256k1 helper.
+
 For `library(lists)`, the current interop predicate set is `member/2`,
 `memberchk/2`, `select/3`, `append/2-3`, `last/2`, `same_length/2`,
 `nth0/3-4`, `nth1/3-4`, `reverse/2`, `length/2`, `maplist/2-8`,

package/why-eyeprolog.md

@@ -166,12 +166,17 @@ interfaces rather than by library names alone. EyeProlog includes the common
 Trealla/Scryer character-term conversion and Base64 predicates, the shared
 arithmetic conversion helpers, `sleep/1`, and selected `iso_ext` re-exports. It
 also provides Scryer-style `library(files)` and `library(os)` modules for
-predicate indicators that Trealla documents too. Their filesystem, environment,
-shell, PID, and argument operations are Node host services and therefore fail
-with a resource error in browser execution rather than inventing a virtual OS.
-EyeProlog still has integer and float processor numbers only, so non-integral
-rational conversion results use a documented structural `rdiv(N,D)` form rather
-than silently extending arithmetic semantics.
+predicate indicators that Trealla documents too, plus the full Scryer
+`library(crypto)` predicate surface. The strict Trealla/Scryer crypto overlap is
+`hex_bytes/2`, `crypto_n_random_bytes/2`, and `crypto_data_hash/3`; EyeProlog
+also supports Scryer's HKDF, password hashing, authenticated encryption,
+Ed25519, X25519, and secp256k1 helpers. Hashing, KDF, authenticated encryption, Ed25519, and X25519 use
+Node's crypto backend; secure random bytes also use Web Crypto when available,
+and operations without a suitable backend report `resource_error(crypto)`. Filesystem, environment, shell, PID, and argument operations are
+likewise Node host services rather than a simulated browser OS. EyeProlog still
+has integer and float processor numbers only, so non-integral rational
+conversion results use a documented structural `rdiv(N,D)` form rather than
+silently extending arithmetic semantics.
 
 Definite clause grammars follow the ISO Part 3 difference-list model. Internal
 fast paths make deep finite sequence processing economical while preserving