@cubingcenter/scrambler 0.7.0 → 0.8.0

package/dist/puzzles/pyraminx/solver/browser-loader.js

@@ -1,22 +1,42 @@
 import { PYRAMINX_SOLVER_TABLE_METADATA } from "./table-metadata.js";
 import { fetchTableBuffer as fetchCompressedTableBuffer } from "../../shared/compressed-fetch.js";
+const TABLES_DIR = "puzzles/pyraminx/solver/generated";
+const CACHE_NAME = "cubingcenter-scrambler-tables-v1";
 let cachedBrowserTables;
+let cachedBrowserTablesPromise;
 export function getCachedBrowserTables() {
     return cachedBrowserTables;
 }
 export function clearCachedBrowserTables() {
     cachedBrowserTables = undefined;
+    cachedBrowserTablesPromise = undefined;
 }
 export async function loadBrowserTables(baseUrl) {
     if (cachedBrowserTables)
         return cachedBrowserTables;
+    if (cachedBrowserTablesPromise) {
+        // One shared in-flight promise: concurrent calls trigger exactly one
+        // fetch pass (dedup).
+        return cachedBrowserTablesPromise;
+    }
+    const promise = fetchTables(baseUrl);
+    cachedBrowserTablesPromise = promise;
+    promise.then(() => { }, () => {
+        // A failed load must not poison the dedup slot: purge the rejected
+        // promise so a later call retries from scratch.
+        if (cachedBrowserTablesPromise === promise)
+            cachedBrowserTablesPromise = undefined;
+    });
+    return promise;
+}
+async function fetchTables(baseUrl) {
     const resolved = resolveBaseUrl(baseUrl);
     const manifest = await fetchManifest(resolved);
     const [centersTable, permutationTable, orientationTable, policyTable] = await Promise.all([
-        fetchUint8Table(resolved, manifest.files.centersTable, PYRAMINX_SOLVER_TABLE_METADATA.centersTable.entries),
-        fetchUint16Table(resolved, manifest.files.permutationTable, PYRAMINX_SOLVER_TABLE_METADATA.permutationTable.entries),
-        fetchUint8Table(resolved, manifest.files.orientationTable, PYRAMINX_SOLVER_TABLE_METADATA.orientationTable.entries),
-        fetchUint8Table(resolved, manifest.files.policyTable, PYRAMINX_SOLVER_TABLE_METADATA.policyTable.entries)
+        fetchUint8Table(resolved, manifest.files.centersTable, PYRAMINX_SOLVER_TABLE_METADATA.centersTable),
+        fetchUint16Table(resolved, manifest.files.permutationTable, PYRAMINX_SOLVER_TABLE_METADATA.permutationTable),
+        fetchUint8Table(resolved, manifest.files.orientationTable, PYRAMINX_SOLVER_TABLE_METADATA.orientationTable),
+        fetchUint8Table(resolved, manifest.files.policyTable, PYRAMINX_SOLVER_TABLE_METADATA.policyTable)
     ]);
     cachedBrowserTables = { centersTable, permutationTable, orientationTable, policyTable };
     return cachedBrowserTables;
@@ -43,19 +63,28 @@ async function fetchManifest(baseUrl) {
         throw new Error(`Unsupported pyraminx solver table manifest version: ${manifest.version}`);
     return manifest;
 }
-const TABLES_DIR = "puzzles/pyraminx/solver/generated";
-const CACHE_NAME = "cubingcenter-scrambler-tables-v1";
-async function fetchUint8Table(baseUrl, entry, expectedEntries) {
-    const buffer = await fetchCompressedTableBuffer(baseUrl, TABLES_DIR, entry.file, { cacheName: CACHE_NAME, compressed: entry.compressed !== false });
-    if (buffer.byteLength !== expectedEntries)
-        throw new Error(`Invalid byte size for ${entry.file}`);
+/**
+ * Fetch + verify with the SAME checks as node-loader.ts: byte length from
+ * the manifest entries, FNV-1a checksum against the table-metadata
+ * constants (the values node asserts against).
+ */
+async function fetchUint8Table(baseUrl, entry, meta) {
+    const buffer = await fetchCompressedTableBuffer(baseUrl, TABLES_DIR, entry.file, {
+        cacheName: CACHE_NAME,
+        compressed: entry.compressed !== false,
+        expectedBytes: entry.entries,
+        expectedFnv1a: { value: meta.checksum, elementSize: 1 }
+    });
     return new Uint8Array(buffer);
 }
-async function fetchUint16Table(baseUrl, entry, expectedEntries) {
-    const buffer = await fetchCompressedTableBuffer(baseUrl, TABLES_DIR, entry.file, { cacheName: CACHE_NAME, compressed: entry.compressed !== false });
-    if (buffer.byteLength !== expectedEntries * 2)
-        throw new Error(`Invalid byte size for ${entry.file}`);
-    const values = new Uint16Array(expectedEntries);
+async function fetchUint16Table(baseUrl, entry, meta) {
+    const buffer = await fetchCompressedTableBuffer(baseUrl, TABLES_DIR, entry.file, {
+        cacheName: CACHE_NAME,
+        compressed: entry.compressed !== false,
+        expectedBytes: entry.entries * 2,
+        expectedFnv1a: { value: meta.checksum, elementSize: 2 }
+    });
+    const values = new Uint16Array(entry.entries);
     const view = new DataView(buffer);
     for (let i = 0; i < values.length; i++)
         values[i] = view.getUint16(i * 2, true);

package/dist/puzzles/pyraminx/solver/generated-assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generated-assets.d.ts","sourceRoot":"","sources":["../../../../src/puzzles/pyraminx/solver/generated-assets.ts"],"names":[],"mappings":"AAaA,wBAAsB,iCAAiC,IAAI,OAAO,CAAC;IACjE,YAAY,EAAE,UAAU,CAAC;IACzB,gBAAgB,EAAE,WAAW,CAAC;IAC9B,gBAAgB,EAAE,UAAU,CAAC;IAC7B,WAAW,EAAE,UAAU,CAAC;CACzB,CAAC,CAYD"}
+{"version":3,"file":"generated-assets.d.ts","sourceRoot":"","sources":["../../../../src/puzzles/pyraminx/solver/generated-assets.ts"],"names":[],"mappings":"AAmBA,wBAAsB,iCAAiC,IAAI,OAAO,CAAC;IACjE,YAAY,EAAE,UAAU,CAAC;IACzB,gBAAgB,EAAE,WAAW,CAAC;IAC9B,gBAAgB,EAAE,UAAU,CAAC;IAC7B,WAAW,EAAE,UAAU,CAAC;CACzB,CAAC,CAWD"}

package/dist/puzzles/pyraminx/solver/generated-assets.js

@@ -1,5 +1,11 @@
 import { getCachedBrowserTables } from "./browser-loader.js";
-let cachedTables;
+import { loadOnce } from "../../shared/load-once.js";
+// One shared in-flight promise for the node fs load (same pattern as
+// cube3/solver/generated-assets.ts): the previous `cached ??= await …` raced —
+// concurrent callers interleaving on the await both ran `loadNodeTables()`
+// (two filesystem reads, last assignment wins). On rejection the slot is
+// purged so the next call can retry.
+const nodeTablesSlot = { promise: undefined };
 function isBrowser() {
     return typeof self !== "undefined";
 }
@@ -12,8 +18,7 @@ export async function loadGeneratedPyraminxSolverTables() {
             "In browser environments, call `initializeScrambler(baseUrl)` " +
             "before generating scrambles.");
     }
-    cachedTables ??= await loadNodeTables();
-    return cachedTables;
+    return loadOnce(nodeTablesSlot, loadNodeTables);
 }
 async function loadNodeTables() {
     const loader = await import(

package/dist/puzzles/shared/compressed-fetch.d.ts

@@ -1,5 +1,19 @@
+/** FNV-1a expectations from the legacy (non-sha256) manifests. */
+export interface ExpectedFnv1a {
+    /** FNV-1a 32-bit checksum (`>>> 0`) over the decoded numeric sequence. */
+    value: number;
+    /**
+     * Wire size of each hashed element: 1 = byte, 2 = uint16 LE, 4 = int32 LE.
+     * Mirrors how each node loader decodes values before hashing (`4` also
+     * covers the 3x3 int32 move tables: their hashed uint16 values are the
+     * same numbers, and XOR/`Math.imul` are sign-insensitive there).
+     */
+    elementSize: 1 | 2 | 4;
+    /** Hash 1-byte elements as signed int8 (Square-1's int8 tables). */
+    signed?: boolean;
+}
 export interface FetchTableBufferOptions {
-    /** Cache API cache name to store responses in (used by cube3). */
+    /** Cache API cache name to store responses in (used by all table loaders). */
     cacheName?: string;
     /**
      * Whether the manifest advertises precompressed variants for this file.
@@ -7,6 +21,28 @@ export interface FetchTableBufferOptions {
      * set to false to skip .br/.gz attempts entirely.
      */
     compressed?: boolean;
+    /**
+     * sha256 hex digest of the UNCOMPRESSED file (from its manifest entry).
+     * Verified after decompression; a mismatch rejects with the file URL.
+     */
+    expectedSha256?: string;
+    /** Exact byte length of the uncompressed file (from its manifest entry). */
+    expectedBytes?: number;
+    /**
+     * FNV-1a checksum from legacy manifests (cube2/cube3/pyraminx/skewb/sq1).
+     * Verified after the length check; a mismatch rejects with the file URL.
+     */
+    expectedFnv1a?: ExpectedFnv1a;
 }
 export declare function fetchTableBuffer(baseUrl: string, dir: string, file: string, options?: FetchTableBufferOptions): Promise<ArrayBuffer>;
+/**
+ * FNV-1a (32-bit) over the elements decoded from a wire buffer: the browser
+ * twin of the node loaders' `checksum(values)` (imul multiply, `>>> 0`
+ * result). `elementSize` mirrors each loader's decoding of the manifest
+ * checksum — see `ExpectedFnv1a`.
+ */
+export declare function fnv1a32(buffer: ArrayBuffer, elementSize: 1 | 2 | 4, signed?: boolean): number;
+/** sha256 hex of a buffer; WebCrypto when available, portable JS fallback otherwise. */
+export declare function sha256Hex(buffer: ArrayBuffer): Promise<string>;
+export declare function sha256HexJs(buffer: ArrayBuffer): string;
 //# sourceMappingURL=compressed-fetch.d.ts.map

package/dist/puzzles/shared/compressed-fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compressed-fetch.d.ts","sourceRoot":"","sources":["../../../src/puzzles/shared/compressed-fetch.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,uBAAuB;IACtC,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAkBD,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,WAAW,CAAC,CAuBtB"}
+{"version":3,"file":"compressed-fetch.d.ts","sourceRoot":"","sources":["../../../src/puzzles/shared/compressed-fetch.ts"],"names":[],"mappings":"AAeA,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,WAAW,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,oEAAoE;IACpE,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAkBD,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,WAAW,CAAC,CAyDtB;AAmCD;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,UAAQ,GAAG,MAAM,CAgB3F;AAED,wFAAwF;AACxF,wBAAsB,SAAS,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAYpE;AAcD,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAmEvD"}

package/dist/puzzles/shared/compressed-fetch.js

@@ -4,6 +4,14 @@
 //
 // Node never uses this module: node-loader.ts reads the .bin files directly
 // from the filesystem.
+//
+// Integrity: callers can pass the manifest's expectations — sha256 + byte
+// length (4x4 manifests) or the FNV-1a32 checksums the older manifests ship
+// — and every check runs on the FINAL (decompressed) bytes, i.e. exactly the
+// .bin payload: identical checks to the node loaders. A payload served by
+// the Cache API that fails verification is purged (`cache.delete`) and
+// re-downloaded exactly once, so a corrupt cache entry heals instead of
+// failing every load forever.
 // DecompressionStream only guarantees "gzip"/"deflate"; "br" support varies,
 // so probe once and never attempt formats the runtime cannot decompress.
 const SUPPORTED_FORMATS = (() => {
@@ -23,46 +31,233 @@ const SUPPORTED_FORMATS = (() => {
 })();
 export async function fetchTableBuffer(baseUrl, dir, file, options = {}) {
     const urlFor = (name) => `${baseUrl}/${dir}/${name}`;
-    const cachedFetch = options.cacheName === undefined ? undefined : makeCachedFetch(options.cacheName);
-    if (options.compressed !== false && SUPPORTED_FORMATS.length > 0) {
-        for (const [suffix, format] of SUPPORTED_FORMATS) {
-            try {
-                const response = await (cachedFetch ? cachedFetch(urlFor(`${file}.${suffix}`)) : fetch(urlFor(`${file}.${suffix}`)));
-                if (response.ok && response.body) {
-                    const stream = response.body.pipeThrough(new DecompressionStream(format));
-                    return await new Response(stream).arrayBuffer();
+    const canonicalUrl = urlFor(file);
+    const cache = options.cacheName === undefined ? undefined : makeCacheChannel(options.cacheName);
+    // Cache API URLs that served the current download attempt; when the
+    // payload fails verification they are purged before the single retry.
+    let servedFromCache = [];
+    const get = async (url) => {
+        if (!cache)
+            return fetch(url);
+        const { response, fromCache } = await cache.fetch(url);
+        if (fromCache)
+            servedFromCache.push(url);
+        return response;
+    };
+    const download = async () => {
+        servedFromCache = [];
+        if (options.compressed !== false && SUPPORTED_FORMATS.length > 0) {
+            for (const [suffix, format] of SUPPORTED_FORMATS) {
+                try {
+                    const response = await get(urlFor(`${file}.${suffix}`));
+                    if (response.ok && response.body) {
+                        const stream = response.body.pipeThrough(new DecompressionStream(format));
+                        return await new Response(stream).arrayBuffer();
+                    }
+                }
+                catch {
+                    // try the next candidate
                 }
             }
-            catch {
-                // try the next candidate
-            }
         }
+        const response = await get(canonicalUrl);
+        if (!response.ok) {
+            throw new Error(`Failed to load table ${canonicalUrl}: ${response.status} ${response.statusText}` +
+                (options.expectedBytes !== undefined ? ` (expected ${options.expectedBytes} bytes)` : ""));
+        }
+        return response.arrayBuffer();
+    };
+    let buffer = await download();
+    try {
+        await verifyTableBuffer(buffer, canonicalUrl, options);
     }
-    const response = await (cachedFetch ? cachedFetch(urlFor(file)) : fetch(urlFor(file)));
-    if (!response.ok) {
-        throw new Error(`Failed to load ${file}: ${response.status} ${response.statusText}`);
+    catch (error) {
+        // A corrupt Cache API entry fails every load until it is purged: delete
+        // the cached copies that served this attempt and re-download exactly
+        // ONCE. A second verification failure (or a payload that never came
+        // from the cache) propagates unchanged.
+        if (!cache || servedFromCache.length === 0)
+            throw error;
+        await cache.purge(servedFromCache);
+        buffer = await download();
+        await verifyTableBuffer(buffer, canonicalUrl, options);
     }
-    return response.arrayBuffer();
+    return buffer;
 }
-function makeCachedFetch(cacheName) {
-    return async (url) => {
-        if (typeof caches === "undefined") {
-            return fetch(url);
+/**
+ * Verify the downloaded payload against the manifest: byte length first
+ * (clearer truncation messages), then sha256 / FNV-1a. Runs on the
+ * decompressed bytes, so .br/.gz variants and the raw file are checked
+ * identically — and identically to the node loaders.
+ */
+async function verifyTableBuffer(buffer, url, options) {
+    if (options.expectedBytes !== undefined && buffer.byteLength !== options.expectedBytes) {
+        throw new Error(`Table size mismatch: ${url} (expected ${options.expectedBytes} bytes, got ${buffer.byteLength})`);
+    }
+    if (options.expectedSha256 !== undefined) {
+        const actual = await sha256Hex(buffer);
+        if (actual !== options.expectedSha256) {
+            throw new Error(`Table checksum mismatch: ${url} (expected sha256 ${options.expectedSha256}, got ${actual}, ${buffer.byteLength} bytes)`);
         }
-        try {
-            const cache = await caches.open(cacheName);
-            const cached = await cache.match(url);
-            if (cached) {
-                return cached;
+    }
+    if (options.expectedFnv1a !== undefined) {
+        const spec = options.expectedFnv1a;
+        const actual = fnv1a32(buffer, spec.elementSize, spec.signed ?? false);
+        if (actual !== spec.value) {
+            throw new Error(`Table checksum mismatch: ${url} (expected fnv1a ${spec.value}, got ${actual}, ${buffer.byteLength} bytes)`);
+        }
+    }
+}
+/**
+ * FNV-1a (32-bit) over the elements decoded from a wire buffer: the browser
+ * twin of the node loaders' `checksum(values)` (imul multiply, `>>> 0`
+ * result). `elementSize` mirrors each loader's decoding of the manifest
+ * checksum — see `ExpectedFnv1a`.
+ */
+export function fnv1a32(buffer, elementSize, signed = false) {
+    if (buffer.byteLength % elementSize !== 0) {
+        throw new Error(`FNV-1a input length ${buffer.byteLength} is not a multiple of ${elementSize}-byte elements`);
+    }
+    let hash = 0x811c9dc5;
+    const view = new DataView(buffer);
+    const count = buffer.byteLength / elementSize;
+    for (let index = 0; index < count; index += 1) {
+        let value;
+        if (elementSize === 1)
+            value = signed ? view.getInt8(index) : view.getUint8(index);
+        else if (elementSize === 2)
+            value = view.getUint16(index * 2, true);
+        else
+            value = view.getInt32(index * 4, true);
+        hash ^= value;
+        hash = Math.imul(hash, 0x01000193);
+    }
+    return hash >>> 0;
+}
+/** sha256 hex of a buffer; WebCrypto when available, portable JS fallback otherwise. */
+export async function sha256Hex(buffer) {
+    const subtle = globalThis.crypto?.subtle;
+    if (subtle) {
+        const digest = await subtle.digest("SHA-256", buffer);
+        const bytes = new Uint8Array(digest);
+        let hex = "";
+        for (let i = 0; i < bytes.length; i++)
+            hex += bytes[i].toString(16).padStart(2, "0");
+        return hex;
+    }
+    // Insecure contexts expose no SubtleCrypto; keep integrity checks working
+    // with a self-contained implementation instead of skipping verification.
+    return sha256HexJs(buffer);
+}
+// FIPS 180-4 SHA-256, used only when `crypto.subtle` is unavailable.
+const SHA256_K = new Uint32Array([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
+]);
+export function sha256HexJs(buffer) {
+    const bytes = new Uint8Array(buffer);
+    const paddedLength = (bytes.length + 72) & ~63;
+    const data = new Uint8Array(paddedLength);
+    data.set(bytes);
+    data[bytes.length] = 0x80;
+    const view = new DataView(data.buffer);
+    view.setUint32(paddedLength - 8, Math.floor(bytes.length / 0x20000000));
+    view.setUint32(paddedLength - 4, (bytes.length << 3) >>> 0);
+    let h0 = 0x6a09e667;
+    let h1 = 0xbb67ae85;
+    let h2 = 0x3c6ef372;
+    let h3 = 0xa54ff53a;
+    let h4 = 0x510e527f;
+    let h5 = 0x9b05688c;
+    let h6 = 0x1f83d9ab;
+    let h7 = 0x5be0cd19;
+    const w = new Int32Array(64);
+    for (let offset = 0; offset < paddedLength; offset += 64) {
+        for (let i = 0; i < 16; i += 1)
+            w[i] = view.getInt32(offset + i * 4);
+        for (let i = 16; i < 64; i += 1) {
+            const w15 = w[i - 15];
+            const w2 = w[i - 2];
+            const s0 = ((w15 >>> 7) | (w15 << 25)) ^ ((w15 >>> 18) | (w15 << 14)) ^ (w15 >>> 3);
+            const s1 = ((w2 >>> 17) | (w2 << 15)) ^ ((w2 >>> 19) | (w2 << 13)) ^ (w2 >>> 10);
+            w[i] = (w[i - 16] + s0 + w[i - 7] + s1) | 0;
+        }
+        let a = h0;
+        let b = h1;
+        let c = h2;
+        let d = h3;
+        let e = h4;
+        let f = h5;
+        let g = h6;
+        let h = h7;
+        for (let i = 0; i < 64; i += 1) {
+            const s1 = ((e >>> 6) | (e << 26)) ^ ((e >>> 11) | (e << 21)) ^ ((e >>> 25) | (e << 7));
+            const ch = (e & f) ^ (~e & g);
+            const t1 = (h + s1 + ch + SHA256_K[i] + w[i]) | 0;
+            const s0 = ((a >>> 2) | (a << 30)) ^ ((a >>> 13) | (a << 19)) ^ ((a >>> 22) | (a << 10));
+            const maj = (a & b) ^ (a & c) ^ (b & c);
+            const t2 = (s0 + maj) | 0;
+            h = g;
+            g = f;
+            f = e;
+            e = (d + t1) | 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (t1 + t2) | 0;
+        }
+        h0 = (h0 + a) | 0;
+        h1 = (h1 + b) | 0;
+        h2 = (h2 + c) | 0;
+        h3 = (h3 + d) | 0;
+        h4 = (h4 + e) | 0;
+        h5 = (h5 + f) | 0;
+        h6 = (h6 + g) | 0;
+        h7 = (h7 + h) | 0;
+    }
+    return [h0, h1, h2, h3, h4, h5, h6, h7]
+        .map((x) => (x >>> 0).toString(16).padStart(8, "0"))
+        .join("");
+}
+function makeCacheChannel(cacheName) {
+    if (typeof caches === "undefined") {
+        return undefined;
+    }
+    return {
+        async fetch(url) {
+            try {
+                const cache = await caches.open(cacheName);
+                const cached = await cache.match(url);
+                if (cached) {
+                    return { response: cached, fromCache: true };
+                }
+                const response = await fetch(url);
+                if (response.ok) {
+                    await cache.put(url, response.clone());
+                }
+                return { response, fromCache: false };
             }
-            const response = await fetch(url);
-            if (response.ok) {
-                await cache.put(url, response.clone());
+            catch {
+                return { response: await fetch(url), fromCache: false };
+            }
+        },
+        async purge(urls) {
+            try {
+                const cache = await caches.open(cacheName);
+                for (const url of urls) {
+                    await cache.delete(url);
+                }
+            }
+            catch {
+                // Best effort: a failed purge must not mask the verification error
+                // that triggered it — the load still fails loudly either way.
             }
-            return response;
-        }
-        catch {
-            return fetch(url);
         }
     };
 }

package/dist/puzzles/shared/load-once.d.ts

@@ -0,0 +1,16 @@
+/**
+ * One-in-flight-promise helper: concurrent cold calls share ONE underlying
+ * load (a single filesystem read / browser fetch pass) instead of racing
+ * several loads and clobbering each other's results. On rejection the slot
+ * is purged so the next call can retry — a failure is never cached forever.
+ *
+ * Used by `cube3/solver/tables.ts` (phase-1 / phase-2 / solver slots) and
+ * `cube3/solver/generated-assets.ts` (the node fs load: a plain
+ * `cached ??= await …` re-reads the filesystem when two callers — e.g. mixed
+ * phase-1 + phase-2 loads — interleave on the `await`).
+ */
+export interface LoadOnceSlot<T> {
+    promise: Promise<T> | undefined;
+}
+export declare function loadOnce<T>(slot: LoadOnceSlot<T>, load: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=load-once.d.ts.map

package/dist/puzzles/shared/load-once.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-once.d.ts","sourceRoot":"","sources":["../../../src/puzzles/shared/load-once.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY,CAAC,CAAC;IAC7B,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;CACjC;AAED,wBAAgB,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CASrF"}

package/dist/puzzles/shared/load-once.js

@@ -0,0 +1,11 @@
+export function loadOnce(slot, load) {
+    if (!slot.promise) {
+        const wrapped = load().catch((error) => {
+            if (slot.promise === wrapped)
+                slot.promise = undefined;
+            throw error;
+        });
+        slot.promise = wrapped;
+    }
+    return slot.promise;
+}

package/dist/puzzles/skewb/solver/browser-loader.d.ts

@@ -1,4 +1,4 @@
-export declare function getCachedBrowserTables(): {
+export interface SkewbBrowserTables {
     permutationTable: Uint16Array;
     orientationTable: Uint16Array;
     centersTable: Uint16Array;
@@ -6,15 +6,8 @@ export declare function getCachedBrowserTables(): {
     evenCenterRank: Uint16Array;
     orientClass: Uint8Array;
     r7Sets: Uint16Array;
-} | undefined;
+}
+export declare function getCachedBrowserTables(): SkewbBrowserTables | undefined;
 export declare function clearCachedBrowserTables(): void;
-export declare function loadBrowserTables(baseUrl?: string): Promise<{
-    permutationTable: Uint16Array;
-    orientationTable: Uint16Array;
-    centersTable: Uint16Array;
-    policyTable: Uint8Array;
-    evenCenterRank: Uint16Array;
-    orientClass: Uint8Array;
-    r7Sets: Uint16Array;
-}>;
+export declare function loadBrowserTables(baseUrl?: string): Promise<SkewbBrowserTables>;
 //# sourceMappingURL=browser-loader.d.ts.map

package/dist/puzzles/skewb/solver/browser-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser-loader.d.ts","sourceRoot":"","sources":["../../../../src/puzzles/skewb/solver/browser-loader.ts"],"names":[],"mappings":"AAeA,wBAAgB,sBAAsB;sBATlB,WAAW;sBACX,WAAW;kBACf,WAAW;iBACZ,UAAU;oBACP,WAAW;iBACd,UAAU;YACf,WAAW;cAKpB;AAED,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAED,wBAAsB,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACjE,gBAAgB,EAAE,WAAW,CAAC;IAC9B,gBAAgB,EAAE,WAAW,CAAC;IAC9B,YAAY,EAAE,WAAW,CAAC;IAC1B,WAAW,EAAE,UAAU,CAAC;IACxB,cAAc,EAAE,WAAW,CAAC;IAC5B,WAAW,EAAE,UAAU,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC,CAwCD"}
+{"version":3,"file":"browser-loader.d.ts","sourceRoot":"","sources":["../../../../src/puzzles/skewb/solver/browser-loader.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,WAAW,CAAC;IAC9B,gBAAgB,EAAE,WAAW,CAAC;IAC9B,YAAY,EAAE,WAAW,CAAC;IAC1B,WAAW,EAAE,UAAU,CAAC;IACxB,cAAc,EAAE,WAAW,CAAC;IAC5B,WAAW,EAAE,UAAU,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;CACrB;AAKD,wBAAgB,sBAAsB,IAAI,kBAAkB,GAAG,SAAS,CAEvE;AAED,wBAAgB,wBAAwB,IAAI,IAAI,CAG/C;AAED,wBAAsB,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAoBrF"}

package/dist/puzzles/skewb/solver/browser-loader.js

@@ -1,25 +1,44 @@
 import { SKEWB_SOLVER_TABLE_METADATA } from "./table-metadata.js";
 import { fetchTableBuffer } from "../../shared/compressed-fetch.js";
 const TABLES_DIR = "puzzles/skewb/solver/generated";
+const CACHE_NAME = "cubingcenter-scrambler-tables-v1";
 let cachedBrowserTables;
+let cachedBrowserTablesPromise;
 export function getCachedBrowserTables() {
     return cachedBrowserTables;
 }
 export function clearCachedBrowserTables() {
     cachedBrowserTables = undefined;
+    cachedBrowserTablesPromise = undefined;
 }
 export async function loadBrowserTables(baseUrl) {
     if (cachedBrowserTables) {
         return cachedBrowserTables;
     }
+    if (cachedBrowserTablesPromise) {
+        // One shared in-flight promise: concurrent calls trigger exactly one
+        // fetch pass (dedup).
+        return cachedBrowserTablesPromise;
+    }
+    const promise = fetchTables(baseUrl);
+    cachedBrowserTablesPromise = promise;
+    promise.then(() => { }, () => {
+        // A failed load must not poison the dedup slot: purge the rejected
+        // promise so a later call retries from scratch.
+        if (cachedBrowserTablesPromise === promise)
+            cachedBrowserTablesPromise = undefined;
+    });
+    return promise;
+}
+async function fetchTables(baseUrl) {
     const resolved = resolveBaseUrl(baseUrl);
     const manifest = await fetchManifest(resolved);
     const [permTable, orientTable, centersTable, helpers, policy] = await Promise.all([
-        fetchUint16Table(resolved, manifest.files.permutationTable, SKEWB_SOLVER_TABLE_METADATA.permutationTable.entries),
-        fetchUint16Table(resolved, manifest.files.orientationTable, SKEWB_SOLVER_TABLE_METADATA.orientationTable.entries),
-        fetchUint16Table(resolved, manifest.files.centersTable, SKEWB_SOLVER_TABLE_METADATA.centersTable.entries),
-        fetchUint8Table(resolved, manifest.files.helpers, SKEWB_SOLVER_TABLE_METADATA.helpers.entries),
-        fetchUint8Table(resolved, manifest.files.policyTable, SKEWB_SOLVER_TABLE_METADATA.policyTable.entries)
+        fetchUint16Table(resolved, manifest.files.permutationTable, SKEWB_SOLVER_TABLE_METADATA.permutationTable),
+        fetchUint16Table(resolved, manifest.files.orientationTable, SKEWB_SOLVER_TABLE_METADATA.orientationTable),
+        fetchUint16Table(resolved, manifest.files.centersTable, SKEWB_SOLVER_TABLE_METADATA.centersTable),
+        fetchUint8Table(resolved, manifest.files.helpers, SKEWB_SOLVER_TABLE_METADATA.helpers),
+        fetchUint8Table(resolved, manifest.files.policyTable, SKEWB_SOLVER_TABLE_METADATA.policyTable)
     ]);
     const helpersOffset = SKEWB_SOLVER_TABLE_METADATA.helpers;
     const evenCenterRank = new Uint16Array(helpersOffset.evenCenterRankBytes / 2);
@@ -65,22 +84,31 @@ async function fetchManifest(baseUrl) {
     }
     return await response.json();
 }
-async function fetchUint16Table(baseUrl, entry, expectedEntries) {
-    const buffer = await fetchTableBuffer(baseUrl, TABLES_DIR, entry.file, { compressed: entry.compressed !== false });
-    if (buffer.byteLength !== expectedEntries * 2) {
-        throw new Error(`Invalid byte size for ${entry.file}`);
-    }
-    const values = new Uint16Array(expectedEntries);
+/**
+ * Fetch + verify with the SAME checks as node-loader.ts: byte length from
+ * the manifest entries, FNV-1a checksum against the table-metadata
+ * constants (the values node asserts against).
+ */
+async function fetchUint16Table(baseUrl, entry, meta) {
+    const buffer = await fetchTableBuffer(baseUrl, TABLES_DIR, entry.file, {
+        cacheName: CACHE_NAME,
+        compressed: entry.compressed !== false,
+        expectedBytes: entry.entries * 2,
+        expectedFnv1a: { value: meta.checksum, elementSize: 2 }
+    });
+    const values = new Uint16Array(entry.entries);
     const view = new DataView(buffer);
     for (let i = 0; i < values.length; i++) {
         values[i] = view.getUint16(i * 2, true);
     }
     return values;
 }
-async function fetchUint8Table(baseUrl, entry, expectedEntries) {
-    const buffer = await fetchTableBuffer(baseUrl, TABLES_DIR, entry.file, { compressed: entry.compressed !== false });
-    if (buffer.byteLength !== expectedEntries) {
-        throw new Error(`Invalid byte size for ${entry.file}`);
-    }
+async function fetchUint8Table(baseUrl, entry, meta) {
+    const buffer = await fetchTableBuffer(baseUrl, TABLES_DIR, entry.file, {
+        cacheName: CACHE_NAME,
+        compressed: entry.compressed !== false,
+        expectedBytes: entry.entries,
+        expectedFnv1a: { value: meta.checksum, elementSize: 1 }
+    });
     return new Uint8Array(buffer);
 }

package/dist/puzzles/skewb/solver/generated-assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generated-assets.d.ts","sourceRoot":"","sources":["../../../../src/puzzles/skewb/solver/generated-assets.ts"],"names":[],"mappings":"AAgBA,wBAAsB,8BAA8B,IAAI,OAAO,CAAC;IAC9D,gBAAgB,EAAE,WAAW,CAAC;IAC9B,gBAAgB,EAAE,WAAW,CAAC;IAC9B,YAAY,EAAE,WAAW,CAAC;IAC1B,WAAW,EAAE,UAAU,CAAC;IACxB,cAAc,EAAE,WAAW,CAAC;IAC5B,WAAW,EAAE,UAAU,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC,CAYD"}
+{"version":3,"file":"generated-assets.d.ts","sourceRoot":"","sources":["../../../../src/puzzles/skewb/solver/generated-assets.ts"],"names":[],"mappings":"AAsBA,wBAAsB,8BAA8B,IAAI,OAAO,CAAC;IAC9D,gBAAgB,EAAE,WAAW,CAAC;IAC9B,gBAAgB,EAAE,WAAW,CAAC;IAC9B,YAAY,EAAE,WAAW,CAAC;IAC1B,WAAW,EAAE,UAAU,CAAC;IACxB,cAAc,EAAE,WAAW,CAAC;IAC5B,WAAW,EAAE,UAAU,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC,CAWD"}

package/dist/puzzles/skewb/solver/generated-assets.js

@@ -1,5 +1,11 @@
 import { getCachedBrowserTables } from "./browser-loader.js";
-let cachedTables;
+import { loadOnce } from "../../shared/load-once.js";
+// One shared in-flight promise for the node fs load (same pattern as
+// cube3/solver/generated-assets.ts): the previous `cached ??= await …` raced —
+// concurrent callers interleaving on the await both ran `loadNodeTables()`
+// (two filesystem reads, last assignment wins). On rejection the slot is
+// purged so the next call can retry.
+const nodeTablesSlot = { promise: undefined };
 function isBrowser() {
     return typeof self !== "undefined";
 }
@@ -12,8 +18,7 @@ export async function loadGeneratedSkewbSolverTables() {
             "In browser environments, call `initializeScrambler(baseUrl)` " +
             "before generating scrambles.");
     }
-    cachedTables ??= await loadNodeTables();
-    return cachedTables;
+    return loadOnce(nodeTablesSlot, loadNodeTables);
 }
 async function loadNodeTables() {
     const loader = await import(

package/dist/puzzles/sq1/solver/browser-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser-loader.d.ts","sourceRoot":"","sources":["../../../../src/puzzles/sq1/solver/browser-loader.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAMvD,wBAAgB,sBAAsB,IAAI,mBAAmB,GAAG,SAAS,CAExE;AAED,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAED,wBAAsB,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA2CtF"}
+{"version":3,"file":"browser-loader.d.ts","sourceRoot":"","sources":["../../../../src/puzzles/sq1/solver/browser-loader.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAQvD,wBAAgB,sBAAsB,IAAI,mBAAmB,GAAG,SAAS,CAExE;AAED,wBAAgB,wBAAwB,IAAI,IAAI,CAG/C;AAED,wBAAsB,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAoBtF"}