@xanots/sdk 0.0.10 → 0.0.12

package/dist/{chunk-LBYWGMOA.js → chunk-N74KDCBD.js}

@@ -2,7 +2,17 @@ import {
   assertPathParamInputs,
   fillPathParams,
   parsePathParams
-} from "./chunk-WHOJWOSV.js";
+} from "./chunk-EETVJZAZ.js";
+import {
+  appNamesByGuid,
+  deriveGuid,
+  deriveQueryGuid,
+  getLockedCanonical,
+  lockKey,
+  lockNameForObject,
+  queryGroupComponent,
+  resolveRef
+} from "./chunk-XWFRNJMQ.js";
 import {
   COLUMN_CONTEXT,
   INPUT_CONTEXT,
@@ -12,18 +22,10 @@ import {
   encodeStatement,
   rawResponseItems,
   registerStatement
-} from "./chunk-5XZ744TS.js";
+} from "./chunk-2ZCUO2UG.js";
 import {
-  appNamesByGuid,
-  deriveGuid,
-  deriveQueryGuid,
-  getLockedCanonical,
-  lockKey,
-  lockNameForObject,
-  queryGroupComponent,
-  resolveRef,
   sha1Bytes
-} from "./chunk-7JDT4PBU.js";
+} from "./chunk-OHX6MIUZ.js";
 
 // src/types/xdo.ts
 var TAGS = [
@@ -137,7 +139,7 @@ var DiagnosticBag = class {
    * a guard. But the audience for this SDK is largely an agent that never reads
    * stderr, and CI has no way to notice a message nobody fails on. `strict`
    * gives a pipeline one switch that turns "printed something" into "did not
-   * ship" (issue #15).
+   * ship".
    *
    * Scope: the diagnostics an EXPORT collects. A guard that runs while a
    * statement is being built ({@link emitDiagnostic}) has already had its say by
@@ -287,15 +289,41 @@ function barePatternRefusal(value) {
   if (isValidPcreLiteral(value.value)) return null;
   return `${JSON.stringify(value.value)} is a BARE regex pattern. PHP \`preg_*\` reads the first character as the delimiter, so the engine matches nothing for every input \u2014 the assertion or precondition built on it fails (or passes) against text that plainly should not. Build it with c.regex(${JSON.stringify(value.value)}) instead of c.text(...), which wraps and escapes it into a valid PCRE literal`;
 }
-var REGEX_PATTERN_FILTERS = /* @__PURE__ */ new Set([
-  "regex_test",
-  "regex_match",
-  "regex_match_all",
-  "regex_matches",
-  "regex_replace",
-  "regex_get_all_matches",
-  "regex_get_first_match"
-]);
+var REGEX_SUBJECT_SLOT = {
+  regex_test: 0,
+  regex_match: 0,
+  regex_match_all: 0,
+  regex_matches: 0,
+  regex_replace: 1,
+  regex_get_all_matches: 0,
+  regex_get_first_match: 0
+};
+var REGEX_PATTERN_FILTERS = new Set(Object.keys(REGEX_SUBJECT_SLOT));
+var REGEX_METACHARACTERS = /[\\^$.|?*+()[\]{}]/;
+function readablePattern(value) {
+  if (!value || value.tag !== "const") return null;
+  if (Array.isArray(value.filters) && value.filters.length > 0) return null;
+  return isValidPcreLiteral(value.value) ? value.value : null;
+}
+function reversedOperandRefusal(pattern, subject) {
+  const misplaced = readablePattern(subject);
+  if (misplaced === null || !REGEX_METACHARACTERS.test(misplaced)) return null;
+  if (readablePattern(pattern) !== null) return null;
+  return `the OPERANDS are reversed. ${JSON.stringify(misplaced)} is a delimiter-wrapped regex pattern sitting in the SUBJECT slot, which means the pattern and the text it tests were written the other way round. The regex family is pattern-piped \u2014 the piped value is the PATTERN and the argument is the text matched against it, the reverse of every other filter \u2014 so this runs the subject as a pattern and answers false for every input, with HTTP 200 and no error. Swap them: pipe the c.regex(...) pattern and pass the subject as the argument`;
+}
+function reversedRegexOperands(v2) {
+  const chain = Array.isArray(v2.filters) ? v2.filters : [];
+  for (const [i, applied] of chain.entries()) {
+    const slot = REGEX_SUBJECT_SLOT[applied.name];
+    if (slot === void 0) continue;
+    const pattern = { value: v2.value, tag: v2.tag, filters: chain.slice(0, i) };
+    const message = reversedOperandRefusal(pattern, applied.arg?.[slot]);
+    if (message !== null) {
+      return { filter: applied.name, slot, subject: applied.arg?.[slot]?.value ?? "", message };
+    }
+  }
+  return null;
+}
 function intLiteral(n) {
   if (typeof n === "bigint") return String(n);
   if (typeof n === "string") {
@@ -346,7 +374,7 @@ var c = {
    * A `number` that is not an integer, or is past `Number.MAX_SAFE_INTEGER`,
    * **throws**: by the time such a literal reaches here its precision is already
    * gone, so encoding it would write a value the caller did not type. The throw
-   * names the string form. (issue #153)
+   * names the string form.
    */
   int(n) {
     return val(intLiteral(n), "const:int");
@@ -394,7 +422,7 @@ var c = {
    * null** the engine writes into a `db.*` statement's `@meta` slot —
    * `c.null("const:obj")` → `{tag:"const:obj", value:"null"}`, 16 of them across
    * eight ordinary queries in the survey corpus, which had no spelling and came
-   * back as `rawValue` (issue #151).
+   * back as `rawValue`.
    *
    * ⚠ Not the same bytes as `c.obj(null)`, which is the BLANK object
    * (`value: ""`). Both evaluate to null — the engine JSON-decodes the stored
@@ -410,7 +438,7 @@ var c = {
    * (`fl.regex_test`/`regex_match`/`regex_replace`/…). Xano runs PHP `preg_*`, so
    * the pattern MUST be delimiter-wrapped — a bare `c.text("^…$")` is an invalid
    * PCRE and the filter then matches *nothing* for every input, so a precondition
-   * built on it silently rejects all values (issue #128). This wraps the raw
+   * built on it silently rejects all values. This wraps the raw
    * pattern in `/…/`, escapes any interior `/`, and appends `flags`, so the result
    * is always valid; `withFilters` rejects a bare `c.text` pattern and points here.
    *
@@ -438,8 +466,13 @@ var c = {
    * `text("now") |to_epoch_ms` chain; both evaluate to the same epoch-ms number
    * on a live engine, and both persist verbatim, but the native tag is what the
    * editor writes and needs no filter to get there. Chain math onto it as usual:
-   * `withFilters(c.now(), fl.epochms_add_ms(c.int(-maxAgeMs)))`. (issues #120,
-   * #145)
+   * `withFilters(c.now(), fl.epochms_add_ms(c.int(-maxAgeMs)))`.
+   *
+   * Inside an `obj()` the tag is flattened into an expression string, where the
+   * identifier `now` alone is the STRING "now" — so `obj()` writes the
+   * `now|to_epochms` coercion that restores this tag's meaning. A `c.now()` used
+   * as a FILTER ARGUMENT there is refused: the coercion cannot be written in
+   * that position. Hoist it with `s.set_var` and `ref()` it.
    */
   now() {
     return val("now", "const:epochms");
@@ -450,7 +483,6 @@ var c = {
    * compile error and throws at runtime — it would serialize as internal
    * representation the engine can't decode. For a computed/multi-key object
    * response use a record of values (`response: { key: value }`), not `c.obj`.
-   * See issue #42.
    *
    * Called with no argument it is the **empty object**, `{}` — the same default
    * the editor gives a new object variable, and the only empty form current
@@ -467,7 +499,7 @@ var c = {
    * same bytes instead of being quietly re-pointed at `{}`.
    *
    * A **populated** object is stored the way the editor stores one: an empty
-   * `{}` base carrying one `set` filter per key (issue #248). It is NOT a
+   * `{}` base carrying one `set` filter per key. It is NOT a
    * populated JSON string — that form fails the request at runtime, see
    * {@link objSetFilters}.
    *
@@ -488,7 +520,7 @@ var c = {
   /**
    * Array constant → JSON-string value with `tag:"const:array"`. Takes **plain
    * JSON literals only** — like {@link obj}, a nested tagged value is a compile
-   * error and throws at runtime. See issue #42.
+   * error and throws at runtime.
    */
   array(a) {
     assertPlainJson(a);
@@ -665,6 +697,16 @@ function withFilters(value, ...filters) {
       `withFilters: argument ${malformed} of the filter chain is not a filter \u2014 got ${JSON.stringify(got) ?? String(got)}. Each entry must come from an \`fl.*\` factory (or \`filter(name, ...)\`), which returns \`{name, arg, disabled}\`. A tagged value is not a filter: to pipe one value through another, pass it as a filter ARGUMENT (\`fl.concat(other)\`), not as a chain member.`
     );
   }
+  const reversed = reversedRegexOperands({
+    value: value.value,
+    tag: value.tag,
+    filters: [...value.filters, ...added]
+  });
+  if (reversed) {
+    throw new Error(
+      `Regex filter \`${reversed.filter}\`: ${reversed.message} \u2014 \`withFilters(c.regex(\u2026), fl.${reversed.filter}(${reversed.slot === 0 ? "" : "\u2026, "}subject))\`. Naming the argument says which slot is which: \`fl.${reversed.filter}({ subject: \u2026 })\`. (issue #298)`
+    );
+  }
   const pipedIsBarePattern = barePatternRefusal(value) !== null;
   const offending = pipedIsBarePattern ? added.find((filter2) => REGEX_PATTERN_FILTERS.has(filter2.name)) : void 0;
   if (offending) {
@@ -1312,7 +1354,7 @@ var f = {
    * bytes, and a map does not preserve it.
    *
    * Without this there is no way to author a structured JSON column at all
-   * (issue #135).
+   *.
    */
   json(options = {}) {
     return descriptor("json", { ...options });
@@ -1382,9 +1424,8 @@ var f = {
    *   instead: `f.tableRef("tweets", { type: "int" })`. Identity guids derive
    *   from `(type, name)`, so the name form resolves to the same guid.
    *
-   * Byte-verified whole-object against a persisted table readback
-   * (`test/fixtures/tables/ex_field_table_ref.json`, asserted in
-   * `test/conformance/kinds-corpus.test.ts`): the `@` method carries
+   * Byte-verified whole-object against a persisted table readback: the `@`
+   * method carries
    * `disabled:false`, sits last in `methods`, and its `dbo=` arg is the target
    * table's payload guid.
    *
@@ -1431,7 +1472,7 @@ var input = {
    * password on **both** signup and login, let the `f.password` *column* hash on write,
    * and pass the plaintext straight to `check_password`. See the auth recipe in the
    * README. Reach for `input.password` only when you specifically want bind-time hashing
-   * and are not also comparing it with `check_password` (issue #109).
+   * and are not also comparing it with `check_password`.
    */
   password: makeInput("password"),
   /**
@@ -1559,8 +1600,86 @@ function encodeInput(name, descriptor2) {
 // src/values/obj.ts
 var IDENT = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
 function serializeValue(v2, path) {
+  const record = objSetRecord(v2, path);
+  if (record) return record;
+  const nowExpr = serializeEpochMs(v2);
+  if (nowExpr !== null) return nowExpr + serializeFilters(v2, path);
   return serializeAtom(v2, path) + serializeFilters(v2, path);
 }
+function serializeEpochMs(v2) {
+  if (v2.tag !== "const:epochms") return null;
+  if (v2.value !== "now") return null;
+  return "now|to_epochms";
+}
+function objSetRecord(v2, path) {
+  if (v2.tag !== "const:obj") return null;
+  if (v2.value === "") {
+    throw new Error(
+      `obj(): \`${path}\` is \`c.obj(null)\`, the legacy BLANK object form \u2014 the engine evaluates it to null, not to {}. Write \`c.null()\` for the null, or \`c.obj()\` for an empty object.`
+    );
+  }
+  if (v2.value !== "{}") {
+    const parsed = parseJson(v2.value);
+    if (parsed === NOT_JSON) return null;
+    return serializeJson(parsed, path) + serializeFilters(v2, path);
+  }
+  const parts = [];
+  const keys = /* @__PURE__ */ new Set();
+  let i = 0;
+  for (; i < v2.filters.length; i++) {
+    const f2 = v2.filters[i];
+    if (f2.name !== "set" || f2.disabled || f2.arg.length !== 2) break;
+    const [pathArg, member] = f2.arg;
+    if (pathArg.tag !== "const" || pathArg.filters.length > 0) break;
+    const bracketed = pathArg.value.startsWith("[");
+    const key = parseSetPath(pathArg.value);
+    if (!IDENT.test(key)) {
+      if (!bracketed) break;
+      throw new Error(
+        `obj(): key "${key}" inside the \`c.obj\` at \`${path}\` must be a bare identifier ([A-Za-z_][A-Za-z0-9_]*) \u2014 XanoScript object keys aren't quoted.`
+      );
+    }
+    if (keys.has(key)) break;
+    keys.add(key);
+    parts.push(`${key}: ${serializeValue(member, `${path}.${key}`)}`);
+  }
+  const rendered = parts.length === 0 ? "{}" : `{ ${parts.join(", ")} }`;
+  const rest = { ...v2, filters: v2.filters.slice(i) };
+  return rendered + serializeFilters(rest, path);
+}
+function parseSetPath(stored) {
+  const bracketed = /^\["(.*)"\]$/s.exec(stored);
+  return bracketed ? bracketed[1].replace(/\\(["\\])/g, "$1") : stored;
+}
+var NOT_JSON = /* @__PURE__ */ Symbol("not-json");
+function parseJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return NOT_JSON;
+  }
+}
+function serializeJson(value, path) {
+  if (value === null) return "null";
+  if (typeof value === "string") return JSON.stringify(value);
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (typeof value === "number") return Number.isFinite(value) ? String(value) : "null";
+  if (Array.isArray(value)) {
+    return `[${value.map((el, i) => serializeJson(el, `${path}[${i}]`)).join(", ")}]`;
+  }
+  if (typeof value === "object") {
+    const parts = Object.entries(value).map(([key, member]) => {
+      if (!IDENT.test(key)) {
+        throw new Error(
+          `obj(): key "${key}" at \`${path}\` must be a bare identifier ([A-Za-z_][A-Za-z0-9_]*) \u2014 XanoScript object keys aren't quoted.`
+        );
+      }
+      return `${key}: ${serializeJson(member, `${path}.${key}`)}`;
+    });
+    return parts.length === 0 ? "{}" : `{ ${parts.join(", ")} }`;
+  }
+  return "null";
+}
 function serializeFilters(v2, path) {
   let out2 = "";
   for (const f2 of v2.filters) {
@@ -1608,15 +1727,28 @@ function serializeAtom(v2, path) {
     // renders `$env.STRIPE_KEY`.
     case "setting":
       return `$env.${v2.value}`;
-    // The engine's native current-time constant. Only ever holds `"now"` — the
-    // same narrowing the decoder makes — so anything else falls through to the
-    // rejection rather than being rendered as a `now` it is not.
+    // The engine's native current-time constant reaches this function ONLY as a
+    // filter argument — a member position is answered by `serializeEpochMs`
+    // above. There it is unwritable: the value needs a leading `|to_epochms` to
+    // evaluate as a time at all (see `serializeEpochMs`), and inside an argument
+    // a trailing `|` binds to the whole value rather than to the argument, which
+    // is the same wall a pre-filtered argument hits.
     case "const:epochms":
-      if (v2.value === "now") return "now";
+      throw new Error(
+        `obj(): \`${path}\` is \`c.now()\` used as a FILTER ARGUMENT. In an expression the current-time constant has to carry a \`|to_epochms\` coercion, and a \`|\` inside an argument binds to the whole value instead \u2014 so this cannot be written without changing what it means. Compute it in a prior step (\`s.set_var("now", c.now())\`) and reference it with \`ref("now")\`.`
+      );
+    // `c.array([…])` stores plain JSON, and the literal grammar spells the same
+    // list — so it renders to the identical bytes a bare `[…]` member does. The
+    // bare form always worked and this one used to throw, which made the empty
+    // list (`c.array([])`) an export failure with no named way through (#295).
+    case "const:array": {
+      const parsed = parseJson(v2.value);
+      if (parsed !== NOT_JSON) return serializeJson(parsed, path);
       break;
+    }
   }
   throw new Error(
-    `obj(): value tag "${v2.tag}" at \`${path}\` isn't supported in a dynamic object literal yet. Supported: inp(), ref(), auth(), col(), env()/setting()/sys.*, c.now(), and c.text/int/decimal/bool/null \u2014 each optionally carrying a filter chain.`
+    `obj(): value tag "${v2.tag}" at \`${path}\` isn't supported in a dynamic object literal yet. Supported: inp(), ref(), auth(), col(), env()/setting()/sys.*, c.now(), c.text/int/decimal/bool/null, and c.obj()/c.array() \u2014 each optionally carrying a filter chain. A constant record or list can also be written bare: \`{ a: 1 }\`, \`[]\`.`
   );
 }
 function serializeMember(m, path) {
@@ -1683,7 +1815,7 @@ var slotted = (name, argNames, required, capped = true) => (...args) => {
   const hole = argNames.slice(0, last).findIndex((n) => named[n] === void 0);
   if (hole !== -1) {
     throw new Error(
-      `fl.${name}: \`${argNames[hole]}\` is omitted but \`${argNames[last]}\` is supplied. Filter arguments are positional even in this form \u2014 the engine reads them by slot, so one in the middle cannot be skipped. Supply \`${argNames[hole]}\` too. (issue #221)`
+      `fl.${name}: \`${argNames[hole]}\` is omitted but \`${argNames[last]}\` is supplied. Filter arguments are positional even in this form \u2014 the engine reads them by slot, so one in the middle cannot be skipped. Supply \`${argNames[hole]}\` too.`
     );
   }
   assertArity(name, argNames, required, last + 1);
@@ -1692,7 +1824,7 @@ var slotted = (name, argNames, required, capped = true) => (...args) => {
 var assertArity = (name, argNames, required, got) => {
   if (got >= required) return;
   throw new Error(
-    `fl.${name} needs ${required} argument(s) \u2014 ${argNames.slice(0, required).join(", ")} \u2014 but got ${got}. Filter arguments are positional and the engine refuses a short call, so a missing one cannot be inferred \u2014 not even where the filter's own documentation calls it optional. Some filters accept omission from the END and some require every argument regardless; which is which is probed, not declared. (issues #221, #246)`
+    `fl.${name} needs ${required} argument(s) \u2014 ${argNames.slice(0, required).join(", ")} \u2014 but got ${got}. Filter arguments are positional and the engine refuses a short call, so a missing one cannot be inferred \u2014 not even where the filter's own documentation calls it optional. Some filters accept omission from the END and some require every argument regardless; which is which is probed, not declared.`
   );
 };
 var assertMaxArity = (name, argNames, got) => {
@@ -4006,6 +4138,8 @@ export {
   DiagnosticBag,
   isTaggedValue,
   barePatternRefusal,
+  reversedOperandRefusal,
+  reversedRegexOperands,
   c,
   ref,
   inp,
@@ -4117,4 +4251,4 @@ export {
   serializeBundle,
   emitBundle
 };
-//# sourceMappingURL=chunk-LBYWGMOA.js.map
+//# sourceMappingURL=chunk-N74KDCBD.js.map

package/dist/{chunk-3IGNIP6R.js → chunk-NDP7OUPS.js}

@@ -86,4 +86,4 @@ export {
   fetchReadOrExplain,
   retryingFetch
 };
-//# sourceMappingURL=chunk-3IGNIP6R.js.map
+//# sourceMappingURL=chunk-NDP7OUPS.js.map

package/dist/chunk-OHX6MIUZ.js

@@ -0,0 +1,184 @@
+// src/util/hash.ts
+var utf8 = new TextEncoder();
+function toBytes(input) {
+  return typeof input === "string" ? utf8.encode(input) : input;
+}
+function md5Bytes(input) {
+  const msg = toBytes(input);
+  const len = msg.length;
+  const withPad = (len + 8 >>> 6) + 1;
+  const words = new Int32Array(withPad * 16);
+  for (let i = 0; i < len; i++) {
+    const idx = i >> 2;
+    words[idx] = words[idx] | msg[i] << i % 4 * 8;
+  }
+  const padIdx = len >> 2;
+  words[padIdx] = words[padIdx] | 128 << len % 4 * 8;
+  words[words.length - 2] = len * 8;
+  let a = 1732584193, b = -271733879, c = -1732584194, d = 271733878;
+  const add = (x, y) => x + y | 0;
+  const rol = (n, s) => n << s | n >>> 32 - s;
+  const cmn = (q, a0, b0, x, s, t) => add(rol(add(add(a0, q), add(x, t)), s), b0);
+  const ff = (a0, b0, c0, d0, x, s, t) => cmn(b0 & c0 | ~b0 & d0, a0, b0, x, s, t);
+  const gg = (a0, b0, c0, d0, x, s, t) => cmn(b0 & d0 | c0 & ~d0, a0, b0, x, s, t);
+  const hh = (a0, b0, c0, d0, x, s, t) => cmn(b0 ^ c0 ^ d0, a0, b0, x, s, t);
+  const ii = (a0, b0, c0, d0, x, s, t) => cmn(c0 ^ (b0 | ~d0), a0, b0, x, s, t);
+  for (let i = 0; i < words.length; i += 16) {
+    const oa = a, ob = b, oc = c, od = d;
+    const w = (j) => words[i + j];
+    a = ff(a, b, c, d, w(0), 7, -680876936);
+    d = ff(d, a, b, c, w(1), 12, -389564586);
+    c = ff(c, d, a, b, w(2), 17, 606105819);
+    b = ff(b, c, d, a, w(3), 22, -1044525330);
+    a = ff(a, b, c, d, w(4), 7, -176418897);
+    d = ff(d, a, b, c, w(5), 12, 1200080426);
+    c = ff(c, d, a, b, w(6), 17, -1473231341);
+    b = ff(b, c, d, a, w(7), 22, -45705983);
+    a = ff(a, b, c, d, w(8), 7, 1770035416);
+    d = ff(d, a, b, c, w(9), 12, -1958414417);
+    c = ff(c, d, a, b, w(10), 17, -42063);
+    b = ff(b, c, d, a, w(11), 22, -1990404162);
+    a = ff(a, b, c, d, w(12), 7, 1804603682);
+    d = ff(d, a, b, c, w(13), 12, -40341101);
+    c = ff(c, d, a, b, w(14), 17, -1502002290);
+    b = ff(b, c, d, a, w(15), 22, 1236535329);
+    a = gg(a, b, c, d, w(1), 5, -165796510);
+    d = gg(d, a, b, c, w(6), 9, -1069501632);
+    c = gg(c, d, a, b, w(11), 14, 643717713);
+    b = gg(b, c, d, a, w(0), 20, -373897302);
+    a = gg(a, b, c, d, w(5), 5, -701558691);
+    d = gg(d, a, b, c, w(10), 9, 38016083);
+    c = gg(c, d, a, b, w(15), 14, -660478335);
+    b = gg(b, c, d, a, w(4), 20, -405537848);
+    a = gg(a, b, c, d, w(9), 5, 568446438);
+    d = gg(d, a, b, c, w(14), 9, -1019803690);
+    c = gg(c, d, a, b, w(3), 14, -187363961);
+    b = gg(b, c, d, a, w(8), 20, 1163531501);
+    a = gg(a, b, c, d, w(13), 5, -1444681467);
+    d = gg(d, a, b, c, w(2), 9, -51403784);
+    c = gg(c, d, a, b, w(7), 14, 1735328473);
+    b = gg(b, c, d, a, w(12), 20, -1926607734);
+    a = hh(a, b, c, d, w(5), 4, -378558);
+    d = hh(d, a, b, c, w(8), 11, -2022574463);
+    c = hh(c, d, a, b, w(11), 16, 1839030562);
+    b = hh(b, c, d, a, w(14), 23, -35309556);
+    a = hh(a, b, c, d, w(1), 4, -1530992060);
+    d = hh(d, a, b, c, w(4), 11, 1272893353);
+    c = hh(c, d, a, b, w(7), 16, -155497632);
+    b = hh(b, c, d, a, w(10), 23, -1094730640);
+    a = hh(a, b, c, d, w(13), 4, 681279174);
+    d = hh(d, a, b, c, w(0), 11, -358537222);
+    c = hh(c, d, a, b, w(3), 16, -722521979);
+    b = hh(b, c, d, a, w(6), 23, 76029189);
+    a = hh(a, b, c, d, w(9), 4, -640364487);
+    d = hh(d, a, b, c, w(12), 11, -421815835);
+    c = hh(c, d, a, b, w(15), 16, 530742520);
+    b = hh(b, c, d, a, w(2), 23, -995338651);
+    a = ii(a, b, c, d, w(0), 6, -198630844);
+    d = ii(d, a, b, c, w(7), 10, 1126891415);
+    c = ii(c, d, a, b, w(14), 15, -1416354905);
+    b = ii(b, c, d, a, w(5), 21, -57434055);
+    a = ii(a, b, c, d, w(12), 6, 1700485571);
+    d = ii(d, a, b, c, w(3), 10, -1894986606);
+    c = ii(c, d, a, b, w(10), 15, -1051523);
+    b = ii(b, c, d, a, w(1), 21, -2054922799);
+    a = ii(a, b, c, d, w(8), 6, 1873313359);
+    d = ii(d, a, b, c, w(15), 10, -30611744);
+    c = ii(c, d, a, b, w(6), 15, -1560198380);
+    b = ii(b, c, d, a, w(13), 21, 1309151649);
+    a = ii(a, b, c, d, w(4), 6, -145523070);
+    d = ii(d, a, b, c, w(11), 10, -1120210379);
+    c = ii(c, d, a, b, w(2), 15, 718787259);
+    b = ii(b, c, d, a, w(9), 21, -343485551);
+    a = add(a, oa);
+    b = add(b, ob);
+    c = add(c, oc);
+    d = add(d, od);
+  }
+  const out = new Uint8Array(16);
+  [a, b, c, d].forEach((word, wi) => {
+    for (let j = 0; j < 4; j++) out[wi * 4 + j] = word >>> j * 8 & 255;
+  });
+  return out;
+}
+function md5Hex(input) {
+  return toHex(md5Bytes(input));
+}
+function sha1Bytes(input) {
+  const msg = toBytes(input);
+  const len = msg.length;
+  const withLen = len + 9;
+  const blocks = Math.ceil(withLen / 64);
+  const total = blocks * 64;
+  const buf = new Uint8Array(total);
+  buf.set(msg);
+  buf[len] = 128;
+  const bitLen = len * 8;
+  buf[total - 4] = bitLen >>> 24 & 255;
+  buf[total - 3] = bitLen >>> 16 & 255;
+  buf[total - 2] = bitLen >>> 8 & 255;
+  buf[total - 1] = bitLen & 255;
+  let h0 = 1732584193, h1 = -271733879, h2 = -1732584194, h3 = 271733878, h4 = -1009589776;
+  const w = new Int32Array(80);
+  const rol = (n, s) => n << s | n >>> 32 - s;
+  for (let i = 0; i < total; i += 64) {
+    for (let j = 0; j < 16; j++) {
+      const k = i + j * 4;
+      w[j] = buf[k] << 24 | buf[k + 1] << 16 | buf[k + 2] << 8 | buf[k + 3];
+    }
+    for (let j = 16; j < 80; j++) w[j] = rol(w[j - 3] ^ w[j - 8] ^ w[j - 14] ^ w[j - 16], 1);
+    let a = h0, b = h1, c = h2, d = h3, e = h4;
+    for (let j = 0; j < 80; j++) {
+      let f, k;
+      if (j < 20) {
+        f = b & c | ~b & d;
+        k = 1518500249;
+      } else if (j < 40) {
+        f = b ^ c ^ d;
+        k = 1859775393;
+      } else if (j < 60) {
+        f = b & c | b & d | c & d;
+        k = -1894007588;
+      } else {
+        f = b ^ c ^ d;
+        k = -899497514;
+      }
+      const t = rol(a, 5) + f + e + k + w[j] | 0;
+      e = d;
+      d = c;
+      c = rol(b, 30);
+      b = a;
+      a = t;
+    }
+    h0 = h0 + a | 0;
+    h1 = h1 + b | 0;
+    h2 = h2 + c | 0;
+    h3 = h3 + d | 0;
+    h4 = h4 + e | 0;
+  }
+  const out = new Uint8Array(20);
+  [h0, h1, h2, h3, h4].forEach((h, hi) => {
+    out[hi * 4] = h >>> 24 & 255;
+    out[hi * 4 + 1] = h >>> 16 & 255;
+    out[hi * 4 + 2] = h >>> 8 & 255;
+    out[hi * 4 + 3] = h & 255;
+  });
+  return out;
+}
+function toHex(bytes) {
+  let s = "";
+  for (const b of bytes) s += b.toString(16).padStart(2, "0");
+  return s;
+}
+function randomBytes(n) {
+  const out = new Uint8Array(n);
+  globalThis.crypto.getRandomValues(out);
+  return out;
+}
+
+export {
+  md5Hex,
+  sha1Bytes,
+  randomBytes
+};
+//# sourceMappingURL=chunk-OHX6MIUZ.js.map

package/dist/{chunk-EQW3YT5U.js → chunk-P6PVBQL6.js}

@@ -1,7 +1,7 @@
 import {
   describeTransportFailure,
   httpFailure
-} from "./chunk-3IGNIP6R.js";
+} from "./chunk-NDP7OUPS.js";
 
 // src/deploy/branch.ts
 var BRANCH_TIMEOUT_MS = 3e4;
@@ -156,4 +156,4 @@ export {
   assertBranchAbsent,
   requireBranch
 };
-//# sourceMappingURL=chunk-EQW3YT5U.js.map
+//# sourceMappingURL=chunk-P6PVBQL6.js.map