typenative 0.1.3 → 0.2.0

package/bin/node/console.js

@@ -0,0 +1,121 @@
+// node:console + the global console's extra methods (count / group / time /
+// assert / trace / dir). console.log / error / warn themselves are lowered in
+// the transpiler (callHandlers); node:console's functions route there.
+import { defineHelper, defineModule } from './registry.js';
+const consoleHelper = `// console: group indentation, counters and timers (Node's output formats)
+var tnConsoleIndent = ""
+var tnConsoleCounts = map[string]int{}
+var tnConsoleTimers = map[string]time.Time{}
+var tnConsoleMu sync.Mutex
+
+func TnConsoleWrite(w *os.File, line string) {
+	tnConsoleMu.Lock()
+	defer tnConsoleMu.Unlock()
+	if tnConsoleIndent != "" {
+		line = tnConsoleIndent + strings.ReplaceAll(line, "\\n", "\\n"+tnConsoleIndent)
+	}
+	fmt.Fprintln(w, line)
+}
+
+func TnConsoleGroup(label ...interface{}) {
+	if len(label) > 0 {
+		TnConsoleWrite(os.Stdout, strings.TrimSuffix(fmt.Sprintln(label...), "\\n"))
+	}
+	tnConsoleMu.Lock()
+	tnConsoleIndent += "  "
+	tnConsoleMu.Unlock()
+}
+
+func TnConsoleGroupEnd() {
+	tnConsoleMu.Lock()
+	if len(tnConsoleIndent) >= 2 {
+		tnConsoleIndent = tnConsoleIndent[2:]
+	}
+	tnConsoleMu.Unlock()
+}
+
+func TnConsoleCount(label ...string) {
+	name := "default"
+	if len(label) > 0 {
+		name = label[0]
+	}
+	tnConsoleMu.Lock()
+	tnConsoleCounts[name]++
+	n := tnConsoleCounts[name]
+	tnConsoleMu.Unlock()
+	TnConsoleWrite(os.Stdout, fmt.Sprintf("%s: %d", name, n))
+}
+
+func TnConsoleCountReset(label ...string) {
+	name := "default"
+	if len(label) > 0 {
+		name = label[0]
+	}
+	tnConsoleMu.Lock()
+	delete(tnConsoleCounts, name)
+	tnConsoleMu.Unlock()
+}
+
+func tnTimerLabel(label []string) string {
+	if len(label) > 0 {
+		return label[0]
+	}
+	return "default"
+}
+
+func TnConsoleTime(label ...string) {
+	tnConsoleMu.Lock()
+	tnConsoleTimers[tnTimerLabel(label)] = time.Now()
+	tnConsoleMu.Unlock()
+}
+
+// Node's duration format: 1.234ms, 1.234s, 1:02.345 (m:ss.mmm)
+func tnFormatDuration(d time.Duration) string {
+	ms := float64(d.Nanoseconds()) / 1e6
+	if ms < 1000 {
+		return fmt.Sprintf("%.3fms", ms)
+	}
+	if ms < 60000 {
+		return fmt.Sprintf("%.3fs", ms/1000)
+	}
+	minutes := int(ms / 60000)
+	return fmt.Sprintf("%d:%06.3f (m:ss.mmm)", minutes, (ms-float64(minutes)*60000)/1000)
+}
+
+func tnConsoleElapsed(label string, end bool) (string, bool) {
+	tnConsoleMu.Lock()
+	defer tnConsoleMu.Unlock()
+	start, ok := tnConsoleTimers[label]
+	if !ok {
+		return "", false
+	}
+	if end {
+		delete(tnConsoleTimers, label)
+	}
+	return label + ": " + tnFormatDuration(time.Since(start)), true
+}
+
+func TnConsoleTimeEnd(label ...string) {
+	name := tnTimerLabel(label)
+	if line, ok := tnConsoleElapsed(name, true); ok {
+		TnConsoleWrite(os.Stdout, line)
+	} else {
+		TnConsoleWrite(os.Stderr, "Warning: No such label '"+name+"' for console.timeEnd()")
+	}
+}
+
+func TnConsoleTimeLog(label string, extra string) {
+	if line, ok := tnConsoleElapsed(label, false); ok {
+		if extra != "" {
+			line += " " + extra
+		}
+		TnConsoleWrite(os.Stdout, line)
+	} else {
+		TnConsoleWrite(os.Stderr, "Warning: No such label '"+label+"' for console.timeLog()")
+	}
+}`;
+export function registerConsole(r) {
+    defineModule(r, 'console');
+    defineHelper(r, 'console', ['fmt', 'os', 'strings', 'sync', 'time'], [], consoleHelper);
+    r.namespaces['console.default'] = 'console';
+}

package/bin/node/core.js

@@ -0,0 +1,111 @@
+// Cross-cutting Node types: NodeJS.ErrnoException is the TnError every
+// thrown Node error is (err.code / err.syscall / err.path / err.errno)
+import { defineClass, defineHelper, defineModule } from './registry.js';
+const invokeHelper = `// Node-style callbacks (cb(err, value)) take any arguments
+type TnCallback = func(...interface{})
+
+// Calls a JS callback of any Go func type with JS arguments: extra arguments
+// are dropped, missing ones are zero values, numbers convert between kinds
+func TnInvoke(fn interface{}, args ...interface{}) interface{} {
+	fv := reflect.ValueOf(fn)
+	if !fv.IsValid() || fv.Kind() != reflect.Func || fv.IsNil() {
+		return nil
+	}
+	ft := fv.Type()
+	in := []reflect.Value{}
+	n := ft.NumIn()
+	for i := 0; i < n; i++ {
+		if ft.IsVariadic() && i == n-1 {
+			elem := ft.In(i).Elem()
+			for j := i; j < len(args); j++ {
+				in = append(in, tnInvokeArg(args[j], elem))
+			}
+			break
+		}
+		var a interface{}
+		if i < len(args) {
+			a = args[i]
+		}
+		in = append(in, tnInvokeArg(a, ft.In(i)))
+	}
+	out := fv.Call(in)
+	if len(out) > 0 {
+		return out[0].Interface()
+	}
+	return nil
+}
+
+func tnInvokeArg(a interface{}, t reflect.Type) reflect.Value {
+	if a == nil {
+		return reflect.Zero(t)
+	}
+	v := reflect.ValueOf(a)
+	if v.Type().AssignableTo(t) {
+		return v
+	}
+	// Nullable primitives (*string / *float64) take a pointer to the value
+	if t.Kind() == reflect.Pointer && v.Type().AssignableTo(t.Elem()) {
+		p := reflect.New(t.Elem())
+		p.Elem().Set(v)
+		return p
+	}
+	// A callback of another func type: adapt the arguments through TnInvoke
+	if t.Kind() == reflect.Func && v.Kind() == reflect.Func {
+		target := a
+		return reflect.MakeFunc(t, func(in []reflect.Value) []reflect.Value {
+			args := make([]interface{}, len(in))
+			for i, arg := range in {
+				if arg.Kind() == reflect.Pointer && arg.IsNil() {
+					args[i] = nil
+				} else if arg.Kind() == reflect.Pointer && arg.Elem().Kind() != reflect.Struct {
+					args[i] = arg.Elem().Interface()
+				} else {
+					args[i] = arg.Interface()
+				}
+			}
+			result := TnInvoke(target, args...)
+			out := []reflect.Value{}
+			for i := 0; i < t.NumOut(); i++ {
+				out = append(out, tnInvokeArg(result, t.Out(i)))
+			}
+			return out
+		})
+	}
+	numeric := func(k reflect.Kind) bool {
+		return (k >= reflect.Int && k <= reflect.Uint64) || k == reflect.Float32 || k == reflect.Float64
+	}
+	if numeric(v.Kind()) && numeric(t.Kind()) {
+		return v.Convert(t)
+	}
+	// Decoded JSON-like values into typed parameters (worker messages …)
+	if converted, ok := TnConvertDynamic(a, t); ok {
+		return converted
+	}
+	return reflect.Zero(t)
+}`;
+export function registerCore(r) {
+    defineHelper(r, 'nodeInvoke', ['reflect'], ['dynamic'], invokeHelper);
+    defineClass(r, 'NodeJS.ErrnoException', '*TnError', 'class', '', 'message=string; code=string', 'name=string; stack=string; cause=interface{}; syscall=string; path=string; errno=float64; hostname=string; address=string; port=float64; actual=interface{}; expected=interface{}; operator=string; generatedMessage=bool', '');
+    r.globals['NodeJS'] = 'NodeJS';
+    // Callback types of Node's typings (TransformCallback …)
+    for (const name of ['stream.TransformCallback', 'fs.NoParamCallback']) {
+        defineClass(r, name, 'TnCallback', 'class', '', '', '', '');
+    }
+    r.classByGoType['TnCallback'] = '';
+}
+// node:constants (deprecated): fs.constants and os.constants.signals merged.
+// Registered after the fs and os modules.
+export function registerConstants(r) {
+    defineModule(r, 'constants');
+    for (const key of Object.keys(r.values)) {
+        let name = '';
+        if (key.startsWith('fs.constants.'))
+            name = key.slice('fs.constants.'.length);
+        if (key.startsWith('os.constants.signals.'))
+            name = key.slice('os.constants.signals.'.length);
+        if (!name)
+            continue;
+        r.values[`constants.${name}`] = r.values[key];
+        r.valueTypes[`constants.${name}`] = r.valueTypes[key];
+    }
+}

package/bin/node/crypto.js

@@ -0,0 +1,414 @@
+// node:crypto (+ the global crypto): hashes / HMAC (md5, sha1, sha2, sha3),
+// random bytes / UUIDs / ints, timingSafeEqual, PBKDF2 / HKDF, AES ciphers
+// (cbc / ctr / gcm). Backed by Go's crypto packages.
+import { defineClass, defineHelper, defineModule, setResults } from './registry.js';
+const cryptoHelper = `// node:crypto
+func tnHashFactory(alg string) func() hash.Hash {
+	switch strings.ToLower(alg) {
+	case "md5":
+		return md5.New
+	case "sha1", "sha-1":
+		return sha1.New
+	case "sha224", "sha-224":
+		return sha256.New224
+	case "sha256", "sha-256":
+		return sha256.New
+	case "sha384", "sha-384":
+		return sha512.New384
+	case "sha512", "sha-512":
+		return sha512.New
+	case "sha512-224":
+		return sha512.New512_224
+	case "sha512-256":
+		return sha512.New512_256
+	case "sha3-224":
+		return func() hash.Hash { return sha3.New224() }
+	case "sha3-256":
+		return func() hash.Hash { return sha3.New256() }
+	case "sha3-384":
+		return func() hash.Hash { return sha3.New384() }
+	case "sha3-512":
+		return func() hash.Hash { return sha3.New512() }
+	}
+	panic(TnNodeError("Error", "ERR_OSSL_EVP_UNSUPPORTED", "Digest method not supported"))
+}
+
+func TnGetHashes() []string {
+	return []string{"md5", "sha1", "sha224", "sha256", "sha3-224", "sha3-256", "sha3-384", "sha3-512", "sha384", "sha512", "sha512-224", "sha512-256"}
+}
+
+// Hash and Hmac objects (createHash / createHmac)
+type TnHash struct {
+	h         hash.Hash
+	alg       string
+	finalized bool
+}
+
+func TnCreateHash(alg string, options ...interface{}) *TnHash {
+	return &TnHash{h: tnHashFactory(alg)(), alg: alg}
+}
+
+func TnCreateHmac(alg string, key interface{}, options ...interface{}) *TnHash {
+	return &TnHash{h: hmac.New(tnHashFactory(alg), tnCryptoBytes(key, "")), alg: alg}
+}
+
+// Bytes of data passed to crypto APIs: strings in an encoding (utf8 by default) or Buffers
+func tnCryptoBytes(v interface{}, enc string) []byte {
+	switch x := v.(type) {
+	case string:
+		return TnBufferFromString(x, enc)
+	case []byte:
+		return x
+	}
+	return TnBufferFrom(v, enc)
+}
+
+func (h *TnHash) update(data interface{}, enc ...string) *TnHash {
+	if h.finalized {
+		panic(TnNodeError("Error", "ERR_CRYPTO_HASH_FINALIZED", "Digest already called"))
+	}
+	e := ""
+	if len(enc) > 0 {
+		e = enc[0]
+	}
+	h.h.Write(tnCryptoBytes(data, e))
+	return h
+}
+
+func (h *TnHash) digestBytes() []byte {
+	if h.finalized {
+		panic(TnNodeError("Error", "ERR_CRYPTO_HASH_FINALIZED", "Digest already called"))
+	}
+	h.finalized = true
+	return h.h.Sum(nil)
+}
+
+func (h *TnHash) digest() []byte { return h.digestBytes() }
+
+func (h *TnHash) digestString(enc string) string { return TnBufferToString(h.digestBytes(), enc) }
+
+// hash.copy(): the state so far, as an independent Hash
+func (h *TnHash) copy() *TnHash {
+	m, ok := h.h.(encoding.BinaryMarshaler)
+	if !ok {
+		panic(TnNodeError("Error", "ERR_CRYPTO_HASH_FINALIZED", "Digest already called"))
+	}
+	state, err := m.MarshalBinary()
+	if err != nil {
+		panic(err)
+	}
+	clone := tnHashFactory(h.alg)()
+	clone.(encoding.BinaryUnmarshaler).UnmarshalBinary(state)
+	return &TnHash{h: clone, alg: h.alg}
+}
+
+// crypto.hash(algorithm, data, outputEncoding = "hex")
+func TnHashOnce(alg string, data interface{}, enc ...string) string {
+	out := "hex"
+	if len(enc) > 0 && enc[0] != "" {
+		out = enc[0]
+	}
+	h := tnHashFactory(alg)()
+	h.Write(tnCryptoBytes(data, ""))
+	return TnBufferToString(h.Sum(nil), out)
+}
+
+func TnRandomBytes(n float64) []byte {
+	b := make([]byte, int(n))
+	if _, err := cryptorand.Read(b); err != nil {
+		panic(err)
+	}
+	return b
+}
+
+func TnRandomUUID() string {
+	b := TnRandomBytes(16)
+	b[6] = (b[6] & 0x0f) | 0x40
+	b[8] = (b[8] & 0x3f) | 0x80
+	h := hex.EncodeToString(b)
+	return h[0:8] + "-" + h[8:12] + "-" + h[12:16] + "-" + h[16:20] + "-" + h[20:32]
+}
+
+// randomInt([min,] max): min <= n < max
+func TnRandomInt(a float64, b ...float64) float64 {
+	min, max := 0.0, a
+	if len(b) > 0 {
+		min, max = a, b[0]
+	}
+	if max <= min {
+		panic(TnNodeError("RangeError", "ERR_OUT_OF_RANGE", "The value of \\"max\\" is out of range. It must be greater than the value of \\"min\\" ("+TnNumStr(min)+"). Received "+TnNumStr(max)))
+	}
+	n, err := cryptorand.Int(cryptorand.Reader, tnbig.NewInt(int64(max-min)))
+	if err != nil {
+		panic(err)
+	}
+	return min + float64(n.Int64())
+}
+
+func TnGetRandomValues(b []byte) []byte {
+	if _, err := cryptorand.Read(b); err != nil {
+		panic(err)
+	}
+	return b
+}
+
+func TnTimingSafeEqual(a []byte, b []byte) bool {
+	if len(a) != len(b) {
+		panic(TnNodeError("RangeError", "ERR_CRYPTO_TIMING_SAFE_EQUAL_LENGTH", "Input buffers must have the same byte length"))
+	}
+	return subtle.ConstantTimeCompare(a, b) == 1
+}
+
+func TnPbkdf2(password interface{}, salt interface{}, iterations float64, keylen float64, digest string) []byte {
+	key, err := pbkdf2.Key(tnHashFactory(digest), string(tnCryptoBytes(password, "")), tnCryptoBytes(salt, ""), int(iterations), int(keylen))
+	if err != nil {
+		panic(TnNodeError("Error", "ERR_CRYPTO_INVALID_KEYLEN", err.Error()))
+	}
+	return key
+}
+
+func TnHkdf(digest string, ikm interface{}, salt interface{}, info interface{}, keylen float64) []byte {
+	key, err := hkdf.Key(tnHashFactory(digest), tnCryptoBytes(ikm, ""), tnCryptoBytes(salt, ""), string(tnCryptoBytes(info, "")), int(keylen))
+	if err != nil {
+		panic(TnNodeError("RangeError", "ERR_CRYPTO_INVALID_KEYLEN", err.Error()))
+	}
+	return key
+}
+
+// Ciphers: aes-{128,192,256}-{cbc,ctr,gcm}; GCM authenticates on final()
+type TnCipher struct {
+	decrypt     bool
+	mode        string
+	block       cipher.Block
+	stream      cipher.Stream
+	cbc         cipher.BlockMode
+	aead        cipher.AEAD
+	iv          []byte
+	pending     []byte
+	aad         []byte
+	authTag     []byte
+	autoPadding bool
+	finalized   bool
+}
+
+func TnGetCiphers() []string {
+	return []string{"aes-128-cbc", "aes-128-ctr", "aes-128-gcm", "aes-192-cbc", "aes-192-ctr", "aes-192-gcm", "aes-256-cbc", "aes-256-ctr", "aes-256-gcm"}
+}
+
+func TnCreateCipher(alg string, key interface{}, iv interface{}, decrypt bool, options ...interface{}) *TnCipher {
+	parts := strings.Split(strings.ToLower(alg), "-")
+	if len(parts) != 3 || parts[0] != "aes" {
+		panic(TnNodeError("Error", "ERR_CRYPTO_UNKNOWN_CIPHER", "Unknown cipher"))
+	}
+	k := tnCryptoBytes(key, "")
+	if strconv.Itoa(len(k)*8) != parts[1] {
+		panic(TnNodeError("RangeError", "ERR_CRYPTO_INVALID_KEYLEN", "Invalid key length"))
+	}
+	block, err := aes.NewCipher(k)
+	if err != nil {
+		panic(TnNodeError("RangeError", "ERR_CRYPTO_INVALID_KEYLEN", "Invalid key length"))
+	}
+	c := &TnCipher{decrypt: decrypt, mode: parts[2], block: block, iv: tnCryptoBytes(iv, ""), autoPadding: true}
+	switch c.mode {
+	case "cbc":
+		if len(c.iv) != aes.BlockSize {
+			panic(TnNodeError("TypeError", "ERR_CRYPTO_INVALID_IV", "Invalid initialization vector"))
+		}
+		if decrypt {
+			c.cbc = cipher.NewCBCDecrypter(block, c.iv)
+		} else {
+			c.cbc = cipher.NewCBCEncrypter(block, c.iv)
+		}
+	case "ctr":
+		if len(c.iv) != aes.BlockSize {
+			panic(TnNodeError("TypeError", "ERR_CRYPTO_INVALID_IV", "Invalid initialization vector"))
+		}
+		c.stream = cipher.NewCTR(block, c.iv)
+	case "gcm":
+		aead, err := cipher.NewGCMWithNonceSize(block, len(c.iv))
+		if err != nil {
+			panic(TnNodeError("TypeError", "ERR_CRYPTO_INVALID_IV", "Invalid initialization vector"))
+		}
+		c.aead = aead
+	default:
+		panic(TnNodeError("Error", "ERR_CRYPTO_UNKNOWN_CIPHER", "Unknown cipher"))
+	}
+	return c
+}
+
+func (c *TnCipher) process(data []byte) []byte {
+	switch c.mode {
+	case "ctr":
+		out := make([]byte, len(data))
+		c.stream.XORKeyStream(out, data)
+		return out
+	case "gcm":
+		c.pending = append(c.pending, data...)
+		return []byte{}
+	}
+	c.pending = append(c.pending, data...)
+	n := len(c.pending) / aes.BlockSize * aes.BlockSize
+	// Decryption keeps the last block back: it carries the padding
+	if c.decrypt && c.autoPadding && n == len(c.pending) && n > 0 {
+		n -= aes.BlockSize
+	}
+	out := make([]byte, n)
+	c.cbc.CryptBlocks(out, c.pending[:n])
+	c.pending = c.pending[n:]
+	return out
+}
+
+func (c *TnCipher) finish() []byte {
+	if c.finalized {
+		panic(TnNodeError("Error", "ERR_CRYPTO_INVALID_STATE", "Unsupported state"))
+	}
+	c.finalized = true
+	switch c.mode {
+	case "ctr":
+		return []byte{}
+	case "gcm":
+		if c.decrypt {
+			out, err := c.aead.Open(nil, c.iv, append(append([]byte{}, c.pending...), c.authTag...), c.aad)
+			if err != nil {
+				panic(TnNodeError("Error", "", "Unsupported state or unable to authenticate data"))
+			}
+			return out
+		}
+		sealed := c.aead.Seal(nil, c.iv, c.pending, c.aad)
+		tagStart := len(sealed) - c.aead.Overhead()
+		c.authTag = sealed[tagStart:]
+		return sealed[:tagStart]
+	}
+	if c.decrypt {
+		if len(c.pending) != aes.BlockSize && c.autoPadding {
+			panic(TnNodeError("Error", "ERR_OSSL_WRONG_FINAL_BLOCK_LENGTH", "wrong final block length"))
+		}
+		if len(c.pending) == 0 {
+			return []byte{}
+		}
+		out := make([]byte, len(c.pending))
+		c.cbc.CryptBlocks(out, c.pending)
+		if !c.autoPadding {
+			return out
+		}
+		pad := int(out[len(out)-1])
+		if pad == 0 || pad > aes.BlockSize {
+			panic(TnNodeError("Error", "ERR_OSSL_BAD_DECRYPT", "bad decrypt"))
+		}
+		return out[:len(out)-pad]
+	}
+	if !c.autoPadding {
+		if len(c.pending)%aes.BlockSize != 0 {
+			panic(TnNodeError("Error", "ERR_OSSL_WRONG_FINAL_BLOCK_LENGTH", "data not multiple of block length"))
+		}
+		out := make([]byte, len(c.pending))
+		c.cbc.CryptBlocks(out, c.pending)
+		return out
+	}
+	pad := aes.BlockSize - len(c.pending)%aes.BlockSize
+	padded := append(append([]byte{}, c.pending...), bytes.Repeat([]byte{byte(pad)}, pad)...)
+	out := make([]byte, len(padded))
+	c.cbc.CryptBlocks(out, padded)
+	return out
+}
+
+func (c *TnCipher) update(data interface{}, inputEncoding ...string) []byte {
+	enc := ""
+	if len(inputEncoding) > 0 {
+		enc = inputEncoding[0]
+	}
+	return c.process(tnCryptoBytes(data, enc))
+}
+
+func (c *TnCipher) updateString(data interface{}, inputEncoding string, outputEncoding string) string {
+	return TnBufferToString(c.process(tnCryptoBytes(data, inputEncoding)), outputEncoding)
+}
+
+func (c *TnCipher) final() []byte { return c.finish() }
+
+func (c *TnCipher) finalString(enc string) string { return TnBufferToString(c.finish(), enc) }
+
+func (c *TnCipher) setAAD(aad []byte, options ...interface{}) *TnCipher {
+	c.aad = aad
+	return c
+}
+
+func (c *TnCipher) setAuthTag(tag []byte) *TnCipher {
+	c.authTag = tag
+	return c
+}
+
+func (c *TnCipher) getAuthTag() []byte { return c.authTag }
+
+func (c *TnCipher) setAutoPadding(pad ...bool) *TnCipher {
+	c.autoPadding = len(pad) == 0 || pad[0]
+	return c
+}`;
+export function registerCrypto(r) {
+    defineModule(r, 'crypto');
+    r.globals['crypto'] = 'crypto';
+    defineHelper(r, 'nodeCrypto', [
+        'bytes',
+        'crypto/aes',
+        'crypto/cipher',
+        'crypto/hkdf',
+        'crypto/hmac',
+        'crypto/md5',
+        'crypto/pbkdf2',
+        'crypto/rand',
+        'crypto/sha1',
+        'crypto/sha256',
+        'crypto/sha3',
+        'crypto/sha512',
+        'crypto/subtle',
+        'encoding',
+        'encoding/hex',
+        'hash',
+        'math/big',
+        'strconv',
+        'strings'
+    ], ['error', 'buffer', 'dynamic'], cryptoHelper);
+    defineClass(r, 'crypto.Hash', '*TnHash', 'class', 'update=*TnHash; copy=*TnHash', '', '', '');
+    r.classes['crypto.Hmac'] = r.classes['crypto.Hash'];
+    defineClass(r, 'crypto.Cipher', '*TnCipher', 'class', 'setAAD=*TnCipher; setAuthTag=*TnCipher; getAuthTag=[]byte; setAutoPadding=*TnCipher', '', '', '');
+    r.classes['crypto.Cipheriv'] = r.classes['crypto.Cipher'];
+    r.classes['crypto.Decipheriv'] = r.classes['crypto.Cipher'];
+    r.classes['crypto.Decipher'] = r.classes['crypto.Cipher'];
+    const use = () => r.helper('nodeCrypto');
+    const fn = (name, result, emit) => {
+        r.functions[`crypto.${name}`] = (call) => {
+            use();
+            return emit(call);
+        };
+        r.results[`crypto.${name}`] = result;
+    };
+    fn('createHash', '*TnHash', (c) => `TnCreateHash(${c.args.join(', ')})`);
+    fn('createHmac', '*TnHash', (c) => `TnCreateHmac(${c.args.join(', ')})`);
+    fn('hash', 'string', (c) => `TnHashOnce(${c.args.join(', ')})`);
+    fn('getHashes', '[]string', (_c) => 'TnGetHashes()');
+    fn('getCiphers', '[]string', (_c) => 'TnGetCiphers()');
+    fn('randomBytes', '[]byte', (c) => `TnRandomBytes(${c.args[0]})`);
+    fn('randomUUID', 'string', (_c) => 'TnRandomUUID()');
+    fn('randomInt', 'float64', (c) => `TnRandomInt(${c.args.join(', ')})`);
+    fn('getRandomValues', '[]byte', (c) => `TnGetRandomValues(${c.args[0]})`);
+    fn('timingSafeEqual', 'bool', (c) => `TnTimingSafeEqual(${c.args[0]}, ${c.args[1]})`);
+    fn('pbkdf2Sync', '[]byte', (c) => `TnPbkdf2(${c.args.join(', ')})`);
+    fn('hkdfSync', '[]byte', (c) => `TnHkdf(${c.args.join(', ')})`);
+    fn('createCipheriv', '*TnCipher', (c) => `TnCreateCipher(${c.args[0]}, ${c.args[1]}, ${c.args[2]}, false)`);
+    fn('createDecipheriv', '*TnCipher', (c) => `TnCreateCipher(${c.args[0]}, ${c.args[1]}, ${c.args[2]}, true)`);
+    r.objects['crypto.webcrypto'] = true;
+    r.namespaces['crypto.webcrypto'] = 'crypto';
+    setResults(r, 'crypto', '');
+    // hash.digest(encoding?) → string with an encoding, Buffer without
+    r.methods['crypto.Hash#digest'] = (c) => (c.args.length > 0 ? `${c.recv}.digestString(${c.args[0]})` : `${c.recv}.digest()`);
+    r.typers['crypto.Hash#digest'] = (c) => (c.nodes.length > 0 ? 'string' : '[]byte');
+    // cipher.update(data, inputEncoding?, outputEncoding?) / final(outputEncoding?)
+    r.methods['crypto.Cipher#update'] = (c) => {
+        if (c.args.length >= 3)
+            return `${c.recv}.updateString(${c.args[0]}, ${c.args[1]}, ${c.args[2]})`;
+        return `${c.recv}.update(${c.args.join(', ')})`;
+    };
+    r.typers['crypto.Cipher#update'] = (c) => (c.nodes.length >= 3 ? 'string' : '[]byte');
+    r.methods['crypto.Cipher#final'] = (c) => (c.args.length > 0 ? `${c.recv}.finalString(${c.args[0]})` : `${c.recv}.final()`);
+    r.typers['crypto.Cipher#final'] = (c) => (c.nodes.length > 0 ? 'string' : '[]byte');
+}