nx_base64.nx

base64.nx -- RFC 4648 base64 encoder + decoder. Canonical: this is the substrate-wide canonical Base64 (RFC 4648 §4 standard alphabet) per [[feedback-no-tool-proliferation-bit- level]]. Variants that need URL-safe alphabet (RFC 4648 §5) are candidates for ONE distinct sibling primitive nx_base64_url.nx (queued) that imports THIS file's encode/decode skeleton; all other consumers compose THIS file's encode/decode primitives. Re-implementing the Base64 alphabet or quantum-loop inline is refused. Used for: - PEM decoding of X.509 certs (thin ASCII wrapper around DER) - TLS 1.3 pre-shared key encoding - HTTP Basic auth, OAuth tokens, JWT - Web content (data: URIs, JSON-embedded bytes) Standard alphabet (RFC 4648 §4): 0-25 : A-Z 26-51 : a-z 52-61 : 0-9 62 : + 63 : / pad : = URL-safe alphabet variant (§5) swaps +/ for -_; provided as b64url_encode / b64url_decode. Invariants: B1 Input/output lengths are predictable: encode(n bytes) -> 4 * ceil(n / 3) chars decode(n chars) -> 3 * (n / 4) - padding bytes B2 Decoder rejects invalid input (non-alphabet chars) by returning a negative length. No silent skip. B3 Decoder is tolerant of missing padding (RFC 4648 §3.2 permits this as "unpadded" variant). B4 Encoder is deterministic; same input -> same output. No trailing whitespace, no line breaks inserted. Callers that want MIME-style 76-char wrap do it outside.