nervur 0.19.2 → 0.20.0

package/src/contract/index.ts

@@ -0,0 +1,44 @@
+// SPDX-License-Identifier: Apache-2.0
+// The contracts: what the onion cannot unpack from cells, each an abstract
+// class, so a registry can tell at run time which class fulfils which. The
+// class differs by terrain, and the contract does not.
+import type { Draw } from '../quo/index.ts';
+
+// Drawn bytes.
+export abstract class Entropy {
+  abstract draw(length: number): Uint8Array;
+  // The same source, as the function `quo/` takes.
+  get drawer(): Draw {
+    return (length) => this.draw(length);
+  }
+}
+
+// The moment, and a wait that ends.
+export abstract class Clock {
+  abstract now(): number;
+  // Resolves after `ms`, unless cancelled first.
+  abstract wait(ms: number): { done: Promise<void>; cancel(): void };
+}
+
+// One ward's partition, opened by name: the rows the ward writes into
+// directly, told after every write, and kept once at the end of an arrival.
+export interface Rows {
+  readonly rows: Record<string, unknown>;
+  told(row: string): void;
+  kept(): Promise<boolean>;
+}
+
+export abstract class Memory {
+  abstract open(name: string): Promise<Rows>;
+}
+
+// A ward's seed by the harbor's name for it: thirty-two bytes, the same
+// every time that name is asked.
+export abstract class Custody {
+  abstract seed(name: string): Promise<Uint8Array>;
+}
+
+// Bytes to a ward pk in; bytes, or null for nothing, out.
+export abstract class Carrier {
+  abstract carry(pk: string, bytes: Uint8Array): Promise<Uint8Array | null>;
+}

package/src/crypto/aes.ts

@@ -0,0 +1,26 @@
+// SPDX-License-Identifier: Apache-2.0
+// AES-256-GCM with a sixteen-byte tag at the end of the ciphertext.
+import { own, subtle } from './subtle.ts';
+
+export const TAG = 16;
+
+const cipher = (key: Uint8Array, nonce: Uint8Array, additional: Uint8Array) => ({
+  params: { name: 'AES-GCM', iv: own(nonce), additionalData: own(additional), tagLength: TAG * 8 },
+  key: subtle().importKey('raw', own(key), 'AES-GCM', false, ['encrypt', 'decrypt']),
+});
+
+export const encrypt = async (key: Uint8Array, nonce: Uint8Array, additional: Uint8Array, plaintext: Uint8Array): Promise<Uint8Array> => {
+  const c = cipher(key, nonce, additional);
+  return new Uint8Array(await subtle().encrypt(c.params, await c.key, own(plaintext)));
+};
+
+// The plaintext, or null when the ciphertext does not open.
+export const decrypt = async (key: Uint8Array, nonce: Uint8Array, additional: Uint8Array, ciphertext: Uint8Array): Promise<Uint8Array | null> => {
+  if (ciphertext.length < TAG) return null;
+  const c = cipher(key, nonce, additional);
+  try {
+    return new Uint8Array(await subtle().decrypt(c.params, await c.key, own(ciphertext)));
+  } catch {
+    return null;
+  }
+};

package/src/crypto/bytes.ts

@@ -0,0 +1,37 @@
+// SPDX-License-Identifier: Apache-2.0
+// Bytes and the one text spelling Quo gives them: hex, two lowercase digits
+// a byte.
+const DIGITS = Array.from({ length: 256 }, (_, at) => at.toString(16).padStart(2, '0'));
+const HEX = /^(?:[0-9a-f]{2})*$/;
+
+export const hex = (bytes: Uint8Array): string => {
+  let out = '';
+  for (const byte of bytes) out += DIGITS[byte];
+  return out;
+};
+
+// Hex of `length` bytes, or any length when none is named.
+export const isHex = (text: unknown, length?: number): text is string =>
+  typeof text === 'string' && HEX.test(text) && (length === undefined || text.length === length * 2);
+
+export const unhex = (text: string): Uint8Array => {
+  if (!isHex(text)) throw new TypeError('not hex');
+  const out = new Uint8Array(text.length / 2);
+  for (let at = 0; at < out.length; at += 1) out[at] = parseInt(text.slice(at * 2, at * 2 + 2), 16);
+  return out;
+};
+
+export const concat = (...parts: Uint8Array[]): Uint8Array => {
+  const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+  let at = 0;
+  for (const part of parts) {
+    out.set(part, at);
+    at += part.length;
+  }
+  return out;
+};
+
+export const zero = (bytes: Uint8Array): boolean => bytes.every((b) => b === 0);
+
+const encoder = new TextEncoder();
+export const utf8 = (text: string): Uint8Array => encoder.encode(text);

package/src/crypto/ed25519.ts

@@ -0,0 +1,84 @@
+// SPDX-License-Identifier: Apache-2.0
+// Ed25519 signs, as RFC 8032 defines it, and verifies with the cofactorless
+// check. The spec names exactly where a check fails, and Web Crypto promises
+// none of the decoding rules, so they are held here before Web Crypto runs:
+//
+//   a signature of any length but sixty-four
+//   an `s` at or above the group order
+//   an `R` that does not decode, or whose bytes are not its point's encoding
+//   a public key that does not decode, or whose y is at or above the prime
+//   a public key of small order, in any spelling
+import { importSecret, own, publicOf, subtle } from './subtle.ts';
+
+const P = 2n ** 255n - 19n;
+const L = 2n ** 252n + 27742317777372353535851937790883648493n;
+
+const mod = (a: bigint): bigint => ((a % P) + P) % P;
+const power = (base: bigint, exponent: bigint): bigint => {
+  let out = 1n;
+  let b = mod(base);
+  for (let e = exponent; e > 0n; e >>= 1n) {
+    if (e & 1n) out = (out * b) % P;
+    b = (b * b) % P;
+  }
+  return out;
+};
+const D = mod(-121665n * power(121666n, P - 2n));
+const ROOT_MINUS_ONE = power(2n, (P - 1n) / 4n);
+
+const little = (bytes: Uint8Array): bigint => bytes.reduceRight((n, b) => (n << 8n) | BigInt(b), 0n);
+
+type Point = { x: bigint; y: bigint; z: bigint; t: bigint };
+
+// A point from its thirty-two bytes, or null where RFC 8032 section 5.1.3
+// refuses it, the sign bit set on x = 0 included.
+const decode = (bytes: Uint8Array): Point | null => {
+  if (bytes.length !== 32) return null;
+  const sign = (bytes[31]! & 0x80) !== 0;
+  const y = little(bytes) & ((1n << 255n) - 1n);
+  if (y >= P) return null;
+  const u = mod(y * y - 1n);
+  const v = mod(D * y * y + 1n);
+  let x = mod(u * power(v, 3n) * power(u * power(v, 7n), (P - 5n) / 8n));
+  const check = mod(v * x * x);
+  if (check === mod(-u)) x = mod(x * ROOT_MINUS_ONE);
+  else if (check !== u) return null;
+  if (x === 0n && sign) return null;
+  if ((x & 1n) !== (sign ? 1n : 0n)) x = mod(-x);
+  return { x, y, z: 1n, t: mod(x * y) };
+};
+
+const add = (a: Point, b: Point): Point => {
+  const A = mod((a.y - a.x) * (b.y - b.x));
+  const B = mod((a.y + a.x) * (b.y + b.x));
+  const C = mod(2n * D * a.t * b.t);
+  const E = mod(2n * a.z * b.z);
+  const [e, f, g, h] = [B - A, E - C, E + C, B + A];
+  return { x: mod(e * f), y: mod(g * h), z: mod(f * g), t: mod(e * h) };
+};
+
+// Small order: eight times the point is the identity.
+const smallOrder = (p: Point): boolean => {
+  let q = p;
+  for (let i = 0; i < 3; i += 1) q = add(q, q);
+  return q.x === 0n && q.y === q.z;
+};
+
+export const ed25519Public = async (secret: Uint8Array): Promise<Uint8Array> => publicOf(await importSecret('Ed25519', secret, ['sign']));
+
+export const sign = async (secret: Uint8Array, message: Uint8Array): Promise<Uint8Array> =>
+  new Uint8Array(await subtle().sign('Ed25519', await importSecret('Ed25519', secret, ['sign']), own(message)));
+
+export const verify = async (pk: Uint8Array, message: Uint8Array, signature: Uint8Array): Promise<boolean> => {
+  if (signature.length !== 64) return false;
+  const key = decode(pk);
+  if (key === null || smallOrder(key)) return false;
+  if (decode(signature.subarray(0, 32)) === null) return false;
+  if (little(signature.subarray(32)) >= L) return false;
+  try {
+    const imported = await subtle().importKey('raw', own(pk), { name: 'Ed25519' }, false, ['verify']);
+    return await subtle().verify('Ed25519', imported, own(signature), own(message));
+  } catch {
+    return false;
+  }
+};

package/src/crypto/hash.ts

@@ -0,0 +1,14 @@
+// SPDX-License-Identifier: Apache-2.0
+// SHA-256 hashes, and HKDF-SHA-256 derives under the zero-length salt, with
+// the label's ASCII bytes as `info`.
+import { own, subtle } from './subtle.ts';
+
+const SALT = new Uint8Array(0);
+
+export const sha256 = async (bytes: Uint8Array): Promise<Uint8Array> => new Uint8Array(await subtle().digest('SHA-256', own(bytes)));
+
+export const hkdf = async (ikm: Uint8Array, info: Uint8Array, length: number): Promise<Uint8Array> => {
+  const material = await subtle().importKey('raw', own(ikm), 'HKDF', false, ['deriveBits']);
+  const bits = await subtle().deriveBits({ name: 'HKDF', hash: 'SHA-256', salt: SALT, info: own(info) }, material, length * 8);
+  return new Uint8Array(bits);
+};

package/src/crypto/index.ts

@@ -0,0 +1,10 @@
+// SPDX-License-Identifier: Apache-2.0
+// The six algorithms Quo names, and bytes. Arithmetic only: no label, no
+// key of Quo's, no decision.
+export { concat, hex, isHex, unhex, utf8, zero } from './bytes.ts';
+export { hkdf, sha256 } from './hash.ts';
+export { isCount, readObject, readValue, writeValue, type Fields, type Json } from './json.ts';
+export { decrypt, encrypt, TAG } from './aes.ts';
+export { agree, x25519Public } from './x25519.ts';
+export { ed25519Public, sign, verify } from './ed25519.ts';
+export { CIPHERTEXT, decapsulate, EK, encapsulate, lockFrom, type Lock } from './mlkem.ts';

package/src/crypto/json.ts

@@ -0,0 +1,241 @@
+// SPDX-License-Identifier: Apache-2.0
+// JSON text as the spec's values chapter reads it. Two readers, for two
+// jobs:
+//
+//   readObject   Quo's reading of a payload, a reply text or an invitation:
+//                UTF-8 with no byte order mark, one object, no two own keys
+//                of one name, and every field kept as the text it was
+//                written in. What is inside a field is held to the grammar
+//                alone, at any depth, and read no further.
+//
+//   readValue    Nervur's reading of a text it hands to a being: the
+//                grammar, a nesting bound, no two keys of one name at any
+//                depth, no lone surrogate, and no number a double does not
+//                hold as written. Anything else is undefined, since null
+//                is a value.
+//
+// A runtime's own parser keeps the last of two keys, rounds numbers and
+// mends bad bytes, which is where two kits stop agreeing, so neither reader
+// trusts it with more than the escapes of one string.
+export type Json = null | boolean | number | string | Json[] | { [key: string]: Json };
+
+// A field's value exactly as it stood in the text, by its key.
+export type Fields = ReadonlyMap<string, string>;
+
+const decoder = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+const NUMBER = /-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/y;
+const ESCAPE = /\\(?:["\\/bfnrt]|u[0-9a-fA-F]{4})/y;
+const LONE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+const LITERALS = ['true', 'false', 'null'];
+
+const skip = (s: string, at: number): number => {
+  while (at < s.length && ' \t\n\r'.includes(s[at]!)) at += 1;
+  return at;
+};
+
+// The end of the string opening at `at`, or -1.
+const stringEnd = (s: string, at: number): number => {
+  if (s[at] !== '"') return -1;
+  for (at += 1; at < s.length; ) {
+    const c = s.charCodeAt(at);
+    if (c === 0x22) return at + 1;
+    if (c < 0x20) return -1;
+    if (c !== 0x5c) {
+      at += 1;
+      continue;
+    }
+    ESCAPE.lastIndex = at;
+    if (!ESCAPE.test(s)) return -1;
+    at = ESCAPE.lastIndex;
+  }
+  return -1;
+};
+
+const scalarEnd = (s: string, at: number): number => {
+  if (s[at] === '"') return stringEnd(s, at);
+  const literal = LITERALS.find((word) => s.startsWith(word, at));
+  if (literal) return at + literal.length;
+  NUMBER.lastIndex = at;
+  return NUMBER.test(s) ? NUMBER.lastIndex : -1;
+};
+
+// A key, its colon and the space after it: the start of the key's value, or -1.
+const keyEnd = (s: string, at: number): number => {
+  const end = stringEnd(s, at);
+  if (end < 0) return -1;
+  const colon = skip(s, end);
+  return s[colon] === ':' ? skip(s, colon + 1) : -1;
+};
+
+// The end of the value starting at `at`, held to the grammar at any depth
+// without recursion, or -1.
+const valueEnd = (s: string, at: number): number => {
+  const open: string[] = [];
+  for (;;) {
+    const c = s[at];
+    if (c === '{' || c === '[') {
+      at = skip(s, at + 1);
+      if (s[at] === (c === '{' ? '}' : ']')) at += 1;
+      else {
+        open.push(c);
+        if (c === '{' && (at = keyEnd(s, at)) < 0) return -1;
+        continue;
+      }
+    } else if ((at = scalarEnd(s, at)) < 0) return -1;
+    for (;;) {
+      if (open.length === 0) return at;
+      at = skip(s, at);
+      const top = open.at(-1);
+      if (s[at] === ',') {
+        at = skip(s, at + 1);
+        if (top === '{' && (at = keyEnd(s, at)) < 0) return -1;
+        break;
+      }
+      if (s[at] !== (top === '{' ? '}' : ']')) return -1;
+      open.pop();
+      at += 1;
+    }
+  }
+};
+
+const text = (input: Uint8Array | string): string | null => {
+  if (typeof input === 'string') return input;
+  try {
+    return decoder.decode(input);
+  } catch {
+    return null;
+  }
+};
+
+export const readObject = (input: Uint8Array | string): Fields | null => {
+  const s = text(input);
+  if (s === null) return null;
+  const fields = new Map<string, string>();
+  let at = skip(s, 0);
+  if (s[at] !== '{') return null;
+  at = skip(s, at + 1);
+  if (s[at] === '}') return skip(s, at + 1) === s.length ? fields : null;
+  for (;;) {
+    const keyStart = at;
+    const valueStart = keyEnd(s, at);
+    if (valueStart < 0) return null;
+    const key = JSON.parse(s.slice(keyStart, stringEnd(s, keyStart))) as string;
+    if (fields.has(key)) return null;
+    const end = valueEnd(s, valueStart);
+    if (end < 0) return null;
+    fields.set(key, s.slice(valueStart, end));
+    at = skip(s, end);
+    if (s[at] === '}') return skip(s, at + 1) === s.length ? fields : null;
+    if (s[at] !== ',') return null;
+    at = skip(s, at + 1);
+  }
+};
+
+// A number text a double holds as written: a fraction, or a whole number
+// the double it reads as is exactly, never past the largest double, never
+// a value that rounds to zero, never minus zero.
+const exactNumber = (literal: string): boolean => {
+  const [, sign, whole, frac = '', exp = '0'] = /^(-?)(0|[1-9]\d*)(?:\.(\d+))?(?:[eE]([+-]?\d+))?$/.exec(literal)!;
+  const v = Number(literal);
+  if (!Number.isFinite(v)) return false;
+  const digits = (whole! + frac).replace(/^0+/, '');
+  if (v === 0) return digits === '' && sign === '';
+  const trimmed = digits.replace(/0+$/, '');
+  const e = BigInt(exp) - BigInt(frac.length) + BigInt(digits.length - trimmed.length);
+  if (e < 0n) return true;
+  return BigInt(trimmed) * 10n ** e === (v < 0 ? -BigInt(v) : BigInt(v)) || literal === String(v);
+};
+
+const depthOf = (s: string): number => {
+  let depth = 0;
+  let deepest = 0;
+  for (let at = 0; at < s.length; at += 1) {
+    const c = s[at];
+    if (c === '"') at = stringEnd(s, at) - 1;
+    else if (c === '{' || c === '[') deepest = Math.max(deepest, (depth += 1));
+    else if (c === '}' || c === ']') depth -= 1;
+  }
+  return deepest;
+};
+
+// Parses a text already held to the grammar and to the depth bound.
+const parse = (s: string): Json => {
+  let at = 0;
+  const value = (): Json => {
+    at = skip(s, at);
+    const c = s[at];
+    if (c === '{' || c === '[') {
+      const object = c === '{';
+      const out: Json[] | Record<string, Json> = object ? {} : [];
+      at = skip(s, at + 1);
+      if (s[at] === (object ? '}' : ']')) {
+        at += 1;
+        return out;
+      }
+      for (;;) {
+        if (object) {
+          const key = str();
+          if (Object.hasOwn(out, key)) throw new Error('two keys of one name');
+          at = skip(s, at) + 1;
+          Object.defineProperty(out, key, { value: value(), enumerable: true, writable: true, configurable: true });
+        } else (out as Json[]).push(value());
+        at = skip(s, at);
+        if (s[at++] !== ',') return out;
+      }
+    }
+    if (c === '"') return str();
+    const end = scalarEnd(s, at);
+    const literal = s.slice(at, end);
+    at = end;
+    if (LITERALS.includes(literal)) return JSON.parse(literal) as Json;
+    if (!exactNumber(literal)) throw new Error('a number no double holds as written');
+    return Number(literal);
+  };
+  const str = (): string => {
+    at = skip(s, at);
+    const end = stringEnd(s, at);
+    const out = JSON.parse(s.slice(at, end)) as string;
+    if (LONE.test(out)) throw new Error('a lone surrogate');
+    at = end;
+    return out;
+  };
+  return value();
+};
+
+export const readValue = (input: Uint8Array | string, depth: number): Json | undefined => {
+  const s = text(input);
+  if (s === null) return undefined;
+  const start = skip(s, 0);
+  const end = valueEnd(s, start);
+  if (end < 0 || skip(s, end) !== s.length || depthOf(s) > depth) return undefined;
+  try {
+    return parse(s);
+  } catch {
+    return undefined;
+  }
+};
+
+// A value as JSON text, or undefined for one that JSON would drop, rewrite
+// or refuse: anything but null, a boolean, a finite number other than minus
+// zero, well-formed text, a list with no holes, or a plain object of own
+// string keys, nested no deeper than `depth`, with no cycle.
+export const writeValue = (value: unknown, depth: number): string | undefined => {
+  const fits = (v: unknown, room: number, path: Set<object>): boolean => {
+    if (v === null || typeof v === 'boolean') return true;
+    if (typeof v === 'string') return !LONE.test(v);
+    if (typeof v === 'number') return Number.isFinite(v) && !Object.is(v, -0);
+    if (typeof v !== 'object' || room === 0 || path.has(v)) return false;
+    path.add(v);
+    const ok = Array.isArray(v)
+      ? Object.keys(v).length === v.length && v.every((x) => fits(x, room - 1, path))
+      : [Object.prototype, null].includes(Object.getPrototypeOf(v)) &&
+        Object.getOwnPropertySymbols(v).length === 0 &&
+        Object.entries(Object.getOwnPropertyDescriptors(v)).every(([k, d]) => !LONE.test(k) && d.enumerable === true && 'value' in d && fits(d.value, room - 1, path));
+    path.delete(v);
+    return ok;
+  };
+  return fits(value, depth, new Set()) ? JSON.stringify(value) : undefined;
+};
+
+// A count number: no sign, no fraction, no exponent, from 1 to 2^53 - 1.
+export const isCount = (literal: string): boolean => /^[1-9]\d{0,15}$/.test(literal) && Number(literal) <= Number.MAX_SAFE_INTEGER;

package/src/crypto/mlkem.ts

@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: Apache-2.0
+// ML-KEM-768 of FIPS 203 encapsulates. Web Crypto has none on every terrain,
+// so it comes from `@noble/post-quantum`.
+import { ml_kem768 } from '@noble/post-quantum/ml-kem.js';
+
+export const EK = 1184;
+export const CIPHERTEXT = 1088;
+
+export type Lock = { ek: Uint8Array; dk: Uint8Array };
+
+// KeyGen_internal(d, z): the lock from sixty-four drawn bytes, d then z.
+export const lockFrom = (d: Uint8Array, z: Uint8Array): Lock => {
+  const { publicKey, secretKey } = ml_kem768.keygen(Uint8Array.from([...d, ...z]));
+  return { ek: publicKey, dk: secretKey };
+};
+
+// Encaps_internal(ek, m), or null for an encapsulation key the modulus check
+// of FIPS 203 section 7.2 refuses.
+export const encapsulate = (ek: Uint8Array, m: Uint8Array): { ciphertext: Uint8Array; shared: Uint8Array } | null => {
+  if (ek.length !== EK) return null;
+  try {
+    const { cipherText, sharedSecret } = ml_kem768.encapsulate(ek, m);
+    return { ciphertext: cipherText, shared: sharedSecret };
+  } catch {
+    return null;
+  }
+};
+
+// Decapsulation is implicit rejection: a ciphertext for another lock gives a
+// shared secret that opens nothing.
+export const decapsulate = (dk: Uint8Array, ciphertext: Uint8Array): Uint8Array | null => {
+  if (ciphertext.length !== CIPHERTEXT) return null;
+  try {
+    return ml_kem768.decapsulate(ciphertext, dk);
+  } catch {
+    return null;
+  }
+};

package/src/crypto/subtle.ts

@@ -0,0 +1,33 @@
+// SPDX-License-Identifier: Apache-2.0
+// Web Crypto, read at every use. A page on a plain http origin has `crypto`
+// without `subtle`, and a terrain may install it after this module loads.
+export const subtle = (): SubtleCrypto => {
+  const found = globalThis.crypto?.subtle;
+  if (!found) throw new Error('this terrain has no crypto.subtle: a ward needs a secure context');
+  return found;
+};
+
+export type Bytes = Uint8Array<ArrayBuffer>;
+
+// Web Crypto takes a buffer it owns, so every input is copied into one.
+export const own = (bytes: Uint8Array): Bytes => Uint8Array.from(bytes);
+
+// The PKCS#8 wrapping of a thirty-two byte secret, which is the whole of it
+// for both curves.
+const PKCS8 = { Ed25519: '302e020100300506032b657004220420', X25519: '302e020100300506032b656e04220420' } as const;
+
+export const importSecret = (curve: keyof typeof PKCS8, secret: Uint8Array, uses: KeyUsage[]): Promise<CryptoKey> => {
+  if (secret.length !== 32) throw new TypeError('a secret is thirty-two bytes');
+  const prefix = Uint8Array.from(PKCS8[curve].match(/../g)!, (b) => parseInt(b, 16));
+  const wrapped = new Uint8Array(48);
+  wrapped.set(prefix);
+  wrapped.set(secret, 16);
+  return subtle().importKey('pkcs8', wrapped, { name: curve }, true, uses);
+};
+
+// Web Crypto gives a private key's public half only through a JWK.
+export const publicOf = async (key: CryptoKey): Promise<Uint8Array> => {
+  const { x } = await subtle().exportKey('jwk', key);
+  const binary = atob(x!.replaceAll('-', '+').replaceAll('_', '/'));
+  return Uint8Array.from(binary, (c) => c.charCodeAt(0));
+};

package/src/crypto/x25519.ts

@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: Apache-2.0
+// X25519 agrees. A secret is thirty-two bytes, clamped by the function and
+// never before.
+import { zero } from './bytes.ts';
+import { importSecret, own, publicOf, subtle } from './subtle.ts';
+
+export const x25519Public = async (secret: Uint8Array): Promise<Uint8Array> => publicOf(await importSecret('X25519', secret, ['deriveBits']));
+
+// The agreement, or null for a public key that takes no seal: one whose
+// agreement is thirty-two zero bytes, or one the terrain refuses to read.
+export const agree = async (secret: Uint8Array, pk: Uint8Array): Promise<Uint8Array | null> => {
+  if (pk.length !== 32) return null;
+  try {
+    const mine = await importSecret('X25519', secret, ['deriveBits']);
+    const theirs = await subtle().importKey('raw', own(pk), { name: 'X25519' }, false, []);
+    const shared = new Uint8Array(await subtle().deriveBits({ name: 'X25519', public: theirs }, mine, 256));
+    return zero(shared) ? null : shared;
+  } catch {
+    return null;
+  }
+};