Documentation

Base64url encode a ByteString (without padding).

This function encodes a ByteString using base64url encoding as specified in RFC 4648 Section 5. The result is URL-safe and does not include padding.

>>> base64urlEncode "Hello, World!"
"SGVsbG8sIFdvcmxkIQ"

Base64url decode a Text (handles padding).

This function decodes a base64url-encoded Text back to a ByteString. It handles both padded and unpadded input.

Returns Left with an error message if decoding fails.

Convert Text to ByteString (UTF-8 encoding).

This is a convenience function that encodes Text as UTF-8 ByteString.

Convert ByteString to Text (UTF-8 decoding).

This is a convenience function that decodes a UTF-8 ByteString to Text. Note: This will throw an exception if the ByteString is not valid UTF-8. For safe decoding, use decodeUtf8' instead.

Hash bytes using the specified hash algorithm.

This function computes a cryptographic hash of the input ByteString using the specified hash algorithm (SHA-256, SHA-384, or SHA-512). Returns the hash digest as a ByteString.

Split JSON Pointer path by "/", respecting escapes (RFC 6901).

This function properly handles JSON Pointer escaping:

• "~1" represents a literal forward slash "/"
• "~0" represents a literal tilde "~"

Examples:

• "a/b" → ["a", "b"]
• "a~1b" → ["a/b"] (escaped slash)
• "a~0b" → ["a~b"] (escaped tilde)
• "a~1/b" → ["a/", "b"] (escaped slash becomes "/", then "/" is separator)

Note: This function is designed for relative JSON Pointer paths (without leading "/"). Leading slashes are stripped, trailing slashes don't create empty segments, and consecutive slashes are collapsed.

Unescape JSON Pointer segment (RFC 6901).

Converts escape sequences back to literal characters:

• "~1" → "/"
• "~0" → "~"

Note: Order matters - must replace ~1 before ~0 to avoid double-replacement.

Constant-time equality comparison for ByteStrings.

This function performs a constant-time comparison to prevent timing attacks. It compares two ByteStrings byte-by-byte and always takes the same amount of time regardless of where the first difference occurs.

SECURITY: Use this function when comparing cryptographic values like digests, hashes, or other sensitive data that could be exploited via timing attacks.

Implementation uses cryptonite's constEq which provides constant-time comparison for ByteArray instances. ByteString is a ByteArray instance.

Generate a cryptographically secure random salt.

Generates 128 bits (16 bytes) of random data as recommended by RFC 9901. This salt is used when creating disclosures to ensure that digests cannot be guessed or brute-forced.

The salt is generated using cryptonite's secure random number generator.

Group paths by their first segment.

This is a common pattern for processing nested JSON Pointer paths. Empty paths are grouped under an empty string key.

Example: groupPathsByFirstSegment [["a", "b"], ["a", "c"], ["x"]] = Map.fromList [("a", [["b"], ["c"]]), ("x", [[]])]