voltaire-effect 0.2.23

package/src/crypto/Keccak256/Keccak256.test.ts

@@ -0,0 +1,265 @@
+import { describe, expect, it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import { hash, KeccakLive, KeccakService, KeccakTest } from "./index.js";
+
+const bytesToHex = (bytes: Uint8Array): string => {
+	return (
+		"0x" +
+		Array.from(bytes)
+			.map((b) => b.toString(16).padStart(2, "0"))
+			.join("")
+	);
+};
+
+describe("KeccakService", () => {
+	describe("KeccakLive", () => {
+		it.effect("hashes data using Voltaire Keccak256", () =>
+			Effect.gen(function* () {
+				const keccak = yield* KeccakService;
+				const result = yield* keccak.hash(new Uint8Array([1, 2, 3]));
+				expect(result).toBeInstanceOf(Uint8Array);
+				expect(result.length).toBe(32);
+			}).pipe(Effect.provide(KeccakLive)),
+		);
+
+		it.effect("produces correct hash for known input", () =>
+			Effect.gen(function* () {
+				const keccak = yield* KeccakService;
+				const result = yield* keccak.hash(new Uint8Array([]));
+				expect(result[0]).toBe(0xc5);
+				expect(result[1]).toBe(0xd2);
+			}).pipe(Effect.provide(KeccakLive)),
+		);
+	});
+
+	describe("Known Vector Tests", () => {
+		it.effect("matches known vector: empty string", () =>
+			Effect.gen(function* () {
+				const keccak = yield* KeccakService;
+				const result = yield* keccak.hash(new Uint8Array(0));
+				expect(bytesToHex(result)).toBe(
+					"0xc5d2460186f7233c927e7db2dcc703c0e500b653ca82273b7bfad8045d85a470",
+				);
+			}).pipe(Effect.provide(KeccakLive)),
+		);
+
+		it.effect('matches known vector: "hello"', () =>
+			Effect.gen(function* () {
+				const keccak = yield* KeccakService;
+				const result = yield* keccak.hash(
+					new Uint8Array([0x68, 0x65, 0x6c, 0x6c, 0x6f]),
+				);
+				expect(bytesToHex(result)).toBe(
+					"0x1c8aff950685c2ed4bc3174f3472287b56d9517b9c948127319a09a7a36deac8",
+				);
+			}).pipe(Effect.provide(KeccakLive)),
+		);
+
+		it.effect('matches known vector: "Hello, World!"', () =>
+			Effect.gen(function* () {
+				const keccak = yield* KeccakService;
+				const input = new TextEncoder().encode("Hello, World!");
+				const result = yield* keccak.hash(input);
+				expect(bytesToHex(result)).toBe(
+					"0xacaf3289d7b601cbd114fb36c4d29c85bbfd5e133f14cb355c3fd8d99367964f",
+				);
+			}).pipe(Effect.provide(KeccakLive)),
+		);
+
+		it.effect("matches known vector: single zero byte", () =>
+			Effect.gen(function* () {
+				const keccak = yield* KeccakService;
+				const result = yield* keccak.hash(new Uint8Array([0x00]));
+				expect(bytesToHex(result)).toBe(
+					"0xbc36789e7a1e281436464229828f817d6612f7b477d66591ff96a9e064bcc98a",
+				);
+			}).pipe(Effect.provide(KeccakLive)),
+		);
+
+		it.effect("matches known vector: 0xff byte", () =>
+			Effect.gen(function* () {
+				const keccak = yield* KeccakService;
+				const result = yield* keccak.hash(new Uint8Array([0xff]));
+				expect(bytesToHex(result)).toBe(
+					"0x8b1a944cf13a9a1c08facb2c9e98623ef3254d2ddb48113885c3e8e97fec8db9",
+				);
+			}).pipe(Effect.provide(KeccakLive)),
+		);
+
+		it.effect(
+			'matches known vector: "The quick brown fox jumps over the lazy dog"',
+			() =>
+				Effect.gen(function* () {
+					const keccak = yield* KeccakService;
+					const input = new TextEncoder().encode(
+						"The quick brown fox jumps over the lazy dog",
+					);
+					const result = yield* keccak.hash(input);
+					expect(bytesToHex(result)).toBe(
+						"0x4d741b6f1eb29cb2a9b9911c82f56fa8d73b04959d3d9d222895df6c0b28aa15",
+					);
+				}).pipe(Effect.provide(KeccakLive)),
+		);
+
+		it.effect("matches known vector: 32 bytes of 0xab", () =>
+			Effect.gen(function* () {
+				const keccak = yield* KeccakService;
+				const result = yield* keccak.hash(new Uint8Array(32).fill(0xab));
+				expect(result).toBeInstanceOf(Uint8Array);
+				expect(result.length).toBe(32);
+			}).pipe(Effect.provide(KeccakLive)),
+		);
+	});
+
+	describe("Input size variations", () => {
+		it.effect("hashes empty input", () =>
+			Effect.gen(function* () {
+				const keccak = yield* KeccakService;
+				const result = yield* keccak.hash(new Uint8Array(0));
+				expect(result.length).toBe(32);
+			}).pipe(Effect.provide(KeccakLive)),
+		);
+
+		it.effect("hashes single byte", () =>
+			Effect.gen(function* () {
+				const keccak = yield* KeccakService;
+				const result = yield* keccak.hash(new Uint8Array([0x42]));
+				expect(result.length).toBe(32);
+			}).pipe(Effect.provide(KeccakLive)),
+		);
+
+		it.effect("hashes 64 bytes (block size)", () =>
+			Effect.gen(function* () {
+				const keccak = yield* KeccakService;
+				const result = yield* keccak.hash(new Uint8Array(64).fill(0x11));
+				expect(result.length).toBe(32);
+			}).pipe(Effect.provide(KeccakLive)),
+		);
+
+		it.effect("hashes 136 bytes (keccak-256 rate)", () =>
+			Effect.gen(function* () {
+				const keccak = yield* KeccakService;
+				const result = yield* keccak.hash(new Uint8Array(136).fill(0x22));
+				expect(result.length).toBe(32);
+			}).pipe(Effect.provide(KeccakLive)),
+		);
+
+		it.effect("hashes 137 bytes (rate + 1)", () =>
+			Effect.gen(function* () {
+				const keccak = yield* KeccakService;
+				const result = yield* keccak.hash(new Uint8Array(137).fill(0x33));
+				expect(result.length).toBe(32);
+			}).pipe(Effect.provide(KeccakLive)),
+		);
+
+		it.effect("hashes 1KB input", () =>
+			Effect.gen(function* () {
+				const keccak = yield* KeccakService;
+				const result = yield* keccak.hash(new Uint8Array(1024).fill(0x44));
+				expect(result.length).toBe(32);
+			}).pipe(Effect.provide(KeccakLive)),
+		);
+
+		it.effect("hashes 64KB input", () =>
+			Effect.gen(function* () {
+				const keccak = yield* KeccakService;
+				const result = yield* keccak.hash(new Uint8Array(65536).fill(0x55));
+				expect(result.length).toBe(32);
+			}).pipe(Effect.provide(KeccakLive)),
+		);
+
+		it.effect("hashes 1MB input", () =>
+			Effect.gen(function* () {
+				const keccak = yield* KeccakService;
+				const result = yield* keccak.hash(
+					new Uint8Array(1024 * 1024).fill(0x66),
+				);
+				expect(result.length).toBe(32);
+			}).pipe(Effect.provide(KeccakLive)),
+		);
+	});
+
+	describe("Determinism", () => {
+		it.effect("produces same hash for same input", () =>
+			Effect.gen(function* () {
+				const input = new Uint8Array([1, 2, 3, 4, 5]);
+				const keccak = yield* KeccakService;
+				const hash1 = yield* keccak.hash(input);
+				const hash2 = yield* keccak.hash(input);
+				expect(bytesToHex(hash1)).toBe(bytesToHex(hash2));
+			}).pipe(Effect.provide(KeccakLive)),
+		);
+
+		it.effect("produces different hash for different input", () =>
+			Effect.gen(function* () {
+				const keccak = yield* KeccakService;
+				const hash1 = yield* keccak.hash(new Uint8Array([1, 2, 3]));
+				const hash2 = yield* keccak.hash(new Uint8Array([1, 2, 4]));
+				expect(bytesToHex(hash1)).not.toBe(bytesToHex(hash2));
+			}).pipe(Effect.provide(KeccakLive)),
+		);
+
+		it.effect("is sensitive to single bit change", () =>
+			Effect.gen(function* () {
+				const keccak = yield* KeccakService;
+				const hash1 = yield* keccak.hash(new Uint8Array([0b00000000]));
+				const hash2 = yield* keccak.hash(new Uint8Array([0b00000001]));
+				expect(bytesToHex(hash1)).not.toBe(bytesToHex(hash2));
+			}).pipe(Effect.provide(KeccakLive)),
+		);
+	});
+
+	describe("KeccakTest", () => {
+		it.effect("returns deterministic zero-filled hash", () =>
+			Effect.gen(function* () {
+				const keccak = yield* KeccakService;
+				const result = yield* keccak.hash(new Uint8Array([1, 2, 3]));
+				expect(result).toBeInstanceOf(Uint8Array);
+				expect(result.length).toBe(32);
+				expect(result.every((b) => b === 0)).toBe(true);
+			}).pipe(Effect.provide(KeccakTest)),
+		);
+
+		it.effect("returns same result for different inputs", () =>
+			Effect.gen(function* () {
+				const keccak = yield* KeccakService;
+				const hash1 = yield* keccak.hash(new Uint8Array([1, 2, 3]));
+				const hash2 = yield* keccak.hash(new Uint8Array([4, 5, 6]));
+				expect(bytesToHex(hash1)).toBe(bytesToHex(hash2));
+			}).pipe(Effect.provide(KeccakTest)),
+		);
+	});
+});
+
+describe("hash", () => {
+	it.effect("hashes data with KeccakService dependency", () =>
+		Effect.gen(function* () {
+			const data = new Uint8Array([104, 101, 108, 108, 111]);
+			const result = yield* hash(data);
+			expect(result).toBeInstanceOf(Uint8Array);
+			expect(result.length).toBe(32);
+		}).pipe(Effect.provide(KeccakLive)),
+	);
+
+	it.effect("works with test layer", () =>
+		Effect.gen(function* () {
+			const data = new Uint8Array([1, 2, 3]);
+			const result = yield* hash(data);
+			expect(result.every((b) => b === 0)).toBe(true);
+		}).pipe(Effect.provide(KeccakTest)),
+	);
+
+	it("matches service result", async () => {
+		const data = new Uint8Array([104, 101, 108, 108, 111]);
+		const [hashResult, serviceResult] = await Promise.all([
+			Effect.runPromise(hash(data).pipe(Effect.provide(KeccakLive))),
+			Effect.runPromise(
+				Effect.gen(function* () {
+					const keccak = yield* KeccakService;
+					return yield* keccak.hash(data);
+				}).pipe(Effect.provide(KeccakLive)),
+			),
+		]);
+		expect(bytesToHex(hashResult)).toBe(bytesToHex(serviceResult));
+	});
+});

package/src/crypto/Keccak256/KeccakService.ts

@@ -0,0 +1,177 @@
+/**
+ * @fileoverview Keccak-256 service definition and layer implementations for Effect.
+ *
+ * @description
+ * Provides the KeccakService Effect Tag and both production (KeccakLive) and
+ * test (KeccakTest) layer implementations. The service pattern enables
+ * dependency injection for testability and flexibility.
+ *
+ * @module Keccak256/KeccakService
+ * @since 0.0.1
+ */
+
+import type { Keccak256Hash } from "@tevm/voltaire";
+import { Keccak256 } from "@tevm/voltaire";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+/**
+ * Shape interface for the Keccak-256 hashing service.
+ *
+ * @description
+ * Defines the contract for Keccak-256 hash implementations.
+ * Used as the service shape for {@link KeccakService}.
+ *
+ * @since 0.0.1
+ */
+export interface KeccakServiceShape {
+	/**
+	 * Computes the Keccak-256 hash of input data.
+	 *
+	 * @param {Uint8Array} data - The input bytes to hash (any length)
+	 * @returns {Effect.Effect<Keccak256Hash>} Effect containing the 32-byte hash
+	 */
+	readonly hash: (data: Uint8Array) => Effect.Effect<Keccak256Hash>;
+}
+
+/**
+ * Keccak-256 hashing service for Effect-based applications.
+ *
+ * @description
+ * An Effect Context.Tag that provides the standard Ethereum hashing algorithm
+ * used for addresses, signatures, state roots, and more. The service pattern
+ * enables swapping implementations for testing or alternative backends.
+ *
+ * The service exposes a single `hash` method that takes arbitrary bytes and
+ * produces a 32-byte Keccak-256 hash.
+ *
+ * @example Basic usage with Effect.gen
+ * ```typescript
+ * import { KeccakService, KeccakLive } from 'voltaire-effect/crypto/Keccak256'
+ * import * as Effect from 'effect/Effect'
+ *
+ * const program = Effect.gen(function* () {
+ *   const keccak = yield* KeccakService
+ *   return yield* keccak.hash(new Uint8Array([1, 2, 3]))
+ * }).pipe(Effect.provide(KeccakLive))
+ *
+ * const hash = await Effect.runPromise(program)
+ * ```
+ *
+ * @example Chaining multiple hashes
+ * ```typescript
+ * import { KeccakService, KeccakLive } from 'voltaire-effect/crypto/Keccak256'
+ * import * as Effect from 'effect/Effect'
+ *
+ * const doubleHash = Effect.gen(function* () {
+ *   const keccak = yield* KeccakService
+ *   const first = yield* keccak.hash(new Uint8Array([1, 2, 3]))
+ *   return yield* keccak.hash(first)
+ * }).pipe(Effect.provide(KeccakLive))
+ * ```
+ *
+ * @example Composing with other services
+ * ```typescript
+ * import { KeccakService, KeccakLive } from 'voltaire-effect/crypto/Keccak256'
+ * import { Secp256k1Service, Secp256k1Live } from 'voltaire-effect/crypto/Secp256k1'
+ * import * as Effect from 'effect/Effect'
+ * import * as Layer from 'effect/Layer'
+ *
+ * const program = Effect.gen(function* () {
+ *   const keccak = yield* KeccakService
+ *   const secp = yield* Secp256k1Service
+ *   const msgHash = yield* keccak.hash(message)
+ *   return yield* secp.sign(msgHash, privateKey)
+ * }).pipe(Effect.provide(Layer.merge(KeccakLive, Secp256k1Live)))
+ * ```
+ *
+ * @see {@link KeccakLive} - Production implementation
+ * @see {@link KeccakTest} - Test implementation
+ * @see {@link hash} - Standalone hash function
+ * @since 0.0.1
+ */
+export class KeccakService extends Context.Tag("KeccakService")<
+	KeccakService,
+	KeccakServiceShape
+>() {}
+
+/**
+ * Production layer for KeccakService using native Keccak-256 implementation.
+ *
+ * @description
+ * Provides the real Keccak-256 hash implementation from the voltaire library.
+ * Use this layer in production applications for cryptographically secure hashing.
+ *
+ * The underlying implementation uses optimized native code (Zig/Rust) for
+ * high-performance hashing.
+ *
+ * @example Providing the live layer
+ * ```typescript
+ * import { KeccakService, KeccakLive } from 'voltaire-effect/crypto/Keccak256'
+ * import * as Effect from 'effect/Effect'
+ *
+ * const program = Effect.gen(function* () {
+ *   const keccak = yield* KeccakService
+ *   return yield* keccak.hash(new Uint8Array([0xde, 0xad, 0xbe, 0xef]))
+ * })
+ *
+ * const result = await Effect.runPromise(program.pipe(Effect.provide(KeccakLive)))
+ * ```
+ *
+ * @example Merging with other layers
+ * ```typescript
+ * import { KeccakLive } from 'voltaire-effect/crypto/Keccak256'
+ * import { SHA256Live } from 'voltaire-effect/crypto/SHA256'
+ * import * as Layer from 'effect/Layer'
+ *
+ * const CryptoLive = Layer.merge(KeccakLive, SHA256Live)
+ * ```
+ *
+ * @see {@link KeccakService} - The service tag
+ * @see {@link KeccakTest} - Test implementation for unit tests
+ * @since 0.0.1
+ */
+export const KeccakLive = Layer.succeed(KeccakService, {
+	hash: (data) => Effect.sync(() => Keccak256.hash(data)),
+});
+
+/**
+ * Test layer for KeccakService returning deterministic zero-filled hashes.
+ *
+ * @description
+ * Provides a mock Keccak-256 implementation that always returns a 32-byte
+ * array filled with zeros. Use for unit testing without cryptographic overhead
+ * when the actual hash value doesn't matter for the test.
+ *
+ * This layer is useful for:
+ * - Unit tests that need deterministic output
+ * - Performance tests that want to isolate non-crypto logic
+ * - Tests where the hash value is not validated
+ *
+ * @example Using in tests
+ * ```typescript
+ * import { KeccakService, KeccakTest } from 'voltaire-effect/crypto/Keccak256'
+ * import * as Effect from 'effect/Effect'
+ * import { describe, it, expect } from 'vitest'
+ *
+ * describe('MyService', () => {
+ *   it('should hash data', async () => {
+ *     const program = Effect.gen(function* () {
+ *       const keccak = yield* KeccakService
+ *       return yield* keccak.hash(new Uint8Array([1, 2, 3]))
+ *     })
+ *
+ *     const result = await Effect.runPromise(program.pipe(Effect.provide(KeccakTest)))
+ *     expect(result).toEqual(new Uint8Array(32)) // All zeros
+ *   })
+ * })
+ * ```
+ *
+ * @see {@link KeccakService} - The service tag
+ * @see {@link KeccakLive} - Production implementation
+ * @since 0.0.1
+ */
+export const KeccakTest = Layer.succeed(KeccakService, {
+	hash: (_data) => Effect.sync(() => new Uint8Array(32) as Keccak256Hash),
+});

package/src/crypto/Keccak256/hash.ts

@@ -0,0 +1,76 @@
+/**
+ * @fileoverview Keccak-256 hash function for Effect-based applications.
+ * Provides a functional Effect wrapper around the Keccak-256 cryptographic hash.
+ *
+ * @module Keccak256/hash
+ * @since 0.0.1
+ */
+
+import type { Keccak256Hash } from "@tevm/voltaire";
+import * as Effect from "effect/Effect";
+import { KeccakService } from "./KeccakService.js";
+
+/**
+ * Computes the Keccak-256 hash of the provided data.
+ *
+ * @description
+ * This is the primary hash function used in Ethereum for addresses, transactions,
+ * and state roots. Keccak-256 produces a 32-byte (256-bit) cryptographic hash that
+ * is collision-resistant and one-way.
+ *
+ * The function requires a {@link KeccakService} to be provided in the Effect context,
+ * enabling dependency injection for testing and different implementations.
+ *
+ * @param {Uint8Array} data - The input bytes to hash. Can be any length.
+ * @returns {Effect.Effect<Keccak256Hash, never, KeccakService>} An Effect that:
+ *   - Succeeds with a 32-byte Keccak256Hash (branded Uint8Array)
+ *   - Never fails (infallible)
+ *   - Requires KeccakService in context
+ *
+ * @example Basic usage with Layer.provide
+ * ```typescript
+ * import { hash, KeccakLive } from 'voltaire-effect/crypto/Keccak256'
+ * import * as Effect from 'effect/Effect'
+ *
+ * const program = hash(new Uint8Array([1, 2, 3])).pipe(
+ *   Effect.provide(KeccakLive)
+ * )
+ *
+ * const result = await Effect.runPromise(program)
+ * console.log(result) // Uint8Array(32) [...]
+ * ```
+ *
+ * @example Hashing a string (UTF-8 encoded)
+ * ```typescript
+ * import { hash, KeccakLive } from 'voltaire-effect/crypto/Keccak256'
+ * import * as Effect from 'effect/Effect'
+ *
+ * const message = new TextEncoder().encode('hello world')
+ * const hashResult = await Effect.runPromise(
+ *   hash(message).pipe(Effect.provide(KeccakLive))
+ * )
+ * ```
+ *
+ * @example Using test layer for deterministic results
+ * ```typescript
+ * import { hash, KeccakTest } from 'voltaire-effect/crypto/Keccak256'
+ * import * as Effect from 'effect/Effect'
+ *
+ * const program = hash(new Uint8Array([1, 2, 3])).pipe(
+ *   Effect.provide(KeccakTest)
+ * )
+ * // Returns zero-filled 32-byte array for testing
+ * ```
+ *
+ * @see {@link KeccakService} - The service interface for Keccak operations
+ * @see {@link KeccakLive} - Production implementation layer
+ * @see {@link KeccakTest} - Test implementation layer
+ * @since 0.0.1
+ */
+export const hash = (
+	data: Uint8Array,
+): Effect.Effect<Keccak256Hash, never, KeccakService> =>
+	Effect.gen(function* () {
+		const keccak = yield* KeccakService;
+		return yield* keccak.hash(data);
+	});

package/src/crypto/Keccak256/index.ts

@@ -0,0 +1,49 @@
+/**
+ * @fileoverview Keccak-256 cryptographic hashing module for Effect.
+ *
+ * @description
+ * This module provides the standard Ethereum Keccak-256 hashing algorithm
+ * wrapped in Effect for type-safe, composable cryptographic operations.
+ *
+ * Keccak-256 is used throughout Ethereum for:
+ * - Address derivation from public keys
+ * - Transaction hashing
+ * - State root computation
+ * - Message signing (EIP-191, EIP-712)
+ * - Smart contract event topic hashing
+ *
+ * @example Basic hashing
+ * ```typescript
+ * import { hash, KeccakLive } from 'voltaire-effect/crypto/Keccak256'
+ * import * as Effect from 'effect/Effect'
+ *
+ * const program = hash(new Uint8Array([1, 2, 3])).pipe(
+ *   Effect.provide(KeccakLive)
+ * )
+ * const result = await Effect.runPromise(program)
+ * ```
+ *
+ * @example Using the service directly
+ * ```typescript
+ * import { KeccakService, KeccakLive } from 'voltaire-effect/crypto/Keccak256'
+ * import * as Effect from 'effect/Effect'
+ *
+ * const program = Effect.gen(function* () {
+ *   const keccak = yield* KeccakService
+ *   const hash1 = yield* keccak.hash(new Uint8Array([1, 2, 3]))
+ *   const hash2 = yield* keccak.hash(new Uint8Array([4, 5, 6]))
+ *   return [hash1, hash2]
+ * }).pipe(Effect.provide(KeccakLive))
+ * ```
+ *
+ * @module Keccak256
+ * @since 0.0.1
+ */
+
+export { hash } from "./hash.js";
+export {
+	KeccakLive,
+	KeccakService,
+	type KeccakServiceShape,
+	KeccakTest,
+} from "./KeccakService.js";

package/src/crypto/Keystore/Keystore.cleanup.test.ts

@@ -0,0 +1,93 @@
+/**
+ * @fileoverview Tests verifying memory cleanup for decrypted keys in Keystore.
+ */
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import { describe, expect, it } from "vitest";
+import * as Keystore from "./index.js";
+
+describe("withDecryptedKey memory cleanup", () => {
+	const testPrivateKey = new Uint8Array([
+		0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c,
+		0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18,
+		0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20,
+	]) as any;
+
+	const testPassword = "test-password-123";
+
+	it("zeroes decrypted key after normal use", async () => {
+		const encrypted = await Effect.runPromise(
+			Keystore.encrypt(testPrivateKey, testPassword, {
+				scryptN: 1024,
+				scryptR: 8,
+				scryptP: 1,
+			}),
+		);
+
+		let capturedKey: Uint8Array | null = null;
+
+		await Effect.runPromise(
+			Keystore.withDecryptedKey(encrypted, testPassword, (key) =>
+				Effect.sync(() => {
+					capturedKey = key;
+					expect(key).toEqual(testPrivateKey);
+				}),
+			),
+		);
+
+		expect(capturedKey).not.toBeNull();
+		expect(
+			(capturedKey as unknown as Uint8Array).every((b: number) => b === 0),
+		).toBe(true);
+	});
+
+	it("zeroes decrypted key even when use effect fails", async () => {
+		const encrypted = await Effect.runPromise(
+			Keystore.encrypt(testPrivateKey, testPassword, {
+				scryptN: 1024,
+				scryptR: 8,
+				scryptP: 1,
+			}),
+		);
+
+		let capturedKey: Uint8Array | null = null;
+
+		const exit = await Effect.runPromiseExit(
+			Keystore.withDecryptedKey(encrypted, testPassword, (key) =>
+				Effect.sync(() => {
+					capturedKey = key;
+					throw new Error("deliberate test error");
+				}),
+			),
+		);
+
+		expect(Exit.isFailure(exit)).toBe(true);
+		expect(capturedKey).not.toBeNull();
+		expect(
+			(capturedKey as unknown as Uint8Array).every((b: number) => b === 0),
+		).toBe(true);
+	});
+
+	it("does not call use when password is wrong", async () => {
+		const encrypted = await Effect.runPromise(
+			Keystore.encrypt(testPrivateKey, testPassword, {
+				scryptN: 1024,
+				scryptR: 8,
+				scryptP: 1,
+			}),
+		);
+
+		let useCalled = false;
+
+		const exit = await Effect.runPromiseExit(
+			Keystore.withDecryptedKey(encrypted, "wrong-password", (_key) =>
+				Effect.sync(() => {
+					useCalled = true;
+				}),
+			),
+		);
+
+		expect(Exit.isFailure(exit)).toBe(true);
+		expect(useCalled).toBe(false);
+	});
+});