@danielsimonjr/mathts-core 0.12.0 → 0.13.0

package/dist/internal.d.ts

@@ -1090,6 +1090,15 @@ declare function reduce<T, U>(mat: T[] | Matrix<T>, dim: number, callback: (acc:
  */
 declare function scatter<T>(a: SparseMatrix<T>, j: number, w: number[], x: T[] | null, u: number[], mark: number, cindex: number[], f?: (a: T, b: T) => T, inverse?: boolean, update?: boolean, value?: T): void;
 
+/**
+ * Transpose a 2D array. Private helper used only by `core/src/collection.ts`'s
+ * `_reduce` (Bucket B slice 2 canonical) — mirrors `expression/src/utils/switch.ts`
+ * / `functions/src/utils/switch.ts`, which remain in place unchanged for now
+ * (not part of this slice's named scope). Not exported from `internal.ts`.
+ * @private
+ */
+declare function _switch<T>(mat: T[][]): T[][];
+
 /**
  * A map facade on a bare object.
  *
@@ -1237,4 +1246,100 @@ interface WasmManifest {
     [fileName: string]: string;
 }
 
-export { type BigNumberValue, type ConfigOptions, DEFAULT_CONFIG, DimensionError, FactoryFunction, type FormatOptions, type GeneralFormatOptions, type IdentifiedValue, Index, IndexError, type LoadingMetrics, type MathJsConfig, MathjsError, Matrix$1 as Matrix, type MemoizedFunction, type NestedArray, type NormalizedFormatOptions, type NumberTypeConfig, ObjectWrappingMap, PartitionedMap, type SplitValue, UnitConstructor, UnitDependencies, type WasmManifest, acosh, arraySize, asinh, assign as assignMap, atanh, broadcastArrays, broadcastSizes, broadcastTo, canDefineProperty, cbrt, checkBroadcastingRules, clone$1 as clone, clone as cloneArray, compareText, concat, containsCollections, copysign, cosh, createEmptyMap, createIndexError, createMap, createUnitClass, deepExtend, deepFlatten, deepForEach, deepForEach$1 as deepForEachArray, deepMap, deepMap$1 as deepMapArray, deepStrictEqual, digits, endsWith, escape, expm1, extend, filter, filterRegExp, flatten, forEach, format$2 as format, format as formatBigNumber, format$1 as formatGeneric, generalize, get$1 as get, getArrayDataType, get as getArrayElement, hasOwnProperty, identify, initial, isEmptyIndex, isInteger, isLegacyFactory, isObjectWrappingMap, isPowZeroAtInfinity, join, last, lazy, log10, log1p, log2, map, mapObject, memoize, nearlyEqual, normalizeFormatOptions, pick, pickShallow, processSizesWildcard, reduce, reshape, resize, roundDigits, safeNumberType, scatter, set, sign, sinh, splitNumber, squeeze, stretch, stringify, tanh, toEngineering$1 as toEngineering, toEngineering as toEngineeringBigNumber, toExponential$1 as toExponential, toExponential as toExponentialBigNumber, toFixed$1 as toFixed, toFixed as toFixedBigNumber, toObject, toPrecision, traverse, unitDependencies, unsqueeze, validate, validateIndex, validateIndexSourceSize, warnOnce };
+/**
+ * Shared WASM-loader runtime logic — SHA-384 integrity verification + packaged
+ * artifact path resolution — consolidated here so `functions` and `matrix` build
+ * on ONE copy instead of maintaining byte-identical forks.
+ *
+ * Why core: `matrix` cannot import from `functions` (functions depends on matrix,
+ * which would invert the edge and create a cycle), so the historical solution was
+ * to duplicate this logic in both packages. Both packages already depend on
+ * `core`, so `@danielsimonjr/mathts-core/internal` is a home reachable from both
+ * WITHOUT introducing a cycle. Exposed ONLY via the `/internal` subpath (never the
+ * browser-facing `.` entry); every filesystem/crypto access uses a LAZY dynamic
+ * `import()` so this module stays browser-safe (no static `node:` imports).
+ *
+ * SECURITY INVARIANT (CLAUDE.md "Security Invariants" #1): the SHA-384
+ * hash-and-compare-before-instantiate is preserved BYTE-FOR-BYTE from the former
+ * per-package `integrity.ts` copies — same algorithm, same fail-closed/soft-warn
+ * behavior. Do NOT bypass, weaken to a non-cryptographic check, or skip on
+ * streaming compile paths. Regression-covered by
+ * `functions/tests/security/wasm-integrity.test.ts` and
+ * `matrix/tests/security/wasm-integrity.test.ts`.
+ *
+ * The build pipeline writes a JSON manifest beside the .wasm artefact:
+ *
+ *   {
+ *     "mathts-as.wasm": "sha384-<base64-of-binary-digest>"
+ *   }
+ *
+ * At load time the runtime hashes the freshly read buffer with SHA-384 and
+ * compares against the manifest. A mismatch throws — preventing silent
+ * code-injection if the .wasm artefact is tampered with on disk or in transit
+ * (e.g. a CDN/MITM compromise).
+ *
+ * Browser path uses `crypto.subtle.digest('SHA-384', buf)`.
+ * Node path uses `crypto.createHash('sha384').update(buf).digest()`.
+ *
+ * If the manifest is missing or has no entry for the given file, we emit a
+ * console warning and fall through. This keeps existing unsigned builds usable
+ * while making signed builds tamper-evident.
+ *
+ * @module @danielsimonjr/mathts-core/internal (wasm-loader)
+ */
+
+/**
+ * Compute the SHA-384 digest of a buffer and return base64 encoding,
+ * prefixed with "sha384-" to match SRI conventions.
+ */
+declare function sha384OfBuffer(buffer: ArrayBuffer | Uint8Array): Promise<string>;
+/**
+ * Load the manifest sitting next to the .wasm artefact.
+ *
+ * @param wasmPath Resolved path or URL to the .wasm file.
+ * @returns parsed manifest, or `null` if the manifest cannot be located.
+ */
+declare function loadWasmManifest(wasmPath: string): Promise<WasmManifest | null>;
+/**
+ * Verify a freshly loaded WASM buffer against the manifest.
+ *
+ * @throws Error if the buffer's SHA-384 differs from the manifest entry.
+ */
+declare function verifyWasmIntegrity(buffer: ArrayBuffer | Uint8Array, wasmPath: string, options?: {
+    manifest?: WasmManifest | null;
+    required?: boolean;
+}): Promise<void>;
+/**
+ * Robustly locate a packaged `.wasm` artifact across both the monorepo-source
+ * layout and the published-package layout (Node only).
+ *
+ * The historical loaders hard-coded `../../../lib/wasm/<file>` relative to
+ * `import.meta.url`, which only resolved for the monorepo source layout and
+ * pointed outside the package once bundled/published — so the wasm was never
+ * found and every consumer silently fell back to JS. This walks up from the
+ * calling module's directory probing `<dir>/wasm/<file>` and
+ * `<dir>/dist/wasm/<file>` at each level, matching bundled dist, unbundled dist,
+ * and monorepo source.
+ *
+ * The caller injects its OWN `metaUrl` (its `import.meta.url`) so resolution is
+ * relative to the calling package, not to core.
+ *
+ * @returns absolute path to the artifact, or `null` if not found.
+ */
+declare function resolvePackagedWasm(metaUrl: string, wasmFile: string): Promise<string | null>;
+/**
+ * Canonical fallback location for the packaged wasm when {@link resolvePackagedWasm}
+ * finds nothing: `<packageRoot>/dist/wasm/<wasmFile>`, with the package root found
+ * by walking up from `metaUrl` to the nearest `package.json`. This replaces the
+ * historical `../../../lib/wasm/<file>` fabrication, which was only correct for the
+ * pre-bundling source layout. The returned path is where the binary SHOULD be, so
+ * the missing-binary warning tells the user exactly what to build.
+ *
+ * In browser mode (no filesystem) it returns the bundle-relative `./wasm/<file>`
+ * URL — correct for a served `dist/`, which is the only layout browsers see.
+ */
+declare function defaultWasmLocation(metaUrl: string, wasmFile: string, opts?: {
+    browser?: boolean;
+}): Promise<string>;
+
+export { type BigNumberValue, type ConfigOptions, DEFAULT_CONFIG, DimensionError, FactoryFunction, type FormatOptions, type GeneralFormatOptions, type IdentifiedValue, Index, IndexError, type LoadingMetrics, type MathJsConfig, MathjsError, Matrix$1 as Matrix, type MemoizedFunction, type NestedArray, type NormalizedFormatOptions, type NumberTypeConfig, ObjectWrappingMap, PartitionedMap, type SplitValue, UnitConstructor, UnitDependencies, type WasmManifest, _switch, acosh, arraySize, asinh, assign as assignMap, atanh, broadcastArrays, broadcastSizes, broadcastTo, canDefineProperty, cbrt, checkBroadcastingRules, clone$1 as clone, clone as cloneArray, compareText, concat, containsCollections, copysign, cosh, createEmptyMap, createIndexError, createMap, createUnitClass, deepExtend, deepFlatten, deepForEach, deepForEach$1 as deepForEachArray, deepMap, deepMap$1 as deepMapArray, deepStrictEqual, defaultWasmLocation, digits, endsWith, escape, expm1, extend, filter, filterRegExp, flatten, forEach, format$2 as format, format as formatBigNumber, format$1 as formatGeneric, generalize, get$1 as get, getArrayDataType, get as getArrayElement, hasOwnProperty, identify, initial, isEmptyIndex, isInteger, isLegacyFactory, isObjectWrappingMap, isPowZeroAtInfinity, join, last, lazy, loadWasmManifest, log10, log1p, log2, map, mapObject, memoize, nearlyEqual, normalizeFormatOptions, pick, pickShallow, processSizesWildcard, reduce, reshape, resize, resolvePackagedWasm, roundDigits, safeNumberType, scatter, set, sha384OfBuffer, sign, sinh, splitNumber, squeeze, stretch, stringify, tanh, toEngineering$1 as toEngineering, toEngineering as toEngineeringBigNumber, toExponential$1 as toExponential, toExponential as toExponentialBigNumber, toFixed$1 as toFixed, toFixed as toFixedBigNumber, toObject, toPrecision, traverse, unitDependencies, unsqueeze, validate, validateIndex, validateIndexSourceSize, verifyWasmIntegrity, warnOnce };

package/dist/internal.js

@@ -1352,6 +1352,114 @@ function isObjectWrappingMap(object) {
   const wrapper = object;
   return isObject(wrapper.wrappedObject);
 }
+
+// src/wasm-loader.ts
+var ALGO = "sha384";
+async function sha384OfBuffer(buffer) {
+  const bytes = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer);
+  const isNode = typeof process !== "undefined" && process.versions?.node !== void 0;
+  let digest;
+  if (isNode) {
+    const { createHash } = await import("crypto");
+    const hash = createHash(ALGO);
+    hash.update(bytes);
+    digest = new Uint8Array(hash.digest());
+  } else {
+    const copy = new ArrayBuffer(bytes.byteLength);
+    new Uint8Array(copy).set(bytes);
+    const out = await crypto.subtle.digest("SHA-384", copy);
+    digest = new Uint8Array(out);
+  }
+  let binary = "";
+  for (let i = 0; i < digest.length; i++) binary += String.fromCharCode(digest[i]);
+  const b64 = typeof btoa === "function" ? btoa(binary) : Buffer.from(digest).toString("base64");
+  return `sha384-${b64}`;
+}
+async function loadWasmManifest(wasmPath) {
+  const isNode = typeof process !== "undefined" && process.versions?.node !== void 0;
+  const manifestPath = wasmPath.replace(/[^/\\]+$/, "wasm-manifest.json");
+  try {
+    if (isNode) {
+      const fs = await import("fs");
+      const { promisify } = await import("util");
+      const readFile = promisify(fs.readFile);
+      const text = await readFile(manifestPath, "utf8");
+      return JSON.parse(text);
+    } else {
+      const res = await fetch(manifestPath);
+      if (!res.ok) return null;
+      return await res.json();
+    }
+  } catch {
+    return null;
+  }
+}
+async function verifyWasmIntegrity(buffer, wasmPath, options = {}) {
+  const fileName = wasmPath.split(/[/\\]/).pop() || wasmPath;
+  const manifest = options.manifest !== void 0 ? options.manifest : await loadWasmManifest(wasmPath);
+  if (!manifest) {
+    if (options.required) {
+      throw new Error(
+        `WASM integrity check failed: no manifest at sibling of "${wasmPath}" (required)`
+      );
+    }
+    if (typeof console !== "undefined") {
+      console.warn(
+        `[wasm-integrity] no manifest found beside "${wasmPath}"; skipping SHA-384 verification (set options.required=true to fail closed)`
+      );
+    }
+    return;
+  }
+  const expected = manifest[fileName];
+  if (!expected) {
+    if (options.required) {
+      throw new Error(`WASM integrity check failed: manifest has no entry for "${fileName}"`);
+    }
+    return;
+  }
+  const actual = await sha384OfBuffer(buffer);
+  if (actual !== expected) {
+    throw new Error(
+      `WASM integrity check failed for "${fileName}": expected ${expected}, got ${actual}`
+    );
+  }
+}
+async function resolvePackagedWasm(metaUrl, wasmFile) {
+  const isNode = typeof process !== "undefined" && process.versions?.node !== void 0;
+  if (!isNode) return null;
+  const { fileURLToPath } = await import("url");
+  const { dirname, join: join2 } = await import("path");
+  const { existsSync } = await import("fs");
+  let dir = dirname(fileURLToPath(metaUrl));
+  for (let depth = 0; depth < 8; depth++) {
+    const candidates = [join2(dir, "wasm", wasmFile), join2(dir, "dist", "wasm", wasmFile)];
+    for (const candidate of candidates) {
+      if (existsSync(candidate)) return candidate;
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+async function defaultWasmLocation(metaUrl, wasmFile, opts) {
+  if (opts?.browser) {
+    return new URL(`./wasm/${wasmFile}`, metaUrl).href;
+  }
+  const { fileURLToPath } = await import("url");
+  const { dirname, join: join2 } = await import("path");
+  const { existsSync } = await import("fs");
+  let dir = dirname(fileURLToPath(metaUrl));
+  for (let depth = 0; depth < 8; depth++) {
+    if (existsSync(join2(dir, "package.json"))) {
+      return join2(dir, "dist", "wasm", wasmFile);
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return join2(dirname(fileURLToPath(metaUrl)), "wasm", wasmFile);
+}
 export {
   Unit as CoreUnit,
   DEFAULT_CONFIG,
@@ -1360,6 +1468,7 @@ export {
   MathjsError,
   ObjectWrappingMap,
   PartitionedMap,
+  _switch,
   acosh,
   arraySize,
   asinh,
@@ -1391,6 +1500,7 @@ export {
   deepMap2 as deepMap,
   deepMap as deepMapArray,
   deepStrictEqual,
+  defaultWasmLocation,
   digits,
   endsWith,
   escape,
@@ -1443,6 +1553,7 @@ export {
   join,
   last,
   lazy,
+  loadWasmManifest,
   log10,
   log1p,
   log2,
@@ -1457,10 +1568,12 @@ export {
   reduce,
   reshape,
   resize,
+  resolvePackagedWasm,
   roundDigits,
   safeNumberType,
   scatter,
   set,
+  sha384OfBuffer,
   sign,
   sinh,
   sortFactories,
@@ -1485,5 +1598,6 @@ export {
   validate,
   validateIndex,
   validateIndexSourceSize,
+  verifyWasmIntegrity,
   warnOnce
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danielsimonjr/mathts-core",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Core types, utilities, and configuration for MathTS",
   "author": "Daniel Simon Jr.",
   "license": "MIT",