From f915b035b25c84a62e0e76c8b0cf2b4c0917849d Mon Sep 17 00:00:00 2001
From: Sean Li <sean0407@users.noreply.github.com>
Date: Sat, 17 Oct 2026 03:32:17 +0800
Subject: [PATCH 1/3] Fix PHC Argon2 parameter order

---
 argon2.cjs |  2 +-
 test.cjs   | 12 ++++++------
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/argon2.cjs b/argon2.cjs
index b6f1a27..cc1874e 100644
--- a/argon2.cjs
+++ b/argon2.cjs
@@ -116,7 +116,7 @@ async function hash(password, options) {
     return result;
   }
 
-  const params = { m, p, t };
+  const params = { m, t, p };
   if (data.byteLength > 0) {
     params.data = data;
   }
diff --git a/test.cjs b/test.cjs
index 1033c3f..0b97dc7 100644
--- a/test.cjs
+++ b/test.cjs
@@ -12,11 +12,11 @@ const secret = Buffer.alloc(16, "secret");
 // Hashes for argon2i and argon2d with default options
 const hashes = {
   argon2d:
-    "$argon2d$v=19$m=65536,p=4,t=3$c2FsdHNhbHRzYWx0c2FsdA$VtxJNl5Jr/yZ2UIhvfvL4sGPdDQyGCcy45Cs7rIdFq8",
+    "$argon2d$v=19$m=65536,t=3,p=4$c2FsdHNhbHRzYWx0c2FsdA$VtxJNl5Jr/yZ2UIhvfvL4sGPdDQyGCcy45Cs7rIdFq8",
   argon2i:
-    "$argon2i$v=19$m=65536,p=4,t=3$c2FsdHNhbHRzYWx0c2FsdA$1Ccmp7ECb+Rb5XPjqRwEuAjCufY1xQDOJwnHrB+orZ4",
+    "$argon2i$v=19$m=65536,t=3,p=4$c2FsdHNhbHRzYWx0c2FsdA$1Ccmp7ECb+Rb5XPjqRwEuAjCufY1xQDOJwnHrB+orZ4",
   argon2id:
-    "$argon2id$v=19$m=65536,p=4,t=3$c2FsdHNhbHRzYWx0c2FsdA$rBWULD5jOGpQy32rLvGcmvQMVqIVNAmrCtekWvUA8bw",
+    "$argon2id$v=19$m=65536,t=3,p=4$c2FsdHNhbHRzYWx0c2FsdA$rBWULD5jOGpQy32rLvGcmvQMVqIVNAmrCtekWvUA8bw",
   oldFormat:
     "$argon2i$m=4096,p=1,t=3$tbagT6b1YH33niCo9lVzuA$htv/k+OqWk1V9zD9k5DOBi2kcfcZ6Xu3tWmwEPV3/nc",
   rawArgon2d: Buffer.from(
@@ -36,11 +36,11 @@ const hashes = {
     "hex",
   ),
   withAd:
-    "$argon2id$v=19$m=65536,p=4,t=3,data=YWRhZGFkYWRhZGFkYWRhZA$c2FsdHNhbHRzYWx0c2FsdA$TEIIM4GBSUxvMLolL9ePXYP5G/qcr0vywQqqm/ILvsM",
+    "$argon2id$v=19$m=65536,t=3,p=4,data=YWRhZGFkYWRhZGFkYWRhZA$c2FsdHNhbHRzYWx0c2FsdA$TEIIM4GBSUxvMLolL9ePXYP5G/qcr0vywQqqm/ILvsM",
   withNull:
-    "$argon2id$v=19$m=65536,p=4,t=3$c2FsdHNhbHRzYWx0c2FsdA$NqchDOxwWbcBzA+0gtsCtyspEQxqKFf4/PO/AoIvo+Q",
+    "$argon2id$v=19$m=65536,t=3,p=4$c2FsdHNhbHRzYWx0c2FsdA$NqchDOxwWbcBzA+0gtsCtyspEQxqKFf4/PO/AoIvo+Q",
   withSecret:
-    "$argon2id$v=19$m=65536,p=4,t=3$c2FsdHNhbHRzYWx0c2FsdA$8dZyo1MdHgdzBm+VU7+tyW06dUO7B9FyaPImH5ejVOU",
+    "$argon2id$v=19$m=65536,t=3,p=4$c2FsdHNhbHRzYWx0c2FsdA$8dZyo1MdHgdzBm+VU7+tyW06dUO7B9FyaPImH5ejVOU",
 };
 
 describe("hash", () => {

From 2272fa2925556ff9179425cf4bfc10757ff24af9 Mon Sep 17 00:00:00 2001
From: Sean Li <sean0407@users.noreply.github.com>
Date: Sat, 17 Oct 2026 03:36:21 +0800
Subject: [PATCH 2/3] Keep PHC parameter checks in canonical order

---
 argon2.cjs | 7 ++++++-
 test.cjs   | 2 +-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/argon2.cjs b/argon2.cjs
index cc1874e..584e184 100644
--- a/argon2.cjs
+++ b/argon2.cjs
@@ -116,7 +116,12 @@ async function hash(password, options) {
     return result;
   }
 
-  const params = { m, t, p };
+  // @phc/format serializes parameters in insertion order; PHC requires m,t,p.
+  const params = Object.fromEntries([
+    ["m", m],
+    ["t", t],
+    ["p", p],
+  ]);
   if (data.byteLength > 0) {
     params.data = data;
   }
diff --git a/test.cjs b/test.cjs
index 0b97dc7..82173d2 100644
--- a/test.cjs
+++ b/test.cjs
@@ -148,7 +148,7 @@ describe("set options", () => {
         parallelism: 2,
         timeCost: 4,
       }),
-      /m=8192,p=2,t=4/u,
+      /m=8192,t=4,p=2/u,
     );
   });
 });

From aed30e4a274ea0e2c9912e699621b71c6d943afd Mon Sep 17 00:00:00 2001
From: Ranieri Althoff <ranisalt@gmail.com>
Date: Sat, 17 Oct 2026 21:30:56 +0200
Subject: [PATCH 3/3] chore: don't construct param object with
 Object.fromEntries

---
 argon2.cjs | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/argon2.cjs b/argon2.cjs
index 584e184..b2fea09 100644
--- a/argon2.cjs
+++ b/argon2.cjs
@@ -117,11 +117,8 @@ async function hash(password, options) {
   }
 
   // @phc/format serializes parameters in insertion order; PHC requires m,t,p.
-  const params = Object.fromEntries([
-    ["m", m],
-    ["t", t],
-    ["p", p],
-  ]);
+  // oxlint-disable-next-line eslint/sort-keys
+  const params = { m, t, p };
   if (data.byteLength > 0) {
     params.data = data;
   }