feat!: redesign bcrypt API while preserving stored hash verification

[Brooooooklyn]

Bcrypt's positional salt API clips or pads text instead of parsing encoded salts, and its salt generator emits padding. This prepares bcrypt 2.0.0 with explicit creation and verification contracts while preserving existing stored-hash verification behavior.

API changes

• Replace positional arguments with options objects. Validate integer costs before conversion; accept exactly 16 raw salt bytes or a canonical 29-character encoded salt. Generate canonical salts and allow only 2a, 2b, and 2y for creation.
• Preserve default 72-byte truncation for creation and verification, including rehash-on-login. Add an opt-in rejectLongPasswords creation policy that accepts exactly 72 bytes.
• Make async validation reject its Promise. Snapshot mutable bytes before returning, preserve caller signal handlers, and give shared/reused signals independent cancellation state. Accept native signals and locally imported polyfills through AbortSignalLike, without requiring global cancellation constructors. Pending public calls reject on abort even if native work is already running.
• Use the same public adapter for native, Node WASI, and browser entries, retaining comparison aliases. Keep the browser adapter separate from generated files and reject incompatible native backends. Refresh generated bindings and include the matching WASI package during release preparation.

Stored credentials

No database rewrite, prefix replacement, compatibility flag, or password reset is required. Bcrypt retains its existing verifier parser and computation, including accepted noncanonical cost encodings, current prefix handling, raw password bytes, and long-password suffix equivalence. The stricter salt parser applies only to creation. Invalid UTF-8 hash bytes now return false under the documented error contract.

Applications that authenticate by recomputing a hash with a separately saved original salt should migrate to verify(password, storedHash). The migration guide covers this and the new call shapes.

Validation

• The public API and stored-hash smoke checks pass on Node 10.24.1 and 12.22.12, using the PR's macOS x64 native artifact. Dedicated CI jobs exercise both advertised runtimes, including real abort-controller polyfill cancellation with no global constructors and with only an AbortSignal global shim. The polyfill is a development dependency used for regression tests. The package retains its node >= 10 requirement.

• Bcrypt AVA suite: 16 tests passed on native and 16 on WASI on macOS arm64, Node 24.20.0.

• Frozen fixtures: 112 bcrypt hashes from 1.7.3, 1.9.2, 1.10.5, and 1.10.9, plus frozen acceptance/rejection cases. These run in the normal CI suite. New output is checked with bcryptjs and the pinned previous release.

• Manual packed bcrypt entry checks passed on native and WASI with locally built matching backends and backend version enforcement enabled. Headless Chrome 152 also exercised the updated browser entry: 436 assertions passed.

• Forced TypeScript project build, immutable dependency install, and diff checks passed. JavaScript lint, Rust formatting, and targeted Clippy with warnings denied passed for the bcrypt implementation.

Cross-platform results will come from this PR's CI. No packages have been published.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-10T13:21:03.591431Z	dc2e21b	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1ebacd2e69

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 06c3b9576b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".