@backblaze-labs/b2-sdk 0.1.0 → 0.2.0

package/dist/streams/file-source.js

@@ -0,0 +1,286 @@
+//#region src/streams/file-source.ts
+var FILE_STREAM_CHUNK_SIZE = 16 * 1024 * 1024;
+var FILE_SOURCE_INTERNAL = Symbol("FileSource.internal");
+/** @internal */
+var fileSourceTestHooks = {};
+function getNodeFsSync() {
+	const fs = globalThis.process?.getBuiltinModule?.("node:fs");
+	if (!isNodeFsSync(fs)) throw new Error("FileSource constructor requires Node.js 22.3+ synchronous filesystem APIs; use FileSource.fromPath() when synchronous filesystem access is unavailable.");
+	return fs;
+}
+function isNodeFsSync(value) {
+	if (typeof value !== "object" || value === null) return false;
+	return typeof value["lstatSync"] === "function";
+}
+async function fileOpenFlags() {
+	const { constants } = await import("node:fs");
+	return constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0);
+}
+function normalizeSliceOffset(value, size) {
+	if (!Number.isFinite(value)) throw new RangeError("FileSource slice offsets must be finite.");
+	const integer = Math.trunc(value);
+	const offset = integer < 0 ? size + integer : integer;
+	return Math.min(Math.max(offset, 0), size);
+}
+function formatFilePath(path) {
+	return path instanceof URL ? path.href : path;
+}
+function identityFromStats(stats) {
+	return {
+		dev: stats.dev,
+		ino: stats.ino,
+		size: stats.size,
+		mtimeMs: stats.mtimeMs,
+		ctimeMs: stats.ctimeMs
+	};
+}
+function assertStableIdentity(path, stats) {
+	if (stats.dev === 0 && stats.ino === 0) throw new Error(`FileSource: ${formatFilePath(path)} is on a filesystem that does not expose stable file identity.`);
+}
+function assertRegularFile(path, stats) {
+	if (!stats.isFile()) throw new Error(`FileSource: ${formatFilePath(path)} is not a regular file.`);
+}
+function validatedIdentityFromStats(path, stats) {
+	assertRegularFile(path, stats);
+	if (shouldComparePosixFileIdentity()) assertStableIdentity(path, stats);
+	return identityFromStats(stats);
+}
+function assertSameIdentity(path, expected, actual, when) {
+	if (shouldComparePosixFileIdentity()) assertStableIdentity(path, actual);
+	if (shouldComparePosixFileIdentity() && (actual.dev !== expected.dev || actual.ino !== expected.ino)) throw new Error(`FileSource: ${formatFilePath(path)} changed ${when}.`);
+	if (actual.size !== expected.size || actual.mtimeMs !== expected.mtimeMs) throw new Error(`FileSource: ${formatFilePath(path)} was modified ${when}.`);
+	if (shouldComparePosixChangeTime() && actual.ctimeMs !== expected.ctimeMs) throw new Error(`FileSource: ${formatFilePath(path)} was modified ${when}.`);
+}
+function isWindows() {
+	if (fileSourceTestHooks.platform !== void 0) return fileSourceTestHooks.platform === "win32";
+	return globalThis.process?.platform === "win32";
+}
+function shouldComparePosixFileIdentity() {
+	return !isWindows();
+}
+function shouldComparePosixChangeTime() {
+	return !isWindows();
+}
+function throwIfAborted(signal) {
+	if (signal === void 0 || !signal.aborted) return;
+	throw signal.reason ?? new DOMException("Aborted", "AbortError");
+}
+function maxReadSize() {
+	return fileSourceTestHooks.maxReadSize ?? FILE_STREAM_CHUNK_SIZE;
+}
+/* v8 ignore start -- Requires a file to pass identity checks and still EOF mid-range. */
+function rangeEndedEarlyError(path, offset, size) {
+	const end = offset + size;
+	return /* @__PURE__ */ new Error(`FileSource: ${formatFilePath(path)} ended before byte range [${offset}, ${end}) was fully read.`);
+}
+/* v8 ignore stop */
+async function openValidatedFile(path, identity) {
+	const open = fileSourceTestHooks.openFile ?? (await import("node:fs/promises")).open;
+	let file;
+	try {
+		file = await open(path, await fileOpenFlags());
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`FileSource: ${formatFilePath(path)} could not be opened: ${message}`);
+	}
+	try {
+		const stats = await file.stat();
+		assertRegularFile(path, stats);
+		assertSameIdentity(path, identity, stats, "before read");
+		return file;
+	} catch (err) {
+		/* v8 ignore next -- Cleanup failure is deliberately best-effort. */
+		await file.close().catch(() => {});
+		throw err;
+	}
+}
+async function lstatNodeFile(path) {
+	const { lstat } = await import("node:fs/promises");
+	return lstat(path);
+}
+async function readFileRange(path, identity, offset, size, signal) {
+	throwIfAborted(signal);
+	if (size === 0) {
+		await verifyFileIdentityForEmptyRead(path, identity, signal);
+		return /* @__PURE__ */ new Uint8Array(0);
+	}
+	throwIfAborted(signal);
+	const file = await openValidatedFile(path, identity);
+	const data = new Uint8Array(size);
+	let filled = 0;
+	try {
+		while (filled < data.byteLength) {
+			throwIfAborted(signal);
+			const length = Math.min(maxReadSize(), data.byteLength - filled);
+			const { bytesRead } = await file.read(data, filled, length, offset + filled);
+			if (bytesRead === 0) throw rangeEndedEarlyError(path, offset, size);
+			filled += bytesRead;
+			await fileSourceTestHooks.afterReadIteration?.(filled);
+		}
+		throwIfAborted(signal);
+		assertSameIdentity(path, identity, await file.stat(), "while being read");
+		return data;
+	} finally {
+		/* v8 ignore next -- Cleanup failure is deliberately best-effort. */
+		await file.close().catch(() => {});
+	}
+}
+async function verifyFileIdentityForEmptyRead(path, identity, signal) {
+	throwIfAborted(signal);
+	const file = await openValidatedFile(path, identity);
+	try {
+		throwIfAborted(signal);
+		return;
+	} finally {
+		/* v8 ignore next -- Cleanup failure is deliberately best-effort. */
+		await file.close().catch(() => {});
+	}
+}
+function sliceFileRange(path, identity, offset, size, start, end) {
+	const normalizedStart = normalizeSliceOffset(start, size);
+	const normalizedEnd = normalizeSliceOffset(end, size);
+	return new FileSliceSource(path, identity, offset + normalizedStart, Math.max(normalizedEnd - normalizedStart, 0));
+}
+function streamFileRange(path, identity, offset, size) {
+	let position = offset;
+	let remaining = size;
+	let verifiedEmpty = false;
+	const abortController = new AbortController();
+	return new ReadableStream({
+		async pull(controller) {
+			try {
+				if (remaining === 0) {
+					if (!verifiedEmpty) {
+						verifiedEmpty = true;
+						await verifyFileIdentityForEmptyRead(path, identity);
+					}
+					controller.close();
+					return;
+				}
+				const data = await readFileRange(path, identity, position, Math.min(FILE_STREAM_CHUNK_SIZE, remaining), abortController.signal);
+				position += data.byteLength;
+				remaining -= data.byteLength;
+				controller.enqueue(data);
+				if (remaining === 0) controller.close();
+			} catch (err) {
+				controller.error(err);
+			}
+		},
+		cancel(reason) {
+			abortController.abort(reason);
+		}
+	});
+}
+async function fileRangeToArrayBuffer(path, identity, offset, size, options = {}) {
+	return (await readFileRange(path, identity, offset, size, options.signal)).buffer;
+}
+var FileSliceSource = class {
+	path;
+	identity;
+	offset;
+	size;
+	canSlice = true;
+	constructor(path, identity, offset, size) {
+		this.path = path;
+		this.identity = identity;
+		this.offset = offset;
+		this.size = size;
+	}
+	slice(start, end) {
+		return sliceFileRange(this.path, this.identity, this.offset, this.size, start, end);
+	}
+	stream() {
+		return streamFileRange(this.path, this.identity, this.offset, this.size);
+	}
+	toArrayBuffer(options = {}) {
+		return fileRangeToArrayBuffer(this.path, this.identity, this.offset, this.size, options);
+	}
+};
+/**
+* ContentSource backed by a local filesystem path.
+*
+* `FileSource` is Node-only but safe to import in browser builds: it touches
+* Node filesystem APIs only when constructed or read. The constructor performs
+* synchronous filesystem validation so `size` is immediately available; request
+* handlers, sync loops, and other latency-sensitive code should use
+* {@link FileSource.fromPath}. Both paths capture a best-effort regular file
+* identity and reject a symlink as the final path component; parent directory
+* symlinks are followed by the operating system, so callers that constrain
+* paths under a trusted root should validate those parents separately. Reads
+* reject if the path is replaced, if the filesystem cannot report stable
+* identity on POSIX platforms, or if size/mtime/ctime changes before the
+* configured byte range is read. On Windows, reads avoid unreliable dev/inode
+* identity comparisons and validate size/mtime instead.
+* Slices preserve the captured identity, so multipart uploads can read
+* disjoint ranges without materialising the whole file in memory or following
+* later leaf path swaps.
+*/
+var FileSource = class {
+	/** Random-access: file ranges are read by absolute byte offset. */
+	canSlice = true;
+	/** File size captured at construction time. */
+	size;
+	path;
+	identity;
+	/**
+	* Internal constructor path for async validation.
+	* @param path - Local filesystem path or file URL.
+	* @param internal - Module-private validated identity payload.
+	*
+	* @internal
+	*/
+	constructor(path, internal) {
+		const resolvedIdentity = internal?.key === FILE_SOURCE_INTERNAL ? internal.identity : validatedIdentityFromStats(path, getNodeFsSync().lstatSync(path));
+		this.path = path;
+		this.identity = resolvedIdentity;
+		this.size = resolvedIdentity.size;
+	}
+	/**
+	* Return a new file-backed source covering the specified byte range.
+	* @param start - The zero-based byte offset to begin the slice.
+	* @param end - The exclusive byte offset where the slice ends.
+	*
+	* @returns A new ContentSource representing the requested sub-range.
+	*/
+	slice(start, end) {
+		return sliceFileRange(this.path, this.identity, 0, this.size, start, end);
+	}
+	/**
+	* Open this file as a Web ReadableStream.
+	* @returns A ReadableStream that reads the file lazily.
+	*/
+	stream() {
+		return streamFileRange(this.path, this.identity, 0, this.size);
+	}
+	/**
+	* Read this file into an ArrayBuffer.
+	* @param options - Optional abort signal used while reading.
+	*
+	* @returns A promise resolving with the file bytes.
+	*/
+	toArrayBuffer(options = {}) {
+		return fileRangeToArrayBuffer(this.path, this.identity, 0, this.size, options);
+	}
+	/**
+	* Create a FileSource using asynchronous filesystem validation.
+	* @param path - Local filesystem path or file URL.
+	*
+	* @returns A FileSource bound to the validated file identity.
+	*
+	* @throws If the path does not reference a regular non-symlink file.
+	* @throws If a POSIX filesystem cannot report stable file identity.
+	*/
+	static async fromPath(path) {
+		return constructFileSourceFromIdentity(path, validatedIdentityFromStats(path, await lstatNodeFile(path)));
+	}
+};
+function constructFileSourceFromIdentity(path, identity) {
+	return Reflect.construct(FileSource, [path, {
+		key: FILE_SOURCE_INTERNAL,
+		identity
+	}]);
+}
+//#endregion
+export { FileSource, fileSourceTestHooks };
+
+//# sourceMappingURL=file-source.js.map

package/dist/streams/file-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-source.js","names":[],"sources":["../../src/streams/file-source.ts"],"sourcesContent":["import type { ContentSource } from './source.ts'\n\nconst FILE_STREAM_CHUNK_SIZE = 16 * 1024 * 1024\n\n/** Filesystem path accepted by {@link FileSource}. */\nexport type FileSourcePath = string | URL\n\ninterface FileStatsLike {\n  readonly dev: number\n  readonly ino: number\n  readonly mode: number\n  readonly size: number\n  readonly mtimeMs: number\n  readonly ctimeMs: number\n  isFile(): boolean\n}\n\ninterface FileHandleLike {\n  read(\n    buffer: Uint8Array,\n    offset: number,\n    length: number,\n    position: number,\n  ): Promise<{ bytesRead: number }>\n  stat(): Promise<FileStatsLike>\n  close(): Promise<void>\n}\n\ninterface NodeFsSync {\n  lstatSync(path: FileSourcePath): FileStatsLike\n}\n\ninterface FileIdentity {\n  readonly dev: number\n  readonly ino: number\n  readonly size: number\n  readonly mtimeMs: number\n  readonly ctimeMs: number\n}\n\ninterface ToArrayBufferOptions {\n  readonly signal?: AbortSignal\n}\n\nconst FILE_SOURCE_INTERNAL = Symbol('FileSource.internal')\n\ninterface FileSourceInternalOptions {\n  readonly key: typeof FILE_SOURCE_INTERNAL\n  readonly identity: FileIdentity\n}\n\n/** @internal */\nexport const fileSourceTestHooks: {\n  afterReadIteration?: (filled: number) => Promise<void> | void\n  maxReadSize?: number\n  openFile?: (path: FileSourcePath, flags: number) => Promise<FileHandleLike>\n  platform?: string\n} = {}\n\nfunction getNodeFsSync(): NodeFsSync {\n  // FileSource exposes `size` synchronously, so the constructor cannot use the\n  // repo's usual `await import('node:...')` pattern for Node-only APIs. Keep the\n  // synchronous lookup here; async callers should prefer `FileSource.fromPath()`.\n  const processLike = (\n    globalThis as {\n      process?: { getBuiltinModule?: (id: string) => unknown }\n    }\n  ).process\n  const fs = processLike?.getBuiltinModule?.('node:fs')\n  if (!isNodeFsSync(fs)) {\n    throw new Error(\n      'FileSource constructor requires Node.js 22.3+ synchronous filesystem APIs; use FileSource.fromPath() when synchronous filesystem access is unavailable.',\n    )\n  }\n  return fs\n}\n\nfunction isNodeFsSync(value: unknown): value is NodeFsSync {\n  if (typeof value !== 'object' || value === null) return false\n  const candidate = value as Record<string, unknown>\n  return typeof candidate['lstatSync'] === 'function'\n}\n\nasync function fileOpenFlags(): Promise<number> {\n  const { constants } = await import('node:fs')\n  // O_NOFOLLOW and O_NONBLOCK are unavailable on some platforms. When\n  // O_NOFOLLOW is absent, the post-open fstat identity check below is the\n  // symlink-swap defense. O_NONBLOCK avoids blocking indefinitely if a path is\n  // swapped to a FIFO or another blocking special file before fstat rejects it.\n  return (\n    constants.O_RDONLY |\n    (constants.O_NOFOLLOW ?? 0) |\n    ((constants as { O_NONBLOCK?: number }).O_NONBLOCK ?? 0)\n  )\n}\n\nfunction normalizeSliceOffset(value: number, size: number): number {\n  if (!Number.isFinite(value)) throw new RangeError('FileSource slice offsets must be finite.')\n  const integer = Math.trunc(value)\n  const offset = integer < 0 ? size + integer : integer\n  return Math.min(Math.max(offset, 0), size)\n}\n\nfunction formatFilePath(path: FileSourcePath): string {\n  return path instanceof URL ? path.href : path\n}\n\nfunction identityFromStats(stats: FileStatsLike): FileIdentity {\n  return {\n    dev: stats.dev,\n    ino: stats.ino,\n    size: stats.size,\n    mtimeMs: stats.mtimeMs,\n    ctimeMs: stats.ctimeMs,\n  }\n}\n\nfunction assertStableIdentity(path: FileSourcePath, stats: FileStatsLike): void {\n  if (stats.dev === 0 && stats.ino === 0) {\n    throw new Error(\n      `FileSource: ${formatFilePath(path)} is on a filesystem that does not expose stable file identity.`,\n    )\n  }\n}\n\nfunction assertRegularFile(path: FileSourcePath, stats: FileStatsLike): void {\n  if (!stats.isFile()) {\n    throw new Error(`FileSource: ${formatFilePath(path)} is not a regular file.`)\n  }\n}\n\nfunction validatedIdentityFromStats(path: FileSourcePath, stats: FileStatsLike): FileIdentity {\n  assertRegularFile(path, stats)\n  if (shouldComparePosixFileIdentity()) assertStableIdentity(path, stats)\n  return identityFromStats(stats)\n}\n\nfunction assertSameIdentity(\n  path: FileSourcePath,\n  expected: FileIdentity,\n  actual: FileStatsLike,\n  when: string,\n): void {\n  if (shouldComparePosixFileIdentity()) assertStableIdentity(path, actual)\n  if (\n    shouldComparePosixFileIdentity() &&\n    (actual.dev !== expected.dev || actual.ino !== expected.ino)\n  ) {\n    throw new Error(`FileSource: ${formatFilePath(path)} changed ${when}.`)\n  }\n  if (actual.size !== expected.size || actual.mtimeMs !== expected.mtimeMs) {\n    throw new Error(`FileSource: ${formatFilePath(path)} was modified ${when}.`)\n  }\n  if (shouldComparePosixChangeTime() && actual.ctimeMs !== expected.ctimeMs) {\n    throw new Error(`FileSource: ${formatFilePath(path)} was modified ${when}.`)\n  }\n}\n\nfunction isWindows(): boolean {\n  if (fileSourceTestHooks.platform !== undefined) return fileSourceTestHooks.platform === 'win32'\n  const processLike = (globalThis as { process?: { platform?: string } }).process\n  return processLike?.platform === 'win32'\n}\n\nfunction shouldComparePosixFileIdentity(): boolean {\n  return !isWindows()\n}\n\nfunction shouldComparePosixChangeTime(): boolean {\n  return !isWindows()\n}\n\nfunction throwIfAborted(signal: AbortSignal | undefined): void {\n  if (signal === undefined || !signal.aborted) return\n  throw signal.reason ?? new DOMException('Aborted', 'AbortError')\n}\n\nfunction maxReadSize(): number {\n  return fileSourceTestHooks.maxReadSize ?? FILE_STREAM_CHUNK_SIZE\n}\n\n/* v8 ignore start -- Requires a file to pass identity checks and still EOF mid-range. */\nfunction rangeEndedEarlyError(path: FileSourcePath, offset: number, size: number): Error {\n  const end = offset + size\n  return new Error(\n    `FileSource: ${formatFilePath(path)} ended before byte range [${offset}, ${end}) was fully read.`,\n  )\n}\n/* v8 ignore stop */\n\nasync function openValidatedFile(\n  path: FileSourcePath,\n  identity: FileIdentity,\n): Promise<FileHandleLike> {\n  const open =\n    fileSourceTestHooks.openFile ??\n    (\n      (await import('node:fs/promises')) as {\n        open(path: FileSourcePath, flags: number): Promise<FileHandleLike>\n      }\n    ).open\n  let file: FileHandleLike\n  try {\n    file = await open(path, await fileOpenFlags())\n  } catch (err) {\n    const message = err instanceof Error ? err.message : String(err)\n    throw new Error(`FileSource: ${formatFilePath(path)} could not be opened: ${message}`)\n  }\n\n  try {\n    const stats = await file.stat()\n    assertRegularFile(path, stats)\n    assertSameIdentity(path, identity, stats, 'before read')\n    return file\n  } catch (err) {\n    /* v8 ignore next -- Cleanup failure is deliberately best-effort. */\n    await file.close().catch(() => {})\n    throw err\n  }\n}\n\nasync function lstatNodeFile(path: FileSourcePath): Promise<FileStatsLike> {\n  const { lstat } = (await import('node:fs/promises')) as {\n    lstat(path: FileSourcePath): Promise<FileStatsLike>\n  }\n  return lstat(path)\n}\n\nasync function readFileRange(\n  path: FileSourcePath,\n  identity: FileIdentity,\n  offset: number,\n  size: number,\n  signal?: AbortSignal,\n): Promise<Uint8Array> {\n  throwIfAborted(signal)\n  if (size === 0) {\n    await verifyFileIdentityForEmptyRead(path, identity, signal)\n    return new Uint8Array(0)\n  }\n\n  throwIfAborted(signal)\n  const file = await openValidatedFile(path, identity)\n  const data = new Uint8Array(size)\n  let filled = 0\n  try {\n    while (filled < data.byteLength) {\n      throwIfAborted(signal)\n      const length = Math.min(maxReadSize(), data.byteLength - filled)\n      const { bytesRead } = await file.read(data, filled, length, offset + filled)\n      if (bytesRead === 0) throw rangeEndedEarlyError(path, offset, size)\n      filled += bytesRead\n      await fileSourceTestHooks.afterReadIteration?.(filled)\n    }\n    throwIfAborted(signal)\n    const stats = await file.stat()\n    assertSameIdentity(path, identity, stats, 'while being read')\n    return data\n  } finally {\n    /* v8 ignore next -- Cleanup failure is deliberately best-effort. */\n    await file.close().catch(() => {})\n  }\n}\n\nasync function verifyFileIdentityForEmptyRead(\n  path: FileSourcePath,\n  identity: FileIdentity,\n  signal?: AbortSignal,\n): Promise<void> {\n  throwIfAborted(signal)\n  const file = await openValidatedFile(path, identity)\n  try {\n    throwIfAborted(signal)\n    return\n  } finally {\n    /* v8 ignore next -- Cleanup failure is deliberately best-effort. */\n    await file.close().catch(() => {})\n  }\n}\n\nfunction sliceFileRange(\n  path: FileSourcePath,\n  identity: FileIdentity,\n  offset: number,\n  size: number,\n  start: number,\n  end: number,\n): ContentSource {\n  const normalizedStart = normalizeSliceOffset(start, size)\n  const normalizedEnd = normalizeSliceOffset(end, size)\n  return new FileSliceSource(\n    path,\n    identity,\n    offset + normalizedStart,\n    Math.max(normalizedEnd - normalizedStart, 0),\n  )\n}\n\nfunction streamFileRange(\n  path: FileSourcePath,\n  identity: FileIdentity,\n  offset: number,\n  size: number,\n): ReadableStream<Uint8Array> {\n  let position = offset\n  let remaining = size\n  let verifiedEmpty = false\n  const abortController = new AbortController()\n\n  // Open per pull so abandoned public streams do not strand file handles or\n  // retain Windows locks. Each chunk still verifies identity around its read.\n  return new ReadableStream<Uint8Array>({\n    async pull(controller) {\n      try {\n        if (remaining === 0) {\n          if (!verifiedEmpty) {\n            verifiedEmpty = true\n            await verifyFileIdentityForEmptyRead(path, identity)\n          }\n          controller.close()\n          return\n        }\n\n        const length = Math.min(FILE_STREAM_CHUNK_SIZE, remaining)\n        const data = await readFileRange(path, identity, position, length, abortController.signal)\n        position += data.byteLength\n        remaining -= data.byteLength\n        controller.enqueue(data)\n        if (remaining === 0) controller.close()\n      } catch (err) {\n        controller.error(err)\n      }\n    },\n    cancel(reason) {\n      abortController.abort(reason)\n    },\n  })\n}\n\nasync function fileRangeToArrayBuffer(\n  path: FileSourcePath,\n  identity: FileIdentity,\n  offset: number,\n  size: number,\n  options: ToArrayBufferOptions = {},\n): Promise<ArrayBuffer> {\n  const data = await readFileRange(path, identity, offset, size, options.signal)\n  return data.buffer as ArrayBuffer\n}\n\nclass FileSliceSource implements ContentSource {\n  readonly canSlice = true\n\n  constructor(\n    private readonly path: FileSourcePath,\n    private readonly identity: FileIdentity,\n    private readonly offset: number,\n    readonly size: number,\n  ) {}\n\n  slice(start: number, end: number): ContentSource {\n    return sliceFileRange(this.path, this.identity, this.offset, this.size, start, end)\n  }\n\n  stream(): ReadableStream<Uint8Array> {\n    return streamFileRange(this.path, this.identity, this.offset, this.size)\n  }\n\n  toArrayBuffer(options: ToArrayBufferOptions = {}): Promise<ArrayBuffer> {\n    return fileRangeToArrayBuffer(this.path, this.identity, this.offset, this.size, options)\n  }\n}\n\n/**\n * ContentSource backed by a local filesystem path.\n *\n * `FileSource` is Node-only but safe to import in browser builds: it touches\n * Node filesystem APIs only when constructed or read. The constructor performs\n * synchronous filesystem validation so `size` is immediately available; request\n * handlers, sync loops, and other latency-sensitive code should use\n * {@link FileSource.fromPath}. Both paths capture a best-effort regular file\n * identity and reject a symlink as the final path component; parent directory\n * symlinks are followed by the operating system, so callers that constrain\n * paths under a trusted root should validate those parents separately. Reads\n * reject if the path is replaced, if the filesystem cannot report stable\n * identity on POSIX platforms, or if size/mtime/ctime changes before the\n * configured byte range is read. On Windows, reads avoid unreliable dev/inode\n * identity comparisons and validate size/mtime instead.\n * Slices preserve the captured identity, so multipart uploads can read\n * disjoint ranges without materialising the whole file in memory or following\n * later leaf path swaps.\n */\nexport class FileSource implements ContentSource {\n  /** Random-access: file ranges are read by absolute byte offset. */\n  readonly canSlice = true\n  /** File size captured at construction time. */\n  readonly size: number\n  private readonly path: FileSourcePath\n  private readonly identity: FileIdentity\n\n  /**\n   * Create a FileSource for a local file path.\n   * @param path - Local filesystem path or file URL.\n   *\n   * @throws If the runtime has no Node-compatible filesystem API.\n   * @throws If the path does not reference a regular non-symlink file.\n   * @throws If a POSIX filesystem cannot report stable file identity.\n   */\n  constructor(path: FileSourcePath)\n  /**\n   * Internal constructor path for async validation.\n   * @param path - Local filesystem path or file URL.\n   * @param internal - Module-private validated identity payload.\n   *\n   * @internal\n   */\n  constructor(path: FileSourcePath, internal?: FileSourceInternalOptions) {\n    const resolvedIdentity =\n      internal?.key === FILE_SOURCE_INTERNAL\n        ? internal.identity\n        : validatedIdentityFromStats(path, getNodeFsSync().lstatSync(path))\n    this.path = path\n    this.identity = resolvedIdentity\n    this.size = resolvedIdentity.size\n  }\n\n  /**\n   * Return a new file-backed source covering the specified byte range.\n   * @param start - The zero-based byte offset to begin the slice.\n   * @param end - The exclusive byte offset where the slice ends.\n   *\n   * @returns A new ContentSource representing the requested sub-range.\n   */\n  slice(start: number, end: number): ContentSource {\n    return sliceFileRange(this.path, this.identity, 0, this.size, start, end)\n  }\n\n  /**\n   * Open this file as a Web ReadableStream.\n   * @returns A ReadableStream that reads the file lazily.\n   */\n  stream(): ReadableStream<Uint8Array> {\n    return streamFileRange(this.path, this.identity, 0, this.size)\n  }\n\n  /**\n   * Read this file into an ArrayBuffer.\n   * @param options - Optional abort signal used while reading.\n   *\n   * @returns A promise resolving with the file bytes.\n   */\n  toArrayBuffer(options: { readonly signal?: AbortSignal } = {}): Promise<ArrayBuffer> {\n    return fileRangeToArrayBuffer(this.path, this.identity, 0, this.size, options)\n  }\n\n  /**\n   * Create a FileSource using asynchronous filesystem validation.\n   * @param path - Local filesystem path or file URL.\n   *\n   * @returns A FileSource bound to the validated file identity.\n   *\n   * @throws If the path does not reference a regular non-symlink file.\n   * @throws If a POSIX filesystem cannot report stable file identity.\n   */\n  static async fromPath(path: FileSourcePath): Promise<FileSource> {\n    const identity = validatedIdentityFromStats(path, await lstatNodeFile(path))\n    return constructFileSourceFromIdentity(path, identity)\n  }\n}\n\nfunction constructFileSourceFromIdentity(path: FileSourcePath, identity: FileIdentity): FileSource {\n  // The public overload is intentionally single-argument; Reflect.construct\n  // lets fromPath pass the module-private validated identity without exposing\n  // that constructor shape in the public type surface.\n  return Reflect.construct(FileSource, [\n    path,\n    { key: FILE_SOURCE_INTERNAL, identity },\n  ]) as FileSource\n}\n"],"mappings":";AAEA,IAAM,yBAAyB,KAAK,OAAO;AA0C3C,IAAM,uBAAuB,OAAO,qBAAqB;;AAQzD,IAAa,sBAKT,CAAC;AAEL,SAAS,gBAA4B;CASnC,MAAM,KAJJ,WAGA,SACsB,mBAAmB,SAAS;CACpD,IAAI,CAAC,aAAa,EAAE,GAClB,MAAM,IAAI,MACR,yJACF;CAEF,OAAO;AACT;AAEA,SAAS,aAAa,OAAqC;CACzD,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CAExD,OAAO,OAAO,MAAU,iBAAiB;AAC3C;AAEA,eAAe,gBAAiC;CAC9C,MAAM,EAAE,cAAc,MAAM,OAAO;CAKnC,OACE,UAAU,YACT,UAAU,cAAc,MACvB,UAAsC,cAAc;AAE1D;AAEA,SAAS,qBAAqB,OAAe,MAAsB;CACjE,IAAI,CAAC,OAAO,SAAS,KAAK,GAAG,MAAM,IAAI,WAAW,0CAA0C;CAC5F,MAAM,UAAU,KAAK,MAAM,KAAK;CAChC,MAAM,SAAS,UAAU,IAAI,OAAO,UAAU;CAC9C,OAAO,KAAK,IAAI,KAAK,IAAI,QAAQ,CAAC,GAAG,IAAI;AAC3C;AAEA,SAAS,eAAe,MAA8B;CACpD,OAAO,gBAAgB,MAAM,KAAK,OAAO;AAC3C;AAEA,SAAS,kBAAkB,OAAoC;CAC7D,OAAO;EACL,KAAK,MAAM;EACX,KAAK,MAAM;EACX,MAAM,MAAM;EACZ,SAAS,MAAM;EACf,SAAS,MAAM;CACjB;AACF;AAEA,SAAS,qBAAqB,MAAsB,OAA4B;CAC9E,IAAI,MAAM,QAAQ,KAAK,MAAM,QAAQ,GACnC,MAAM,IAAI,MACR,eAAe,eAAe,IAAI,EAAE,+DACtC;AAEJ;AAEA,SAAS,kBAAkB,MAAsB,OAA4B;CAC3E,IAAI,CAAC,MAAM,OAAO,GAChB,MAAM,IAAI,MAAM,eAAe,eAAe,IAAI,EAAE,wBAAwB;AAEhF;AAEA,SAAS,2BAA2B,MAAsB,OAAoC;CAC5F,kBAAkB,MAAM,KAAK;CAC7B,IAAI,+BAA+B,GAAG,qBAAqB,MAAM,KAAK;CACtE,OAAO,kBAAkB,KAAK;AAChC;AAEA,SAAS,mBACP,MACA,UACA,QACA,MACM;CACN,IAAI,+BAA+B,GAAG,qBAAqB,MAAM,MAAM;CACvE,IACE,+BAA+B,MAC9B,OAAO,QAAQ,SAAS,OAAO,OAAO,QAAQ,SAAS,MAExD,MAAM,IAAI,MAAM,eAAe,eAAe,IAAI,EAAE,WAAW,KAAK,EAAE;CAExE,IAAI,OAAO,SAAS,SAAS,QAAQ,OAAO,YAAY,SAAS,SAC/D,MAAM,IAAI,MAAM,eAAe,eAAe,IAAI,EAAE,gBAAgB,KAAK,EAAE;CAE7E,IAAI,6BAA6B,KAAK,OAAO,YAAY,SAAS,SAChE,MAAM,IAAI,MAAM,eAAe,eAAe,IAAI,EAAE,gBAAgB,KAAK,EAAE;AAE/E;AAEA,SAAS,YAAqB;CAC5B,IAAI,oBAAoB,aAAa,KAAA,GAAW,OAAO,oBAAoB,aAAa;CAExF,OADqB,WAAmD,SACpD,aAAa;AACnC;AAEA,SAAS,iCAA0C;CACjD,OAAO,CAAC,UAAU;AACpB;AAEA,SAAS,+BAAwC;CAC/C,OAAO,CAAC,UAAU;AACpB;AAEA,SAAS,eAAe,QAAuC;CAC7D,IAAI,WAAW,KAAA,KAAa,CAAC,OAAO,SAAS;CAC7C,MAAM,OAAO,UAAU,IAAI,aAAa,WAAW,YAAY;AACjE;AAEA,SAAS,cAAsB;CAC7B,OAAO,oBAAoB,eAAe;AAC5C;;AAGA,SAAS,qBAAqB,MAAsB,QAAgB,MAAqB;CACvF,MAAM,MAAM,SAAS;CACrB,uBAAO,IAAI,MACT,eAAe,eAAe,IAAI,EAAE,4BAA4B,OAAO,IAAI,IAAI,kBACjF;AACF;;AAGA,eAAe,kBACb,MACA,UACyB;CACzB,MAAM,OACJ,oBAAoB,aAEjB,MAAM,OAAO,oBAAA,CAGd;CACJ,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,KAAK,MAAM,MAAM,cAAc,CAAC;CAC/C,SAAS,KAAK;EACZ,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;EAC/D,MAAM,IAAI,MAAM,eAAe,eAAe,IAAI,EAAE,wBAAwB,SAAS;CACvF;CAEA,IAAI;EACF,MAAM,QAAQ,MAAM,KAAK,KAAK;EAC9B,kBAAkB,MAAM,KAAK;EAC7B,mBAAmB,MAAM,UAAU,OAAO,aAAa;EACvD,OAAO;CACT,SAAS,KAAK;;EAEZ,MAAM,KAAK,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;EACjC,MAAM;CACR;AACF;AAEA,eAAe,cAAc,MAA8C;CACzE,MAAM,EAAE,UAAW,MAAM,OAAO;CAGhC,OAAO,MAAM,IAAI;AACnB;AAEA,eAAe,cACb,MACA,UACA,QACA,MACA,QACqB;CACrB,eAAe,MAAM;CACrB,IAAI,SAAS,GAAG;EACd,MAAM,+BAA+B,MAAM,UAAU,MAAM;EAC3D,uBAAO,IAAI,WAAW,CAAC;CACzB;CAEA,eAAe,MAAM;CACrB,MAAM,OAAO,MAAM,kBAAkB,MAAM,QAAQ;CACnD,MAAM,OAAO,IAAI,WAAW,IAAI;CAChC,IAAI,SAAS;CACb,IAAI;EACF,OAAO,SAAS,KAAK,YAAY;GAC/B,eAAe,MAAM;GACrB,MAAM,SAAS,KAAK,IAAI,YAAY,GAAG,KAAK,aAAa,MAAM;GAC/D,MAAM,EAAE,cAAc,MAAM,KAAK,KAAK,MAAM,QAAQ,QAAQ,SAAS,MAAM;GAC3E,IAAI,cAAc,GAAG,MAAM,qBAAqB,MAAM,QAAQ,IAAI;GAClE,UAAU;GACV,MAAM,oBAAoB,qBAAqB,MAAM;EACvD;EACA,eAAe,MAAM;EAErB,mBAAmB,MAAM,UAAU,MADf,KAAK,KAAK,GACY,kBAAkB;EAC5D,OAAO;CACT,UAAU;;EAER,MAAM,KAAK,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;CACnC;AACF;AAEA,eAAe,+BACb,MACA,UACA,QACe;CACf,eAAe,MAAM;CACrB,MAAM,OAAO,MAAM,kBAAkB,MAAM,QAAQ;CACnD,IAAI;EACF,eAAe,MAAM;EACrB;CACF,UAAU;;EAER,MAAM,KAAK,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;CACnC;AACF;AAEA,SAAS,eACP,MACA,UACA,QACA,MACA,OACA,KACe;CACf,MAAM,kBAAkB,qBAAqB,OAAO,IAAI;CACxD,MAAM,gBAAgB,qBAAqB,KAAK,IAAI;CACpD,OAAO,IAAI,gBACT,MACA,UACA,SAAS,iBACT,KAAK,IAAI,gBAAgB,iBAAiB,CAAC,CAC7C;AACF;AAEA,SAAS,gBACP,MACA,UACA,QACA,MAC4B;CAC5B,IAAI,WAAW;CACf,IAAI,YAAY;CAChB,IAAI,gBAAgB;CACpB,MAAM,kBAAkB,IAAI,gBAAgB;CAI5C,OAAO,IAAI,eAA2B;EACpC,MAAM,KAAK,YAAY;GACrB,IAAI;IACF,IAAI,cAAc,GAAG;KACnB,IAAI,CAAC,eAAe;MAClB,gBAAgB;MAChB,MAAM,+BAA+B,MAAM,QAAQ;KACrD;KACA,WAAW,MAAM;KACjB;IACF;IAGA,MAAM,OAAO,MAAM,cAAc,MAAM,UAAU,UADlC,KAAK,IAAI,wBAAwB,SACW,GAAQ,gBAAgB,MAAM;IACzF,YAAY,KAAK;IACjB,aAAa,KAAK;IAClB,WAAW,QAAQ,IAAI;IACvB,IAAI,cAAc,GAAG,WAAW,MAAM;GACxC,SAAS,KAAK;IACZ,WAAW,MAAM,GAAG;GACtB;EACF;EACA,OAAO,QAAQ;GACb,gBAAgB,MAAM,MAAM;EAC9B;CACF,CAAC;AACH;AAEA,eAAe,uBACb,MACA,UACA,QACA,MACA,UAAgC,CAAC,GACX;CAEtB,QAAO,MADY,cAAc,MAAM,UAAU,QAAQ,MAAM,QAAQ,MAAM,EAAA,CACjE;AACd;AAEA,IAAM,kBAAN,MAA+C;CAI1B;CACA;CACA;CACR;CANX,WAAoB;CAEpB,YACE,MACA,UACA,QACA,MACA;EAJiB,KAAA,OAAA;EACA,KAAA,WAAA;EACA,KAAA,SAAA;EACR,KAAA,OAAA;CACR;CAEH,MAAM,OAAe,KAA4B;EAC/C,OAAO,eAAe,KAAK,MAAM,KAAK,UAAU,KAAK,QAAQ,KAAK,MAAM,OAAO,GAAG;CACpF;CAEA,SAAqC;EACnC,OAAO,gBAAgB,KAAK,MAAM,KAAK,UAAU,KAAK,QAAQ,KAAK,IAAI;CACzE;CAEA,cAAc,UAAgC,CAAC,GAAyB;EACtE,OAAO,uBAAuB,KAAK,MAAM,KAAK,UAAU,KAAK,QAAQ,KAAK,MAAM,OAAO;CACzF;AACF;;;;;;;;;;;;;;;;;;;;AAqBA,IAAa,aAAb,MAAiD;;CAE/C,WAAoB;;CAEpB;CACA;CACA;;;;;;;;CAkBA,YAAY,MAAsB,UAAsC;EACtE,MAAM,mBACJ,UAAU,QAAQ,uBACd,SAAS,WACT,2BAA2B,MAAM,cAAc,CAAC,CAAC,UAAU,IAAI,CAAC;EACtE,KAAK,OAAO;EACZ,KAAK,WAAW;EAChB,KAAK,OAAO,iBAAiB;CAC/B;;;;;;;;CASA,MAAM,OAAe,KAA4B;EAC/C,OAAO,eAAe,KAAK,MAAM,KAAK,UAAU,GAAG,KAAK,MAAM,OAAO,GAAG;CAC1E;;;;;CAMA,SAAqC;EACnC,OAAO,gBAAgB,KAAK,MAAM,KAAK,UAAU,GAAG,KAAK,IAAI;CAC/D;;;;;;;CAQA,cAAc,UAA6C,CAAC,GAAyB;EACnF,OAAO,uBAAuB,KAAK,MAAM,KAAK,UAAU,GAAG,KAAK,MAAM,OAAO;CAC/E;;;;;;;;;;CAWA,aAAa,SAAS,MAA2C;EAE/D,OAAO,gCAAgC,MADtB,2BAA2B,MAAM,MAAM,cAAc,IAAI,CAC7B,CAAQ;CACvD;AACF;AAEA,SAAS,gCAAgC,MAAsB,UAAoC;CAIjG,OAAO,QAAQ,UAAU,YAAY,CACnC,MACA;EAAE,KAAK;EAAsB;CAAS,CACxC,CAAC;AACH"}

package/dist/streams/hash.cjs

@@ -1,123 +1,215 @@
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-let nodeCreateHash;
+const require_bytes = require("../util/bytes.cjs");
+const require_crypto = require("../util/crypto.cjs");
+//#region src/streams/hash.ts
+var nodeCreateHash;
+/**
+* Lazily loads `node:crypto` and caches the factory. Returns null in non-Node runtimes.
+*
+* @returns The cached hash factory, or null if Node crypto is unavailable.
+*/
 async function getNodeCreateHash() {
-  if (nodeCreateHash !== void 0) return nodeCreateHash;
-  try {
-    const crypto2 = await import("node:crypto");
-    if (typeof crypto2.createHash !== "function") throw new Error("createHash unavailable");
-    nodeCreateHash = (algo) => {
-      const h = crypto2.createHash(algo);
-      return {
-        update(data) {
-          h.update(data);
-        },
-        digest(encoding) {
-          return h.digest(encoding);
-        }
-      };
-    };
-  } catch {
-    nodeCreateHash = null;
-  }
-  return nodeCreateHash;
+	if (nodeCreateHash !== void 0) return nodeCreateHash;
+	try {
+		const crypto = await import("node:crypto");
+		if (typeof crypto.createHash !== "function") throw new Error("createHash unavailable");
+		nodeCreateHash = (algo) => {
+			const h = crypto.createHash(algo);
+			return {
+				update(data) {
+					h.update(data);
+				},
+				digest(encoding) {
+					return h.digest(encoding);
+				}
+			};
+		};
+	} catch {
+		/* v8 ignore next -- non-Node runtime fallback, unreachable in Node coverage. */
+		nodeCreateHash = null;
+	}
+	return nodeCreateHash;
 }
-class IncrementalSha1 {
-  /** Buffered chunks for WebCrypto fallback path. */
-  chunks = [];
-  /** Total bytes fed into the hash so far. */
-  totalLength = 0;
-  /** Node.js hash instance, or null if using WebCrypto fallback. */
-  nodeHash = null;
-  /** Resolves once the crypto backend has been loaded. */
-  initPromise;
-  /** Creates a new IncrementalSha1 and lazily initializes the crypto backend. */
-  constructor() {
-    this.initPromise = getNodeCreateHash().then((factory) => {
-      if (factory) this.nodeHash = factory("sha1");
-    });
-  }
-  /**
-   * Feed data into the hash. Async because it lazily initializes the crypto backend.
-   * @param data - The bytes to include in the hash computation.
-   *
-   * @returns A promise that resolves once the data has been consumed.
-   */
-  async update(data) {
-    await this.initPromise;
-    if (this.nodeHash) {
-      this.nodeHash.update(data);
-    } else {
-      this.chunks.push(new Uint8Array(data));
-    }
-    this.totalLength += data.byteLength;
-  }
-  /**
-   * Finalize the hash and return the hex-encoded SHA-1 digest.
-   * @returns The lowercase hex-encoded SHA-1 digest of all data fed so far.
-   */
-  async digest() {
-    await this.initPromise;
-    if (this.nodeHash) {
-      return this.nodeHash.digest("hex");
-    }
-    const combined = new Uint8Array(this.totalLength);
-    let offset = 0;
-    for (const chunk of this.chunks) {
-      combined.set(chunk, offset);
-      offset += chunk.byteLength;
-    }
-    const hashBuffer = await crypto.subtle.digest("SHA-1", combined.buffer);
-    return hexEncode(new Uint8Array(hashBuffer));
-  }
-  /**
-   * Total number of bytes fed into the hash so far.
-   *
-   * @returns The cumulative byte count across all update calls.
-   */
-  get bytesProcessed() {
-    return this.totalLength;
-  }
+/**
+* Incrementally computes SHA-1 hashes over streaming data.
+* Uses Node.js `crypto` when available, falling back to a dependency-free
+* incremental JavaScript implementation.
+*/
+var IncrementalSha1 = class {
+	/** Total bytes fed into the hash so far. */
+	totalLength = 0;
+	/** Node.js hash instance, or null if using the JavaScript fallback. */
+	nodeHash = null;
+	/** Streaming JavaScript fallback used when Node crypto is unavailable. */
+	jsHash = new JsSha1Hasher();
+	/** Resolves once the crypto backend has been loaded. */
+	initPromise;
+	/** Creates a new IncrementalSha1 and lazily initializes the crypto backend. */
+	constructor() {
+		this.initPromise = getNodeCreateHash().then((factory) => {
+			if (factory) this.nodeHash = factory("sha1");
+		});
+	}
+	/**
+	* Feed data into the hash. Async because it lazily initializes the crypto backend.
+	* @param data - The bytes to include in the hash computation.
+	*
+	* @returns A promise that resolves once the data has been consumed.
+	*/
+	async update(data) {
+		await this.initPromise;
+		if (this.nodeHash) this.nodeHash.update(data);
+		else
+ /* v8 ignore next -- WebCrypto fallback is exercised by browser-mode tests. */
+		this.jsHash.update(data);
+		this.totalLength += data.byteLength;
+	}
+	/**
+	* Finalize the hash and return the hex-encoded SHA-1 digest.
+	* @returns The lowercase hex-encoded SHA-1 digest of all data fed so far.
+	*/
+	async digest() {
+		await this.initPromise;
+		if (this.nodeHash) return this.nodeHash.digest("hex");
+		/* v8 ignore next -- non-Node runtime fallback, exercised by browser-mode tests */
+		return this.jsHash.digest();
+	}
+	/**
+	* Total number of bytes fed into the hash so far.
+	*
+	* @returns The cumulative byte count across all update calls.
+	*/
+	get bytesProcessed() {
+		return this.totalLength;
+	}
+};
+/* v8 ignore start -- JavaScript fallback path, exercised by browser-mode tests */
+var JsSha1Hasher = class {
+	h0 = 1732584193;
+	h1 = 4023233417;
+	h2 = 2562383102;
+	h3 = 271733878;
+	h4 = 3285377520;
+	block = /* @__PURE__ */ new Uint8Array(64);
+	blockLength = 0;
+	bytesProcessed = 0;
+	digested = false;
+	words = /* @__PURE__ */ new Uint32Array(80);
+	update(data) {
+		if (this.digested) throw new Error("SHA-1 digest has already been finalized");
+		this.bytesProcessed += data.byteLength;
+		let offset = 0;
+		if (this.blockLength > 0) {
+			const toCopy = Math.min(64 - this.blockLength, data.byteLength);
+			this.block.set(data.subarray(0, toCopy), this.blockLength);
+			this.blockLength += toCopy;
+			offset = toCopy;
+			if (this.blockLength === 64) {
+				this.processBlock(this.block, 0);
+				this.blockLength = 0;
+			}
+		}
+		while (offset + 64 <= data.byteLength) {
+			this.processBlock(data, offset);
+			offset += 64;
+		}
+		if (offset < data.byteLength) {
+			this.block.set(data.subarray(offset), 0);
+			this.blockLength = data.byteLength - offset;
+		}
+	}
+	digest() {
+		if (this.digested) throw new Error("SHA-1 digest has already been finalized");
+		this.digested = true;
+		const bitLengthHigh = Math.floor(this.bytesProcessed / 536870912);
+		const bitLengthLow = this.bytesProcessed << 3 >>> 0;
+		this.block[this.blockLength] = 128;
+		this.blockLength++;
+		if (this.blockLength > 56) {
+			this.block.fill(0, this.blockLength, 64);
+			this.processBlock(this.block, 0);
+			this.blockLength = 0;
+		}
+		this.block.fill(0, this.blockLength, 56);
+		this.writeUint32(56, bitLengthHigh);
+		this.writeUint32(60, bitLengthLow);
+		this.processBlock(this.block, 0);
+		return wordToHex(this.h0) + wordToHex(this.h1) + wordToHex(this.h2) + wordToHex(this.h3) + wordToHex(this.h4);
+	}
+	writeUint32(offset, value) {
+		this.block[offset] = value >>> 24 & 255;
+		this.block[offset + 1] = value >>> 16 & 255;
+		this.block[offset + 2] = value >>> 8 & 255;
+		this.block[offset + 3] = value & 255;
+	}
+	processBlock(block, offset) {
+		const words = this.words;
+		for (let i = 0; i < 16; i++) {
+			const j = offset + i * 4;
+			words[i] = (block[j] ?? 0) << 24 | (block[j + 1] ?? 0) << 16 | (block[j + 2] ?? 0) << 8 | (block[j + 3] ?? 0);
+		}
+		for (let i = 16; i < 80; i++) words[i] = rotateLeft((words[i - 3] ?? 0) ^ (words[i - 8] ?? 0) ^ (words[i - 14] ?? 0) ^ (words[i - 16] ?? 0), 1);
+		let a = this.h0;
+		let b = this.h1;
+		let c = this.h2;
+		let d = this.h3;
+		let e = this.h4;
+		for (let i = 0; i < 80; i++) {
+			let f;
+			let k;
+			if (i < 20) {
+				f = b & c | ~b & d;
+				k = 1518500249;
+			} else if (i < 40) {
+				f = b ^ c ^ d;
+				k = 1859775393;
+			} else if (i < 60) {
+				f = b & c | b & d | c & d;
+				k = 2400959708;
+			} else {
+				f = b ^ c ^ d;
+				k = 3395469782;
+			}
+			const temp = rotateLeft(a, 5) + f + e + k + (words[i] ?? 0) >>> 0;
+			e = d;
+			d = c;
+			c = rotateLeft(b, 30);
+			b = a;
+			a = temp;
+		}
+		this.h0 = this.h0 + a >>> 0;
+		this.h1 = this.h1 + b >>> 0;
+		this.h2 = this.h2 + c >>> 0;
+		this.h3 = this.h3 + d >>> 0;
+		this.h4 = this.h4 + e >>> 0;
+	}
+};
+function rotateLeft(value, bits) {
+	return (value << bits | value >>> 32 - bits) >>> 0;
 }
-function hexEncode(bytes) {
-  const hex = [];
-  for (const b of bytes) {
-    hex.push(b.toString(16).padStart(2, "0"));
-  }
-  return hex.join("");
+function wordToHex(word) {
+	return word.toString(16).padStart(8, "0");
 }
+/* v8 ignore stop */
+/**
+* Compute the SHA-1 hex digest of a complete byte array in one shot.
+* @param data - The byte array to hash.
+*
+* @returns The lowercase hex-encoded SHA-1 digest of the input.
+*/
 async function sha1Hex(data) {
-  const factory = await getNodeCreateHash();
-  if (factory) {
-    const h = factory("sha1");
-    h.update(data);
-    return h.digest("hex");
-  }
-  const hashBuffer = await crypto.subtle.digest("SHA-1", data.buffer);
-  return hexEncode(new Uint8Array(hashBuffer));
+	const factory = await getNodeCreateHash();
+	if (factory) {
+		const h = factory("sha1");
+		h.update(data);
+		return h.digest("hex");
+	}
+	/* v8 ignore start -- WebCrypto fallback, only reachable when node:crypto is unavailable */
+	const hashBuffer = await crypto.subtle.digest("SHA-1", require_bytes.arrayBufferFor(data));
+	return require_crypto.hexEncode(new Uint8Array(hashBuffer));
+	/* v8 ignore stop */
 }
+//#endregion
 exports.IncrementalSha1 = IncrementalSha1;
 exports.sha1Hex = sha1Hex;
-//# sourceMappingURL=hash.cjs.map
+
+//# sourceMappingURL=hash.cjs.map