@avee1234/selfpatch 0.1.0

package/src/propose.js

@@ -0,0 +1,170 @@
+// selfpatch — `propose` (v0.1).
+//
+// Turn a raw self-edit (a diff, or two versions of a surface) plus its metadata
+// into a *validated* self-patch artifact (see `schema.js`) carrying a
+// deterministic content-hash `id`. Intent is captured; nothing is applied.
+//
+// Pure and synchronous, zero-dependency and zero `node:` imports: the content
+// hash routes through the pure-JS `sha256hex` seam (`sha256.js`), so this module
+// runs unchanged in the browser copy (`site/lib/`).
+//
+// Determinism / id-stability contract: the `id` is a sha-256 over the
+// *semantic* content of the patch — every field except `created` (a wall-clock
+// timestamp: provenance, not identity) and `id` itself. So the same edit yields
+// the same id regardless of when it was proposed or the key order of the inputs,
+// while any change to a semantic field — including the free-form `meta`
+// annotation bag — produces a different id.
+
+import { sha256hex } from "./sha256.js";
+import { validateSelfPatch } from "./schema.js";
+import { canonicalize } from "./canonical.js";
+
+// Thrown when the assembled self-patch fails `validateSelfPatch`. Carries the
+// structured `{ path, code, message }[]` list so callers get every fix in one
+// pass. Named/exported per the #2 spec so callers can rely on the type.
+export class ProposeError extends Error {
+  constructor(message, errors) {
+    super(message);
+    this.name = "ProposeError";
+    this.errors = errors;
+  }
+}
+
+// Field order that produces a readable serialized artifact.
+const FIELD_ORDER = [
+  "id",
+  "created",
+  "author",
+  "layer",
+  "target",
+  "diff",
+  "rationale",
+  "eval_contract",
+  "blast_radius",
+  "requires",
+  "meta",
+];
+
+// Fields excluded from the content id: `id` (self-reference) and `created`
+// (provenance, not identity). Everything else — including `meta` — is hashed.
+const UNHASHED_FIELDS = new Set(["id", "created"]);
+
+function isPlainObject(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+
+function isString(v) {
+  return typeof v === "string";
+}
+
+function contentHash(patch) {
+  const hashable = {};
+  for (const k of Object.keys(patch)) {
+    if (UNHASHED_FIELDS.has(k)) continue;
+    hashable[k] = patch[k];
+  }
+  return "sha256:" + sha256hex(canonicalize(hashable));
+}
+
+// Resolve the diff from the `edit`. The edit *is* the diff: a plain string
+// (⇒ unified), a diff object with a `format` (used verbatim), or the shorthand
+// forms `{ patch }` (⇒ unified) / `{ before, after }` (⇒ before_after). Returns
+// `undefined` when no diff source is present so the validator reports it.
+function resolveDiff(edit) {
+  if (isString(edit)) return { format: "unified", patch: edit };
+  if (isString(edit.format)) return edit;
+  if (isString(edit.patch)) return { format: "unified", patch: edit.patch };
+  if (edit.before !== undefined || edit.after !== undefined) {
+    return { format: "before_after", before: edit.before, after: edit.after };
+  }
+  return undefined;
+}
+
+// Resolve blast_radius from `meta`: an explicit object wins; else a `surfaces`
+// shorthand; else default to the single edited target (when it is a usable
+// string).
+function resolveBlastRadius(meta) {
+  if (meta.blast_radius !== undefined) return meta.blast_radius;
+  if (meta.surfaces !== undefined) return { surfaces: meta.surfaces };
+  if (isString(meta.target) && meta.target.trim().length > 0) {
+    return { surfaces: [meta.target] };
+  }
+  return undefined;
+}
+
+// Resolve eval_contract: a full object wins; else a `command` string shorthand.
+function resolveEvalContract(meta) {
+  if (meta.eval_contract !== undefined) return meta.eval_contract;
+  if (isString(meta.command)) return { kind: "command", command: meta.command };
+  return undefined;
+}
+
+// Order a patch's keys for stable, readable JSON output.
+function ordered(patch) {
+  const out = {};
+  for (const k of FIELD_ORDER) {
+    if (patch[k] !== undefined) out[k] = patch[k];
+  }
+  return out;
+}
+
+/**
+ * Capture a raw self-edit as a validated self-patch artifact.
+ *
+ * @param {string|object} edit  The raw change, which becomes the `diff`: a
+ *   plain unified-diff string, `{ format: "unified", patch }`, or
+ *   `{ format: "before_after", before, after }`.
+ * @param {object} [meta] The rest of the artifact: `{ author, layer, target,
+ *   rationale, eval_contract | command, requires?, blast_radius | surfaces?,
+ *   created?, meta? }`. `requires` defaults to `"human-gate"` (fail-closed);
+ *   `blast_radius` defaults to `{ surfaces: [target] }`; `created` defaults to
+ *   now (it is excluded from the id, so this never perturbs id-stability).
+ * @returns {object} A complete, valid self-patch with a deterministic
+ *   `sha256:…` content-hash `id`.
+ * @throws {Error} If `edit` is not a string or object, or `meta` is not an object.
+ * @throws {ProposeError} If the assembled patch fails `validateSelfPatch`. The
+ *   thrown error carries `.errors` (the full `{ path, code, message }[]` list)
+ *   so callers get every fix in one pass.
+ */
+export function proposeSelfPatch(edit, meta = {}) {
+  if (!isString(edit) && !isPlainObject(edit)) {
+    throw new Error("proposeSelfPatch: `edit` must be a string or object");
+  }
+  if (!isPlainObject(meta)) {
+    throw new Error("proposeSelfPatch: `meta` must be an object");
+  }
+
+  // Assemble the substantive content first so the id is computed over the
+  // normalized shape (shorthand and full forms hash identically).
+  const patch = {
+    author: meta.author,
+    layer: meta.layer,
+    target: meta.target,
+    diff: resolveDiff(edit),
+    rationale: meta.rationale,
+    eval_contract: resolveEvalContract(meta),
+    blast_radius: resolveBlastRadius(meta),
+    requires: meta.requires !== undefined ? meta.requires : "human-gate",
+  };
+  // `meta` is part of the artifact's identity, so it must be present before the
+  // id is hashed (unlike `created`, which is provenance and set afterward).
+  if (meta.meta !== undefined) patch.meta = meta.meta;
+
+  patch.id = contentHash(patch);
+  patch.created =
+    meta.created !== undefined ? meta.created : new Date().toISOString();
+
+  const result = validateSelfPatch(ordered(patch));
+  if (!result.valid) {
+    const lines = result.errors.map((e) => {
+      const loc = e.path === "" ? "(root)" : e.path;
+      return `  ${loc}: ${e.message} [${e.code}]`;
+    });
+    throw new ProposeError(
+      "proposeSelfPatch: assembled self-patch is invalid\n" + lines.join("\n"),
+      result.errors
+    );
+  }
+
+  return ordered(patch);
+}

package/src/schema.js

@@ -0,0 +1,344 @@
+// selfpatch — self-patch + policy schema and validators (v0.1).
+//
+// Hand-written, zero-dependency, pure and synchronous. Both validators return
+// `{ valid, errors }` and never throw on JSON-derived input; a non-object root
+// is reported as a single `not_object` error. Every violation is collected in
+// one pass so a caller (proposer, gate) gets the full fix list at once.
+
+// --- Enums / constants ------------------------------------------------------
+
+export const LAYERS = ["context", "skill", "weights", "scaffolding"];
+export const REQUIRES = ["auto", "human-gate", "forbidden"];
+export const DIFF_FORMATS = ["unified", "before_after"];
+export const ERROR_CODES = [
+  "not_object",
+  "required",
+  "type",
+  "enum",
+  "empty",
+  "format",
+  "mismatch",
+  "unknown_field",
+];
+
+// --- Predicate helpers ------------------------------------------------------
+
+function isPlainObject(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+
+function isString(v) {
+  return typeof v === "string";
+}
+
+function nonEmptyString(v) {
+  return typeof v === "string" && v.trim().length > 0;
+}
+
+function isNonNegativeNumber(v) {
+  return typeof v === "number" && Number.isFinite(v) && v >= 0;
+}
+
+// Lenient ISO-8601 check: accept a date or date-time with optional time,
+// fractional seconds, and a `Z`/±hh:mm offset. Strict enough to reject obvious
+// garbage, lenient enough not to reject valid producers. No date library.
+function isIsoTimestamp(s) {
+  if (typeof s !== "string" || s.trim().length === 0) return false;
+  const iso =
+    /^\d{4}-\d{2}-\d{2}([T ]\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})?)?$/;
+  if (!iso.test(s)) return false;
+  return !Number.isNaN(Date.parse(s));
+}
+
+// `undefined` and `null` both count as absent (for optional fields).
+function isAbsent(v) {
+  return v === undefined || v === null;
+}
+
+function err(errors, path, code, message) {
+  errors.push({ path, code, message });
+}
+
+// Validate a required non-empty string at `path`, pushing the right code.
+function checkRequiredString(errors, obj, key) {
+  const v = obj[key];
+  if (isAbsent(v)) {
+    err(errors, key, "required", `\`${key}\` is required`);
+  } else if (!isString(v)) {
+    err(errors, key, "type", `\`${key}\` must be a string`);
+  } else if (v.trim().length === 0) {
+    err(errors, key, "empty", `\`${key}\` must not be empty`);
+  }
+}
+
+// Validate a required enum value at `path`.
+function checkRequiredEnum(errors, obj, key, allowed) {
+  const v = obj[key];
+  if (isAbsent(v)) {
+    err(errors, key, "required", `\`${key}\` is required`);
+  } else if (!isString(v)) {
+    err(errors, key, "type", `\`${key}\` must be a string`);
+  } else if (!allowed.includes(v)) {
+    err(errors, key, "enum", `\`${key}\` must be one of: ${allowed.join(", ")}`);
+  }
+}
+
+// --- Self-patch -------------------------------------------------------------
+
+const SELFPATCH_KEYS = new Set([
+  "id",
+  "created",
+  "author",
+  "layer",
+  "target",
+  "diff",
+  "rationale",
+  "eval_contract",
+  "blast_radius",
+  "requires",
+  "meta",
+]);
+
+export function validateSelfPatch(obj) {
+  const errors = [];
+  if (!isPlainObject(obj)) {
+    err(errors, "", "not_object", "self-patch must be a plain object");
+    return { valid: false, errors };
+  }
+
+  checkRequiredString(errors, obj, "id");
+  checkRequiredString(errors, obj, "author");
+  checkRequiredString(errors, obj, "target");
+  checkRequiredString(errors, obj, "rationale");
+
+  // created: required non-empty ISO-8601 timestamp
+  if (isAbsent(obj.created)) {
+    err(errors, "created", "required", "`created` is required");
+  } else if (!isString(obj.created)) {
+    err(errors, "created", "type", "`created` must be a string");
+  } else if (obj.created.trim().length === 0) {
+    err(errors, "created", "empty", "`created` must not be empty");
+  } else if (!isIsoTimestamp(obj.created)) {
+    err(errors, "created", "format", "`created` must be an ISO-8601 timestamp");
+  }
+
+  checkRequiredEnum(errors, obj, "layer", LAYERS);
+  checkRequiredEnum(errors, obj, "requires", REQUIRES);
+
+  validateDiff(errors, obj.diff);
+  validateEvalContract(errors, obj.eval_contract);
+  validateBlastRadius(errors, obj.blast_radius);
+
+  checkUnknownKeys(errors, obj, SELFPATCH_KEYS);
+
+  return { valid: errors.length === 0, errors };
+}
+
+function validateDiff(errors, diff) {
+  if (isAbsent(diff)) {
+    err(errors, "diff", "required", "`diff` is required");
+    return;
+  }
+  if (!isPlainObject(diff)) {
+    err(errors, "diff", "type", "`diff` must be an object");
+    return;
+  }
+  const format = diff.format;
+  if (isAbsent(format)) {
+    err(errors, "diff.format", "required", "`diff.format` is required");
+    return;
+  }
+  if (!DIFF_FORMATS.includes(format)) {
+    err(
+      errors,
+      "diff.format",
+      "enum",
+      `\`diff.format\` must be one of: ${DIFF_FORMATS.join(", ")}`
+    );
+    return;
+  }
+
+  if (format === "unified") {
+    if (isAbsent(diff.patch)) {
+      err(errors, "diff.patch", "required", "`diff.patch` is required for unified format");
+    } else if (!isString(diff.patch)) {
+      err(errors, "diff.patch", "type", "`diff.patch` must be a string");
+    }
+    // Keys inconsistent with the declared format.
+    for (const k of ["before", "after"]) {
+      if (k in diff) {
+        err(errors, `diff.${k}`, "mismatch", `\`diff.${k}\` is not valid for format "unified"`);
+      }
+    }
+  } else {
+    // before_after
+    for (const k of ["before", "after"]) {
+      if (isAbsent(diff[k])) {
+        err(errors, `diff.${k}`, "required", `\`diff.${k}\` is required for before_after format`);
+      } else if (!isString(diff[k])) {
+        err(errors, `diff.${k}`, "type", `\`diff.${k}\` must be a string`);
+      }
+    }
+    if ("patch" in diff) {
+      err(errors, "diff.patch", "mismatch", '`diff.patch` is not valid for format "before_after"');
+    }
+  }
+}
+
+function validateEvalContract(errors, ec) {
+  if (isAbsent(ec)) {
+    err(errors, "eval_contract", "required", "`eval_contract` is required");
+    return;
+  }
+  if (!isPlainObject(ec)) {
+    err(errors, "eval_contract", "type", "`eval_contract` must be an object");
+    return;
+  }
+  if (isAbsent(ec.kind)) {
+    err(errors, "eval_contract.kind", "required", "`eval_contract.kind` is required");
+  } else if (ec.kind !== "command") {
+    err(errors, "eval_contract.kind", "enum", '`eval_contract.kind` must be "command"');
+  }
+  if (isAbsent(ec.command)) {
+    err(errors, "eval_contract.command", "required", "`eval_contract.command` is required");
+  } else if (!isString(ec.command)) {
+    err(errors, "eval_contract.command", "type", "`eval_contract.command` must be a string");
+  } else if (ec.command.trim().length === 0) {
+    err(errors, "eval_contract.command", "empty", "`eval_contract.command` must not be empty");
+  }
+}
+
+function validateBlastRadius(errors, br) {
+  if (isAbsent(br)) {
+    err(errors, "blast_radius", "required", "`blast_radius` is required");
+    return;
+  }
+  if (!isPlainObject(br)) {
+    err(errors, "blast_radius", "type", "`blast_radius` must be an object");
+    return;
+  }
+  const surfaces = br.surfaces;
+  if (isAbsent(surfaces)) {
+    err(errors, "blast_radius.surfaces", "required", "`blast_radius.surfaces` is required");
+  } else if (!Array.isArray(surfaces)) {
+    err(errors, "blast_radius.surfaces", "type", "`blast_radius.surfaces` must be an array");
+  } else if (surfaces.length === 0) {
+    err(errors, "blast_radius.surfaces", "empty", "`blast_radius.surfaces` must not be empty");
+  } else {
+    surfaces.forEach((s, i) => {
+      if (!isString(s)) {
+        err(errors, `blast_radius.surfaces[${i}]`, "type", "surface must be a string");
+      }
+    });
+  }
+  for (const k of ["files_changed", "lines_changed"]) {
+    if (!isAbsent(br[k]) && !isNonNegativeNumber(br[k])) {
+      err(errors, `blast_radius.${k}`, "type", `\`blast_radius.${k}\` must be a non-negative number`);
+    }
+  }
+}
+
+// --- Policy -----------------------------------------------------------------
+
+const POLICY_KEYS = new Set([
+  "protected_surfaces",
+  "blast_radius_limits",
+  "approvals",
+  "default_requires",
+  "meta",
+]);
+
+export function validatePolicy(obj) {
+  const errors = [];
+  if (!isPlainObject(obj)) {
+    err(errors, "", "not_object", "policy must be a plain object");
+    return { valid: false, errors };
+  }
+
+  // protected_surfaces: required string[] (may be empty)
+  const ps = obj.protected_surfaces;
+  if (isAbsent(ps)) {
+    err(errors, "protected_surfaces", "required", "`protected_surfaces` is required");
+  } else if (!Array.isArray(ps)) {
+    err(errors, "protected_surfaces", "type", "`protected_surfaces` must be an array");
+  } else {
+    ps.forEach((s, i) => {
+      if (!isString(s)) {
+        err(errors, `protected_surfaces[${i}]`, "type", "surface must be a string");
+      }
+    });
+  }
+
+  validateBlastRadiusLimits(errors, obj.blast_radius_limits);
+  validateApprovals(errors, obj.approvals);
+
+  if (!isAbsent(obj.default_requires)) {
+    if (!isString(obj.default_requires)) {
+      err(errors, "default_requires", "type", "`default_requires` must be a string");
+    } else if (!REQUIRES.includes(obj.default_requires)) {
+      err(errors, "default_requires", "enum", `\`default_requires\` must be one of: ${REQUIRES.join(", ")}`);
+    }
+  }
+
+  checkUnknownKeys(errors, obj, POLICY_KEYS);
+
+  return { valid: errors.length === 0, errors };
+}
+
+function validateBlastRadiusLimits(errors, brl) {
+  if (isAbsent(brl)) return;
+  if (!isPlainObject(brl)) {
+    err(errors, "blast_radius_limits", "type", "`blast_radius_limits` must be an object");
+    return;
+  }
+  for (const k of ["max_surfaces", "max_files_changed", "max_lines_changed"]) {
+    if (!isAbsent(brl[k]) && !isNonNegativeNumber(brl[k])) {
+      err(errors, `blast_radius_limits.${k}`, "type", `\`blast_radius_limits.${k}\` must be a non-negative number`);
+    }
+  }
+}
+
+function validateApprovals(errors, approvals) {
+  if (isAbsent(approvals)) return;
+  if (!Array.isArray(approvals)) {
+    err(errors, "approvals", "type", "`approvals` must be an array");
+    return;
+  }
+  approvals.forEach((rule, i) => {
+    const base = `approvals[${i}]`;
+    if (!isPlainObject(rule)) {
+      err(errors, base, "type", "approval rule must be an object");
+      return;
+    }
+    if (!isAbsent(rule.layer)) {
+      if (!isString(rule.layer)) {
+        err(errors, `${base}.layer`, "type", "`layer` must be a string");
+      } else if (!LAYERS.includes(rule.layer)) {
+        err(errors, `${base}.layer`, "enum", `\`layer\` must be one of: ${LAYERS.join(", ")}`);
+      }
+    }
+    if (!isAbsent(rule.target) && !isString(rule.target)) {
+      err(errors, `${base}.target`, "type", "`target` must be a string");
+    }
+    if (isAbsent(rule.requires)) {
+      err(errors, `${base}.requires`, "required", "`requires` is required");
+    } else if (!isString(rule.requires)) {
+      err(errors, `${base}.requires`, "type", "`requires` must be a string");
+    } else if (!REQUIRES.includes(rule.requires)) {
+      err(errors, `${base}.requires`, "enum", `\`requires\` must be one of: ${REQUIRES.join(", ")}`);
+    }
+    if (isAbsent(rule.layer) && isAbsent(rule.target)) {
+      err(errors, base, "required", "approval rule needs at least one of `layer` or `target`");
+    }
+  });
+}
+
+// --- Shared -----------------------------------------------------------------
+
+function checkUnknownKeys(errors, obj, known) {
+  for (const k of Object.keys(obj)) {
+    if (!known.has(k)) {
+      err(errors, k, "unknown_field", `unknown field \`${k}\``);
+    }
+  }
+}

package/src/sha256.js

@@ -0,0 +1,93 @@
+// selfpatch — pure, synchronous SHA-256 (zero-dependency).
+//
+// A standard FIPS-180-4 SHA-256 over a UTF-8 string, returning lowercase hex.
+// Exists so `propose` and `ledger` can hash without `node:crypto`, making the
+// whole `src/` module graph pure JS with no `node:` imports — so the exact same
+// bytes run in Node and in the browser copy (`site/lib/`). SHA-256 is SHA-256,
+// so ids and chain hashes are byte-identical to the previous `node:crypto`
+// implementation (cross-checked against it in the test suite).
+//
+// Inputs here are small canonical strings (self-patch content, ledger entries),
+// so performance is a non-issue. This is a content hash for addressing and
+// tamper-*evidence*, not authentication. No imports — the browser copy is a
+// literal copy of this file.
+
+// Round constants: first 32 bits of the fractional parts of the cube roots of
+// the first 64 primes.
+const K = new Uint32Array([
+  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
+  0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+  0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
+  0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+  0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
+  0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+  0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
+  0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+  0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
+  0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+  0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+
+function rotr(x, n) {
+  return (x >>> n) | (x << (32 - n));
+}
+
+/**
+ * Synchronous SHA-256 of a UTF-8 string.
+ * @param {string} input
+ * @returns {string} lowercase hex digest (64 chars)
+ * @throws {TypeError} If `input` is not a string.
+ */
+export function sha256hex(input) {
+  if (typeof input !== "string") {
+    throw new TypeError("sha256hex: input must be a string");
+  }
+  const bytes = new TextEncoder().encode(input);
+
+  // Padding: append 0x80, then zeros until the length ≡ 56 (mod 64), then the
+  // 64-bit big-endian message length in bits.
+  const bitLen = bytes.length * 8;
+  const withOne = bytes.length + 1;
+  const totalLen = withOne + ((56 - (withOne % 64) + 64) % 64) + 8;
+  const msg = new Uint8Array(totalLen);
+  msg.set(bytes);
+  msg[bytes.length] = 0x80;
+  const dv = new DataView(msg.buffer);
+  // 64-bit length, big-endian; bitLen is well within the 53-bit safe range.
+  dv.setUint32(totalLen - 8, Math.floor(bitLen / 0x100000000));
+  dv.setUint32(totalLen - 4, bitLen >>> 0);
+
+  let h0 = 0x6a09e667, h1 = 0xbb67ae85, h2 = 0x3c6ef372, h3 = 0xa54ff53a;
+  let h4 = 0x510e527f, h5 = 0x9b05688c, h6 = 0x1f83d9ab, h7 = 0x5be0cd19;
+
+  const w = new Uint32Array(64);
+  for (let off = 0; off < totalLen; off += 64) {
+    for (let i = 0; i < 16; i++) w[i] = dv.getUint32(off + i * 4);
+    for (let i = 16; i < 64; i++) {
+      const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >>> 3);
+      const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >>> 10);
+      w[i] = (w[i - 16] + s0 + w[i - 7] + s1) | 0;
+    }
+
+    let a = h0, b = h1, c = h2, d = h3, e = h4, f = h5, g = h6, h = h7;
+    for (let i = 0; i < 64; i++) {
+      const S1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+      const ch = (e & f) ^ (~e & g);
+      const t1 = (h + S1 + ch + K[i] + w[i]) | 0;
+      const S0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+      const maj = (a & b) ^ (a & c) ^ (b & c);
+      const t2 = (S0 + maj) | 0;
+      h = g; g = f; f = e; e = (d + t1) | 0;
+      d = c; c = b; b = a; a = (t1 + t2) | 0;
+    }
+
+    h0 = (h0 + a) | 0; h1 = (h1 + b) | 0; h2 = (h2 + c) | 0; h3 = (h3 + d) | 0;
+    h4 = (h4 + e) | 0; h5 = (h5 + f) | 0; h6 = (h6 + g) | 0; h7 = (h7 + h) | 0;
+  }
+
+  let hex = "";
+  for (const v of [h0, h1, h2, h3, h4, h5, h6, h7]) {
+    hex += (v >>> 0).toString(16).padStart(8, "0");
+  }
+  return hex;
+}