toilscript 0.1.16 → 0.1.17

package/dist/importmap.json

@@ -1,7 +1,7 @@
 {
   "imports": {
-    "toilscript": "https://cdn.jsdelivr.net/npm/toilscript@0.1.16/dist/toilscript.js",
-    "toilscript/cli": "https://cdn.jsdelivr.net/npm/toilscript@0.1.16/dist/cli.js",
+    "toilscript": "https://cdn.jsdelivr.net/npm/toilscript@0.1.17/dist/toilscript.js",
+    "toilscript/cli": "https://cdn.jsdelivr.net/npm/toilscript@0.1.17/dist/cli.js",
     "binaryen": "https://cdn.jsdelivr.net/npm/binaryen@129.0.0-nightly.20260428/index.js",
     "long": "https://cdn.jsdelivr.net/npm/long@5.3.2/index.js"
   }

package/dist/web.js

@@ -1,8 +1,8 @@
-var ASSEMBLYSCRIPT_VERSION = "0.1.16";
+var ASSEMBLYSCRIPT_VERSION = "0.1.17";
   var ASSEMBLYSCRIPT_IMPORTMAP = {
   "imports": {
-    "toilscript": "https://cdn.jsdelivr.net/npm/toilscript@0.1.16/dist/toilscript.js",
-    "toilscript/cli": "https://cdn.jsdelivr.net/npm/toilscript@0.1.16/dist/cli.js",
+    "toilscript": "https://cdn.jsdelivr.net/npm/toilscript@0.1.17/dist/toilscript.js",
+    "toilscript/cli": "https://cdn.jsdelivr.net/npm/toilscript@0.1.17/dist/cli.js",
     "binaryen": "https://cdn.jsdelivr.net/npm/binaryen@129.0.0-nightly.20260428/index.js",
     "long": "https://cdn.jsdelivr.net/npm/long@5.3.2/index.js"
   }

package/package.json

@@ -8,7 +8,7 @@
     "toilscript",
     "wasm"
   ],
-  "version": "0.1.16",
+  "version": "0.1.17",
   "author": "Daniel Wirtz <dcode+assemblyscript@dcode.io>",
   "license": "Apache-2.0",
   "homepage": "https://github.com/dacely-cloud/toilscript",

package/std/assembly/bindings/dom.ts

@@ -280,12 +280,5 @@ export declare namespace performance {
   export function now(): f64;
 }
 
-export namespace crypto {
-  export function getRandomValues(array: Uint8Array): void {
-    let values = getRandomValuesN(array.length);
-    array.set(values);
-  }
-  @external("env", "crypto.getRandomValuesN")
-  @external.js("let a = new Uint8Array(n); crypto.getRandomValues(a); return a;")
-  export declare function getRandomValuesN(n: u32): Uint8Array;
-}
+// crypto.getRandomValues moved to the dedicated Web Crypto module
+// (std/assembly/crypto.ts), backed by the `crypto.fill_random` host import.

package/std/assembly/bindings/webcrypto.ts

@@ -0,0 +1,106 @@
+// Host-import declarations for the Web Crypto surface. The production edge
+// (toil-backend `src/wasm/host/import_functions/crypto`) and the toiljs dev
+// server both provide these under the `env` namespace. All byte regions are
+// passed as a (pointer, length) pair into guest linear memory.
+//
+// Variable-length results use a two-step pull: the op returns the result
+// length (>= 0) or a negative error code; the guest then allocates a buffer of
+// that length and calls `take_result` to copy the bytes out.
+//
+// This is the guest half of the ABI contract in `crypto/algorithms.ts`; the
+// byte layout of the packed params buffer is defined there.
+
+export namespace webcrypto {
+  // CSPRNG: fill outPtr..outPtr+len with random bytes.
+  // @ts-ignore: decorator
+  @external("env", "crypto.fill_random")
+  export declare function fillRandom(outPtr: usize, len: i32): void;
+
+  // Write 16 random bytes to outPtr (guest applies RFC 4122 v4 bits + format).
+  // @ts-ignore: decorator
+  @external("env", "crypto.random_uuid")
+  export declare function randomUuid(outPtr: usize): void;
+
+  // Copy the last stashed variable-length result into outPtr (outLen must equal
+  // the length the producing op returned). Returns bytes written.
+  // @ts-ignore: decorator
+  @external("env", "crypto.take_result")
+  export declare function takeResult(outPtr: usize, outLen: i32): i32;
+
+  // digest(alg, data) -> digest length (stashed) or negative error.
+  // @ts-ignore: decorator
+  @external("env", "crypto.digest")
+  export declare function digest(alg: i32, dataPtr: usize, dataLen: i32): i32;
+
+  // importKey -> opaque key handle (>= 0) or negative error.
+  // @ts-ignore: decorator
+  @external("env", "crypto.import_key")
+  export declare function importKey(
+    format: i32,
+    keyPtr: usize,
+    keyLen: i32,
+    paramsPtr: usize,
+    paramsLen: i32,
+    extractable: i32,
+    usages: i32
+  ): i32;
+
+  // exportKey -> exported length (stashed) or negative error.
+  // @ts-ignore: decorator
+  @external("env", "crypto.export_key")
+  export declare function exportKey(format: i32, handle: i32): i32;
+
+  // encrypt / decrypt -> output length (stashed) or negative error.
+  // @ts-ignore: decorator
+  @external("env", "crypto.encrypt")
+  export declare function encrypt(
+    handle: i32,
+    paramsPtr: usize,
+    paramsLen: i32,
+    dataPtr: usize,
+    dataLen: i32
+  ): i32;
+  // @ts-ignore: decorator
+  @external("env", "crypto.decrypt")
+  export declare function decrypt(
+    handle: i32,
+    paramsPtr: usize,
+    paramsLen: i32,
+    dataPtr: usize,
+    dataLen: i32
+  ): i32;
+
+  // sign -> signature length (stashed) or negative error.
+  // @ts-ignore: decorator
+  @external("env", "crypto.sign")
+  export declare function sign(
+    handle: i32,
+    paramsPtr: usize,
+    paramsLen: i32,
+    dataPtr: usize,
+    dataLen: i32
+  ): i32;
+
+  // verify -> 1 (valid), 0 (invalid), or negative error.
+  // @ts-ignore: decorator
+  @external("env", "crypto.verify")
+  export declare function verify(
+    handle: i32,
+    paramsPtr: usize,
+    paramsLen: i32,
+    sigPtr: usize,
+    sigLen: i32,
+    dataPtr: usize,
+    dataLen: i32
+  ): i32;
+
+  // deriveBits -> derived length (stashed) or negative error.
+  // @ts-ignore: decorator
+  @external("env", "crypto.derive_bits")
+  export declare function deriveBits(
+    handle: i32,
+    paramsPtr: usize,
+    paramsLen: i32,
+    lengthBits: i32
+  ): i32;
+}

package/std/assembly/crypto/algorithms.ts

@@ -0,0 +1,316 @@
+// The Web Crypto ABI contract: algorithm / format / curve ids, usage flags,
+// error codes, and the packed-parameter classes. This is the single source of
+// truth that the toil-backend Rust host and the toiljs dev mock mirror.
+//
+// Parameterized algorithms can't ride in plain scalars (AssemblyScript has no
+// object literals across the host boundary), so each `*Params` class serializes
+// itself into one little-endian buffer via `DataWriter` (whose `writeBytes`
+// emits a u32 length prefix + bytes — the blob format the host reads).
+
+import { DataWriter } from "data";
+
+// --- Algorithm ids (also used as the inner-hash id for HMAC/ECDSA/KDF) ------
+export const ALG_SHA_1: i32 = 1;
+export const ALG_SHA_256: i32 = 2;
+export const ALG_SHA_384: i32 = 3;
+export const ALG_SHA_512: i32 = 4;
+export const ALG_SHA3_256: i32 = 5;
+export const ALG_SHA3_384: i32 = 6;
+export const ALG_SHA3_512: i32 = 7;
+export const ALG_AES_GCM: i32 = 10;
+export const ALG_AES_CBC: i32 = 11;
+export const ALG_AES_CTR: i32 = 12;
+export const ALG_AES_KW: i32 = 13;
+export const ALG_HMAC: i32 = 20;
+export const ALG_ECDSA: i32 = 32;
+export const ALG_ED25519: i32 = 33;
+export const ALG_ECDH: i32 = 50;
+export const ALG_X25519: i32 = 51;
+export const ALG_HKDF: i32 = 52;
+export const ALG_PBKDF2: i32 = 53;
+
+// --- Key formats ------------------------------------------------------------
+export const FMT_RAW: i32 = 0;
+export const FMT_PKCS8: i32 = 1;
+export const FMT_SPKI: i32 = 2;
+export const FMT_JWK: i32 = 3; // not supported (throws guest-side)
+
+// --- Named curves -----------------------------------------------------------
+export const CURVE_P256: i32 = 1;
+export const CURVE_P384: i32 = 2;
+export const CURVE_P521: i32 = 3; // not supported
+
+// --- Key-usage bit flags (OR together) --------------------------------------
+export const USAGE_ENCRYPT: i32 = 0x01;
+export const USAGE_DECRYPT: i32 = 0x02;
+export const USAGE_SIGN: i32 = 0x04;
+export const USAGE_VERIFY: i32 = 0x08;
+export const USAGE_DERIVE_KEY: i32 = 0x10;
+export const USAGE_DERIVE_BITS: i32 = 0x20;
+export const USAGE_WRAP_KEY: i32 = 0x40;
+export const USAGE_UNWRAP_KEY: i32 = 0x80;
+
+function asciiUpper(s: string): string {
+  let out = "";
+  for (let i = 0; i < s.length; i++) {
+    let c = s.charCodeAt(i);
+    if (c >= 97 && c <= 122) c -= 32;
+    out += String.fromCharCode(c);
+  }
+  return out;
+}
+
+/// Map a Web Crypto algorithm name (case-insensitive) to its id, or 0.
+export function algId(name: string): i32 {
+  let n = asciiUpper(name);
+  if (n == "SHA-1") return ALG_SHA_1;
+  if (n == "SHA-256") return ALG_SHA_256;
+  if (n == "SHA-384") return ALG_SHA_384;
+  if (n == "SHA-512") return ALG_SHA_512;
+  if (n == "SHA3-256") return ALG_SHA3_256;
+  if (n == "SHA3-384") return ALG_SHA3_384;
+  if (n == "SHA3-512") return ALG_SHA3_512;
+  if (n == "AES-GCM") return ALG_AES_GCM;
+  if (n == "AES-CBC") return ALG_AES_CBC;
+  if (n == "AES-CTR") return ALG_AES_CTR;
+  if (n == "AES-KW") return ALG_AES_KW;
+  if (n == "HMAC") return ALG_HMAC;
+  if (n == "ECDSA") return ALG_ECDSA;
+  if (n == "ED25519") return ALG_ED25519;
+  if (n == "ECDH") return ALG_ECDH;
+  if (n == "X25519") return ALG_X25519;
+  if (n == "HKDF") return ALG_HKDF;
+  if (n == "PBKDF2") return ALG_PBKDF2;
+  return 0;
+}
+
+/// Reverse of {@link algId}, for `CryptoKey.algorithmName`.
+export function algName(id: i32): string {
+  if (id == ALG_SHA_1) return "SHA-1";
+  if (id == ALG_SHA_256) return "SHA-256";
+  if (id == ALG_SHA_384) return "SHA-384";
+  if (id == ALG_SHA_512) return "SHA-512";
+  if (id == ALG_AES_GCM) return "AES-GCM";
+  if (id == ALG_AES_CBC) return "AES-CBC";
+  if (id == ALG_AES_CTR) return "AES-CTR";
+  if (id == ALG_AES_KW) return "AES-KW";
+  if (id == ALG_HMAC) return "HMAC";
+  if (id == ALG_ECDSA) return "ECDSA";
+  if (id == ALG_ED25519) return "Ed25519";
+  if (id == ALG_ECDH) return "ECDH";
+  if (id == ALG_X25519) return "X25519";
+  if (id == ALG_HKDF) return "HKDF";
+  if (id == ALG_PBKDF2) return "PBKDF2";
+  return "unknown";
+}
+
+/// Map a key-format name to its id, or -1.
+export function formatId(name: string): i32 {
+  let n = asciiUpper(name);
+  if (n == "RAW") return FMT_RAW;
+  if (n == "PKCS8") return FMT_PKCS8;
+  if (n == "SPKI") return FMT_SPKI;
+  if (n == "JWK") return FMT_JWK;
+  return -1;
+}
+
+/// Map a named-curve string to its id, or 0.
+export function curveId(name: string): i32 {
+  let n = asciiUpper(name);
+  if (n == "P-256") return CURVE_P256;
+  if (n == "P-384") return CURVE_P384;
+  if (n == "P-521") return CURVE_P521;
+  return 0;
+}
+
+/// Decode a negative host error code into a human-readable message.
+export function cryptoError(code: i32): string {
+  if (code == -1) return "crypto: operation failed";
+  if (code == -2) return "crypto: invalid key handle";
+  if (code == -3) return "crypto: unsupported algorithm";
+  if (code == -4) return "crypto: invalid parameters";
+  if (code == -5) return "crypto: operation failed (bad tag, padding, or key)";
+  if (code == -6) return "crypto: key usage not permitted";
+  if (code == -7) return "crypto: key is not extractable";
+  return "crypto: error " + code.toString();
+}
+
+const EMPTY: Uint8Array = new Uint8Array(0);
+
+// --- Parameter classes ------------------------------------------------------
+
+/// Base for every algorithm-parameter object. Subclasses write a fixed
+/// `(algId, hash)` header followed by their tail.
+export abstract class AlgorithmParams {
+  abstract serialize(w: DataWriter): void;
+  /// Pack into a standalone little-endian buffer for the host.
+  pack(): Uint8Array {
+    let w = new DataWriter();
+    this.serialize(w);
+    return w.toBytes();
+  }
+}
+
+export class AesGcmParams extends AlgorithmParams {
+  iv: Uint8Array;
+  additionalData: Uint8Array;
+  tagLength: i32;
+  constructor(iv: Uint8Array, additionalData: Uint8Array = EMPTY, tagLength: i32 = 128) {
+    super();
+    this.iv = iv;
+    this.additionalData = additionalData;
+    this.tagLength = tagLength;
+  }
+  serialize(w: DataWriter): void {
+    w.writeI32(ALG_AES_GCM);
+    w.writeI32(0);
+    w.writeBytes(this.iv);
+    w.writeI32(this.tagLength);
+    w.writeBytes(this.additionalData);
+  }
+}
+
+export class AesCbcParams extends AlgorithmParams {
+  iv: Uint8Array;
+  constructor(iv: Uint8Array) {
+    super();
+    this.iv = iv;
+  }
+  serialize(w: DataWriter): void {
+    w.writeI32(ALG_AES_CBC);
+    w.writeI32(0);
+    w.writeBytes(this.iv);
+  }
+}
+
+export class AesCtrParams extends AlgorithmParams {
+  counter: Uint8Array;
+  length: i32; // counter length in bits (must be 128)
+  constructor(counter: Uint8Array, length: i32 = 128) {
+    super();
+    this.counter = counter;
+    this.length = length;
+  }
+  serialize(w: DataWriter): void {
+    w.writeI32(ALG_AES_CTR);
+    w.writeI32(0);
+    w.writeBytes(this.counter);
+    w.writeI32(this.length);
+  }
+}
+
+/// HMAC key import: carries the inner hash id.
+export class HmacImportParams extends AlgorithmParams {
+  hash: i32;
+  constructor(hash: i32) {
+    super();
+    this.hash = hash;
+  }
+  serialize(w: DataWriter): void {
+    w.writeI32(ALG_HMAC);
+    w.writeI32(this.hash);
+  }
+}
+
+/// HMAC sign/verify: the hash is taken from the key.
+export class HmacParams extends AlgorithmParams {
+  serialize(w: DataWriter): void {
+    w.writeI32(ALG_HMAC);
+    w.writeI32(0);
+  }
+}
+
+export class Pbkdf2Params extends AlgorithmParams {
+  hash: i32;
+  salt: Uint8Array;
+  iterations: u32;
+  constructor(hash: i32, salt: Uint8Array, iterations: u32) {
+    super();
+    this.hash = hash;
+    this.salt = salt;
+    this.iterations = iterations;
+  }
+  serialize(w: DataWriter): void {
+    w.writeI32(ALG_PBKDF2);
+    w.writeI32(this.hash);
+    w.writeU32(this.iterations);
+    w.writeBytes(this.salt);
+  }
+}
+
+export class HkdfParams extends AlgorithmParams {
+  hash: i32;
+  salt: Uint8Array;
+  info: Uint8Array;
+  constructor(hash: i32, salt: Uint8Array, info: Uint8Array = EMPTY) {
+    super();
+    this.hash = hash;
+    this.salt = salt;
+    this.info = info;
+  }
+  serialize(w: DataWriter): void {
+    w.writeI32(ALG_HKDF);
+    w.writeI32(this.hash);
+    w.writeBytes(this.salt);
+    w.writeBytes(this.info);
+  }
+}
+
+/// ECDSA sign/verify: carries the hash (P-256↔SHA-256, P-384↔SHA-384).
+export class EcdsaParams extends AlgorithmParams {
+  hash: i32;
+  constructor(hash: i32) {
+    super();
+    this.hash = hash;
+  }
+  serialize(w: DataWriter): void {
+    w.writeI32(ALG_ECDSA);
+    w.writeI32(this.hash);
+  }
+}
+
+/// EC key import (ECDSA or ECDH): carries the named curve.
+export class EcKeyImportParams extends AlgorithmParams {
+  alg: i32; // ALG_ECDSA or ALG_ECDH
+  namedCurve: i32;
+  constructor(alg: i32, namedCurve: i32) {
+    super();
+    this.alg = alg;
+    this.namedCurve = namedCurve;
+  }
+  serialize(w: DataWriter): void {
+    w.writeI32(this.alg);
+    w.writeI32(0);
+    w.writeI32(this.namedCurve);
+  }
+}
+
+export class Ed25519Params extends AlgorithmParams {
+  serialize(w: DataWriter): void {
+    w.writeI32(ALG_ED25519);
+    w.writeI32(0);
+  }
+}
+
+export class X25519ImportParams extends AlgorithmParams {
+  serialize(w: DataWriter): void {
+    w.writeI32(ALG_X25519);
+    w.writeI32(0);
+  }
+}
+
+/// ECDH / X25519 deriveBits: carries the peer public key handle.
+export class EcdhParams extends AlgorithmParams {
+  alg: i32; // ALG_ECDH or ALG_X25519
+  publicKeyHandle: i32;
+  constructor(alg: i32, publicKeyHandle: i32) {
+    super();
+    this.alg = alg;
+    this.publicKeyHandle = publicKeyHandle;
+  }
+  serialize(w: DataWriter): void {
+    w.writeI32(this.alg);
+    w.writeI32(0);
+    w.writeI32(this.publicKeyHandle);
+  }
+}

package/std/assembly/crypto/key.ts

@@ -0,0 +1,38 @@
+// Opaque CryptoKey wrapping a per-request host keystore handle. Handles are
+// only valid within the request that created them (the host keystore is reset
+// between requests), so a CryptoKey must not be cached across dispatches.
+
+import { algName } from "crypto/algorithms";
+
+export class CryptoKey {
+  readonly handle: i32;
+  readonly type: string; // "secret" | "public" | "private"
+  readonly extractable: bool;
+  readonly algorithm: i32; // ALG_*
+  readonly usages: i32; // USAGE_* bitmask
+
+  constructor(handle: i32, type: string, extractable: bool, algorithm: i32, usages: i32) {
+    this.handle = handle;
+    this.type = type;
+    this.extractable = extractable;
+    this.algorithm = algorithm;
+    this.usages = usages;
+  }
+
+  algorithmName(): string {
+    return algName(this.algorithm);
+  }
+
+  hasUsage(u: i32): bool {
+    return (this.usages & u) != 0;
+  }
+}
+
+export class CryptoKeyPair {
+  readonly publicKey: CryptoKey;
+  readonly privateKey: CryptoKey;
+  constructor(publicKey: CryptoKey, privateKey: CryptoKey) {
+    this.publicKey = publicKey;
+    this.privateKey = privateKey;
+  }
+}

package/std/assembly/crypto/subtle.ts

@@ -0,0 +1,151 @@
+// Synchronous SubtleCrypto. Mirrors the Web Crypto method names but, because
+// ToilScript has no Promises, every method returns its value directly rather
+// than a Promise. Variable-length results use the two-step pull (op returns
+// the length, then `take_result` copies the bytes out).
+
+import { webcrypto } from "bindings/webcrypto";
+import { CryptoKey } from "crypto/key";
+import {
+  AlgorithmParams,
+  algId,
+  formatId,
+  cryptoError,
+  FMT_JWK,
+  FMT_PKCS8,
+  FMT_SPKI,
+  ALG_AES_GCM,
+  ALG_AES_CBC,
+  ALG_AES_CTR,
+  ALG_AES_KW,
+  ALG_HMAC,
+  ALG_PBKDF2,
+  ALG_HKDF,
+} from "crypto/algorithms";
+
+/// Pull a stashed variable-length result out of the host, or throw on error.
+function drain(len: i32): Uint8Array {
+  if (len < 0) throw new Error(cryptoError(len));
+  let out = new Uint8Array(len);
+  if (len > 0) webcrypto.takeResult(out.dataStart, len);
+  return out;
+}
+
+function isSymmetricAlg(alg: i32): bool {
+  return (
+    alg == ALG_AES_GCM ||
+    alg == ALG_AES_CBC ||
+    alg == ALG_AES_CTR ||
+    alg == ALG_AES_KW ||
+    alg == ALG_HMAC ||
+    alg == ALG_PBKDF2 ||
+    alg == ALG_HKDF
+  );
+}
+
+export class SubtleCrypto {
+  digest(algorithm: string, data: Uint8Array): Uint8Array {
+    let id = algId(algorithm);
+    if (id == 0) throw new Error("Unrecognized algorithm: " + algorithm);
+    return drain(webcrypto.digest(id, data.dataStart, data.byteLength));
+  }
+
+  importKey(
+    format: string,
+    keyData: Uint8Array,
+    algorithm: AlgorithmParams,
+    extractable: bool,
+    usages: i32
+  ): CryptoKey {
+    let fmt = formatId(format);
+    if (fmt < 0) throw new Error("Unknown key format: " + format);
+    if (fmt == FMT_JWK) throw new Error("jwk key format is not supported");
+    let p = algorithm.pack();
+    let alg = load<i32>(p.dataStart); // first packed field is the alg id
+    let handle = webcrypto.importKey(
+      fmt,
+      keyData.dataStart,
+      keyData.byteLength,
+      p.dataStart,
+      p.byteLength,
+      extractable ? 1 : 0,
+      usages
+    );
+    if (handle < 0) throw new Error(cryptoError(handle));
+
+    let type: string;
+    if (fmt == FMT_PKCS8) type = "private";
+    else if (fmt == FMT_SPKI) type = "public";
+    else type = isSymmetricAlg(alg) ? "secret" : "public";
+
+    return new CryptoKey(handle, type, extractable, alg, usages);
+  }
+
+  exportKey(format: string, key: CryptoKey): Uint8Array {
+    let fmt = formatId(format);
+    if (fmt < 0) throw new Error("Unknown key format: " + format);
+    if (fmt == FMT_JWK) throw new Error("jwk key format is not supported");
+    return drain(webcrypto.exportKey(fmt, key.handle));
+  }
+
+  encrypt(algorithm: AlgorithmParams, key: CryptoKey, data: Uint8Array): Uint8Array {
+    let p = algorithm.pack();
+    return drain(
+      webcrypto.encrypt(key.handle, p.dataStart, p.byteLength, data.dataStart, data.byteLength)
+    );
+  }
+
+  decrypt(algorithm: AlgorithmParams, key: CryptoKey, data: Uint8Array): Uint8Array {
+    let p = algorithm.pack();
+    return drain(
+      webcrypto.decrypt(key.handle, p.dataStart, p.byteLength, data.dataStart, data.byteLength)
+    );
+  }
+
+  sign(algorithm: AlgorithmParams, key: CryptoKey, data: Uint8Array): Uint8Array {
+    let p = algorithm.pack();
+    return drain(
+      webcrypto.sign(key.handle, p.dataStart, p.byteLength, data.dataStart, data.byteLength)
+    );
+  }
+
+  verify(
+    algorithm: AlgorithmParams,
+    key: CryptoKey,
+    signature: Uint8Array,
+    data: Uint8Array
+  ): bool {
+    let p = algorithm.pack();
+    let r = webcrypto.verify(
+      key.handle,
+      p.dataStart,
+      p.byteLength,
+      signature.dataStart,
+      signature.byteLength,
+      data.dataStart,
+      data.byteLength
+    );
+    if (r < 0) throw new Error(cryptoError(r));
+    return r == 1;
+  }
+
+  /// Derive `length` bits from `baseKey` (PBKDF2/HKDF/ECDH/X25519).
+  deriveBits(algorithm: AlgorithmParams, baseKey: CryptoKey, length: i32): Uint8Array {
+    let p = algorithm.pack();
+    return drain(webcrypto.deriveBits(baseKey.handle, p.dataStart, p.byteLength, length));
+  }
+
+  /// Composed from deriveBits + importKey. Unlike the web API, the derived bit
+  /// length is passed explicitly (`lengthBits`) since ToilScript can't infer
+  /// it from `derivedKeyAlgorithm` the way the spec does.
+  deriveKey(
+    algorithm: AlgorithmParams,
+    baseKey: CryptoKey,
+    lengthBits: i32,
+    derivedKeyAlgorithm: AlgorithmParams,
+    extractable: bool,
+    usages: i32
+  ): CryptoKey {
+    let bits = this.deriveBits(algorithm, baseKey, lengthBits);
+    return this.importKey("raw", bits, derivedKeyAlgorithm, extractable, usages);
+  }
+}