@zeldrisho/pi-web-fetch 0.10.2 → 0.11.0

package/src/{fragments.ts → document/fragments.ts}

@@ -1,4 +1,4 @@
-import type { CompleteDocument } from "./content";
+import type { CompleteDocument } from "./content.ts";
 
 /** Removes a URL fragment before acquisition so fragment variants share cache entries. */
 export function urlWithoutFragment(rawUrl: string): string {

package/src/index.ts

@@ -7,7 +7,17 @@ import { executeWebFetch, resetLlmsNoticeOrigins } from "./service";
 
 export { ExpiringLruCache } from "./cache";
 
-export type { FetchResult } from "./content";
+export {
+  hasAnubisMarkers,
+  parseAnubisChallenge,
+  solveAnubisChallenge,
+  type AnubisChallenge,
+  type AnubisSolveContext,
+} from "./challenges/anubis.ts";
+
+export { CookieJar } from "./network/cookies.ts";
+
+export type { FetchResult } from "./document/content.ts";
 
 export {
   diagnoseExtraction,
@@ -15,13 +25,21 @@ export {
   type ExtractedLink,
   type ExtractedLinks,
   type ExtractionDiagnostics,
-} from "./evidence";
+} from "./document/evidence.ts";
 
-export { fetchRemoteContent, npmRegistryFallbackUrl, type FetchRemoteDependencies } from "./fetch";
+export {
+  fetchRemoteContent,
+  npmRegistryFallbackUrl,
+  type FetchRemoteDependencies,
+} from "./acquisition/fetch.ts";
 
-export { focusMarkdown, type FocusDetails, type FocusResult } from "./focus";
+export { focusMarkdown, type FocusDetails, type FocusResult } from "./document/focus.ts";
 
-export { createDocumentOutline, type DocumentOutline, type OutlineHeading } from "./outline";
+export {
+  createDocumentOutline,
+  type DocumentOutline,
+  type OutlineHeading,
+} from "./document/outline.ts";
 
 export { redactUrlForDisplay } from "./redact";
 
@@ -39,7 +57,7 @@ export {
   requestPinned,
   validateRemoteUrl,
   type ValidatedTarget,
-} from "./network";
+} from "./network/network.ts";
 
 export const webFetchParameters = Type.Object({
   url: Type.String(),

package/src/network/cookies.ts

@@ -0,0 +1,260 @@
+import type { IncomingHttpHeaders, IncomingMessage } from "node:http";
+
+/** Maximum number of cookies retained by one jar. */
+const MAX_COOKIES = 128;
+
+/** Maximum accepted cookie value length in characters. */
+const MAX_COOKIE_VALUE_CHARACTERS = 4_096;
+
+/** Maximum accepted cookie name length in characters. */
+const MAX_COOKIE_NAME_CHARACTERS = 256;
+
+/** RFC 6265 cookie-name token characters. */
+const COOKIE_NAME = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+
+/** Returns whether a value contains a control character that cookie headers must not carry. */
+function hasInvalidCookieCharacter(value: string): boolean {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+
+    if (code <= 0x1f || code === 0x7f) return true;
+  }
+
+  return false;
+}
+
+interface StoredCookie {
+  name: string;
+  value: string;
+  origin: string;
+  path: string;
+  secure: boolean;
+  createdAt: number;
+  expiresAt?: number;
+}
+
+interface ParsedCookie {
+  name: string;
+  value: string;
+  path: string;
+  secure: boolean;
+  expiresAt?: number;
+}
+
+/** Returns the default cookie path for a request path, per RFC 6265 section 5.1.4. */
+function defaultCookiePath(pathname: string): string {
+  if (!pathname.startsWith("/")) return "/";
+
+  const index = pathname.lastIndexOf("/");
+
+  return index <= 0 ? "/" : pathname.slice(0, index);
+}
+
+/** Returns whether a request path is covered by a cookie path. */
+function pathMatches(pathname: string, cookiePath: string): boolean {
+  if (pathname === cookiePath) return true;
+
+  if (!pathname.startsWith(cookiePath)) return false;
+
+  return cookiePath.endsWith("/") || pathname[cookiePath.length] === "/";
+}
+
+/** Returns whether a response host may set a cookie for the supplied domain attribute. */
+function domainMatches(hostname: string, domain: string): boolean {
+  return hostname === domain || hostname.endsWith(`.${domain}`);
+}
+
+/** Normalizes a Domain attribute value, rejecting values that cannot match the response host. */
+function normalizeDomain(raw: string, hostname: string): string | undefined {
+  const domain = raw.trim().toLowerCase().replace(/^\./, "");
+
+  if (!domain || hasInvalidCookieCharacter(domain) || domain.includes("..")) return undefined;
+
+  if (!domainMatches(hostname, domain)) return undefined;
+
+  return domain;
+}
+
+/** Parses one Set-Cookie header into the subset of attributes this jar uses. */
+function parseSetCookie(raw: string, url: URL, now: number): ParsedCookie | undefined {
+  const parts = raw.split(";");
+  const pair = parts[0]?.trim() ?? "";
+  const separator = pair.indexOf("=");
+
+  if (separator <= 0) return undefined;
+
+  const name = pair.slice(0, separator).trim();
+  const value = pair.slice(separator + 1).trim();
+
+  if (
+    name.length === 0 ||
+    name.length > MAX_COOKIE_NAME_CHARACTERS ||
+    !COOKIE_NAME.test(name) ||
+    value.length > MAX_COOKIE_VALUE_CHARACTERS ||
+    hasInvalidCookieCharacter(value)
+  ) {
+    return undefined;
+  }
+
+  let path = defaultCookiePath(url.pathname || "/");
+  let secure = false;
+  let maxAge: number | undefined;
+  let expires: number | undefined;
+
+  for (let index = 1; index < parts.length; index += 1) {
+    const attribute = parts[index]?.trim() ?? "";
+    const equals = attribute.indexOf("=");
+
+    const attributeName = (equals === -1 ? attribute : attribute.slice(0, equals))
+      .trim()
+      .toLowerCase();
+
+    const attributeValue = equals === -1 ? "" : attribute.slice(equals + 1).trim();
+
+    if (attributeName === "secure") {
+      secure = true;
+      continue;
+    }
+
+    if (attributeName === "path" && attributeValue.startsWith("/")) {
+      if (!hasInvalidCookieCharacter(attributeValue)) path = attributeValue;
+
+      continue;
+    }
+
+    if (attributeName === "domain") {
+      if (normalizeDomain(attributeValue, url.hostname) === undefined) return undefined;
+
+      continue;
+    }
+
+    if (attributeName === "max-age") {
+      const seconds = Number(attributeValue);
+
+      if (Number.isInteger(seconds)) maxAge = seconds;
+
+      continue;
+    }
+
+    if (attributeName === "expires") {
+      const parsed = Date.parse(attributeValue);
+
+      if (Number.isFinite(parsed)) expires = parsed;
+    }
+  }
+
+  const expiresAt =
+    maxAge === undefined
+      ? expires
+      : maxAge <= 0
+        ? now - 1
+        : now + Math.min(maxAge, 31_536_000) * 1_000;
+
+  return { name, value, path, secure, expiresAt };
+}
+
+/** Returns every Set-Cookie value from a response without relying on comma splitting. */
+function setCookieValues(headers: IncomingHttpHeaders): string[] {
+  const value = headers["set-cookie"];
+
+  if (Array.isArray(value)) return value;
+
+  return value === undefined ? [] : [value];
+}
+
+/**
+ * A bounded, origin-scoped cookie jar used for one web fetch acquisition.
+ *
+ * Cookies are accepted only for the origin that supplied them and are never
+ * persisted, logged, or sent to another origin. Domain attributes must match the
+ * response host; the jar still scopes the stored cookie to that exact origin,
+ * which is stricter than a browser and appropriate for challenge handshakes.
+ */
+export class CookieJar {
+  readonly #cookies = new Map<string, StoredCookie>();
+
+  /** Number of unexpired cookies currently stored. */
+  get size(): number {
+    return this.#cookies.size;
+  }
+
+  /**
+   * Stores cookies supplied by a response for the given request URL.
+   *
+   * @param response - The HTTP response whose Set-Cookie headers should be stored.
+   * @param url - The final URL that produced the response.
+   */
+  store(response: Pick<IncomingMessage, "headers">, url: URL): void {
+    const now = Date.now();
+
+    for (const raw of setCookieValues(response.headers)) {
+      const parsed = parseSetCookie(raw, url, now);
+
+      if (!parsed) continue;
+
+      const key = `${url.origin}\0${parsed.name}\0${parsed.path}`;
+      this.#cookies.delete(key);
+
+      if (parsed.expiresAt !== undefined && parsed.expiresAt <= now) continue;
+
+      this.#cookies.set(key, {
+        name: parsed.name,
+        value: parsed.value,
+        origin: url.origin,
+        path: parsed.path,
+        secure: parsed.secure,
+        createdAt: now,
+        expiresAt: parsed.expiresAt,
+      });
+    }
+
+    this.#evict();
+  }
+
+  /**
+   * Returns a Cookie header value for a URL, excluding expired, insecure, and
+   * cross-origin cookies.
+   *
+   * @param url - The request URL.
+   * @returns A serialized Cookie header value, or undefined when no cookie matches.
+   */
+  headerFor(url: URL): string | undefined {
+    const now = Date.now();
+    const matches: StoredCookie[] = [];
+
+    for (const [key, cookie] of this.#cookies) {
+      if (cookie.expiresAt !== undefined && cookie.expiresAt <= now) {
+        this.#cookies.delete(key);
+        continue;
+      }
+
+      if (cookie.origin !== url.origin) continue;
+
+      if (cookie.secure && url.protocol !== "https:") continue;
+
+      if (!pathMatches(url.pathname || "/", cookie.path)) continue;
+
+      matches.push(cookie);
+    }
+
+    if (matches.length === 0) return undefined;
+
+    matches.sort((left, right) => {
+      const pathOrder = right.path.length - left.path.length;
+
+      return pathOrder !== 0 ? pathOrder : left.createdAt - right.createdAt;
+    });
+
+    return matches.map((cookie) => `${cookie.name}=${cookie.value}`).join("; ");
+  }
+
+  /** Drops oldest cookies until the jar is within its entry bound. */
+  #evict(): void {
+    while (this.#cookies.size > MAX_COOKIES) {
+      const oldest = this.#cookies.keys().next().value;
+
+      if (oldest === undefined) return;
+      this.#cookies.delete(oldest);
+    }
+  }
+}

package/src/{network-redirects.ts → network/network-redirects.ts}

@@ -1,7 +1,8 @@
 import type { IncomingMessage } from "node:http";
-import { awaitWithAbort } from "./abort";
-import { validateRemoteUrl, type ValidatedTarget } from "./network-policy";
-import { requestPinned, responseHeader } from "./network-transport";
+import { awaitWithAbort } from "../abort";
+import type { CookieJar } from "./cookies.ts";
+import { validateRemoteUrl, type ValidatedTarget } from "./network-policy.ts";
+import { requestPinned, responseHeader } from "./network-transport.ts";
 
 /** Maximum number of HTTP redirects to follow before aborting. */
 export const FETCH_MAX_REDIRECTS = 5;
@@ -31,6 +32,8 @@ export interface RedirectDependencies {
   ) => Promise<IncomingMessage>;
   random?: () => number;
   sleep?: (milliseconds: number, signal: AbortSignal) => Promise<void>;
+  /** Origin-scoped cookies for the current acquisition, including challenge handshakes. */
+  cookies?: CookieJar;
 }
 
 /** Creates the consistent abort error used by redirect and retry coordination. */
@@ -140,13 +143,18 @@ async function coordinatedRequest(
   for (let attempt = 0; ; attempt += 1) {
     const release = await acquireOrigin(target.url.origin, signal);
     let response: IncomingMessage;
+    const cookieHeader = dependencies.cookies?.headerFor(target.url);
+    const requestHeaders = cookieHeader ? { Cookie: cookieHeader, ...headers } : headers;
 
     try {
-      response = await request(target, signal, headers);
+      response = await request(target, signal, requestHeaders);
     } finally {
       release();
     }
 
+    // Record cookies before any retry destroy so challenge handshakes keep state.
+    dependencies.cookies?.store(response, target.url);
+
     const status = response.statusCode ?? 0;
 
     if (![429, 503].includes(status) || attempt >= MAX_RETRIES) return response;

package/src/{network-transport.ts → network/network-transport.ts}

@@ -1,8 +1,9 @@
 import { request as httpRequest, type IncomingMessage } from "node:http";
 import { request as httpsRequest } from "node:https";
 import { isIP, type LookupFunction } from "node:net";
+import { brotliDecompressSync, gunzipSync, inflateSync } from "node:zlib";
 import { formatSize } from "@earendil-works/pi-coding-agent";
-import type { ValidatedTarget } from "./network-policy";
+import type { ValidatedTarget } from "./network-policy.ts";
 
 /** Maximum size in bytes for raw HTTP response bodies. */
 export const FETCH_MAX_BYTES = 5 * 1_024 * 1_024;
@@ -285,6 +286,41 @@ export async function readResponseBytes(
  * @param contentTypeHeader - Value of the Content-Type response header
  * @returns Decoded response string
  */
+/** Decompresses supported HTTP content codings while bounding expansion. */
+export function decompressResponse(
+  bytes: Uint8Array,
+  contentEncoding: string | undefined,
+): Uint8Array {
+  const encodings = (contentEncoding ?? "identity")
+    .split(",")
+    .map((encoding) => encoding.trim().toLowerCase())
+    .filter((encoding) => encoding && encoding !== "identity");
+
+  for (const encoding of encodings.reverse()) {
+    try {
+      const options = { maxOutputLength: FETCH_MAX_BYTES };
+
+      if (encoding === "gzip" || encoding === "x-gzip") bytes = gunzipSync(bytes, options);
+      else if (encoding === "deflate") bytes = inflateSync(bytes, options);
+      else if (encoding === "br") bytes = brotliDecompressSync(bytes, options);
+      else throw new Error(`unsupported content encoding: ${encoding}`);
+    } catch (error) {
+      if (error instanceof Error && error.message.startsWith("unsupported content encoding:"))
+        throw error;
+
+      if (error instanceof Error && "code" in error && error.code === "ERR_BUFFER_TOO_LARGE") {
+        throw new Error(
+          `web_fetch decompressed response exceeds the ${formatSize(FETCH_MAX_BYTES)} limit.`,
+        );
+      }
+
+      throw new Error(`web_fetch could not decode ${encoding}-encoded response.`);
+    }
+  }
+
+  return bytes;
+}
+
 export function decodeResponse(bytes: Uint8Array, contentTypeHeader: string): string {
   const charset = contentTypeHeader.match(/(?:^|;)\s*charset\s*=\s*["']?([^;"'\s]+)/i)?.[1];
 

package/src/{network.ts → network/network.ts}

@@ -4,12 +4,13 @@ export {
   validateRemoteUrl,
   type ResolveAddresses,
   type ValidatedTarget,
-} from "./network-policy";
+} from "./network-policy.ts";
 
 export {
   decodeResponse,
+  decompressResponse,
   FETCH_MAX_BYTES,
   readResponseBytes,
   requestPinned,
   responseHeader,
-} from "./network-transport";
+} from "./network-transport.ts";

package/src/service.ts

@@ -8,13 +8,13 @@ import {
   truncateHead,
 } from "@earendil-works/pi-coding-agent";
 import { ExpiringLruCache, stableKeyHash, type CachePersistence } from "./cache";
-import { sliceCompleteDocument, type CompleteDocument } from "./content";
-import { revalidateCompleteDocument, type FetchRemoteDependencies } from "./fetch";
-import { fetchDocumentWithLlmsTxtSupport } from "./llms";
-import { focusMarkdown, type FocusDetails } from "./focus";
-import { resolveFragmentOffset, urlWithoutFragment } from "./fragments";
+import { sliceCompleteDocument, type CompleteDocument } from "./document/content.ts";
+import { revalidateCompleteDocument, type FetchRemoteDependencies } from "./acquisition/fetch.ts";
+import { fetchDocumentWithLlmsTxtSupport } from "./acquisition/llms.ts";
+import { focusMarkdown, type FocusDetails } from "./document/focus.ts";
+import { resolveFragmentOffset, urlWithoutFragment } from "./document/fragments.ts";
 import { InflightCoalescer } from "./inflight";
-import { createDocumentOutline, type DocumentOutline } from "./outline";
+import { createDocumentOutline, type DocumentOutline } from "./document/outline.ts";
 import { redactUrlForDisplay } from "./redact";
 import {
   FETCH_DEFAULT_MAX_CHARACTERS,
@@ -129,7 +129,7 @@ export function classifyConfidence(
   return markdownLength >= 200 ? "medium" : "low";
 }
 
-export { buildLlmsTxtCandidateUrls } from "./llms";
+export { buildLlmsTxtCandidateUrls } from "./acquisition/llms.ts";
 
 /** Resolves the private, cross-session cache directory for a web tool. */
 function resolveCacheDirectory(name: string): string {

package/workers/anubis-solver.js

@@ -0,0 +1,164 @@
+import { createHash } from "node:crypto";
+/** Maximum length in bytes of the server-provided random challenge data. */
+export const ANUBIS_MAX_RANDOM_DATA_BYTES = 4_096;
+/** Maximum size in bytes of a server-provided WebAssembly challenge module. */
+export const ANUBIS_MAX_WASM_BYTES = 4 * 1_024 * 1_024;
+/** The host function Anubis baseline WebAssembly modules import. */
+const ANUBIS_WASM_IMPORT = { module: "anubis", name: "anubis_update_nonce" };
+/** Exports required from an Anubis baseline WebAssembly module. */
+const ANUBIS_WASM_EXPORTS = [
+    "data_ptr",
+    "set_data_length",
+    "anubis_work",
+    "result_hash_ptr",
+    "result_hash_size",
+];
+/** Decodes a lowercase or uppercase hexadecimal string, rejecting odd or non-hex input. */
+function decodeHex(value) {
+    if (value.length === 0 || value.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(value))
+        return undefined;
+    const bytes = new Uint8Array(value.length / 2);
+    for (let index = 0; index < bytes.length; index += 1) {
+        bytes[index] = Number.parseInt(value.slice(index * 2, index * 2 + 2), 16);
+    }
+    return bytes;
+}
+/** Returns a defensive snapshot of a WebAssembly memory range. */
+function readMemory(memory, pointer, size) {
+    const offset = pointer >>> 0;
+    if (size < 0 || offset + size > memory.buffer.byteLength)
+        throw new Error("Anubis challenge module returned an out-of-bounds pointer.");
+    return new Uint8Array(memory.buffer, offset, size).slice();
+}
+/** Copies bytes into a validated WebAssembly memory range. */
+function writeMemory(memory, pointer, bytes) {
+    const offset = pointer >>> 0;
+    if (offset + bytes.byteLength > memory.buffer.byteLength)
+        throw new Error("Anubis challenge module returned an out-of-bounds pointer.");
+    new Uint8Array(memory.buffer, offset, bytes.byteLength).set(bytes);
+}
+/** Returns the number of leading zero bits in a byte sequence. */
+function leadingZeroBits(bytes) {
+    let bits = 0;
+    for (const byte of bytes) {
+        if (byte === 0) {
+            bits += 8;
+            continue;
+        }
+        bits += Math.clz32(byte) - 24;
+        break;
+    }
+    return bits;
+}
+/** Narrows a WebAssembly export value to a numeric function. */
+function isWasmFunction(value) {
+    return typeof value === "function";
+}
+/** Reads a required numeric function export from an instantiated module. */
+function requireFunction(exports, name) {
+    const value = exports[name];
+    if (!isWasmFunction(value))
+        throw new Error(`Anubis challenge module is missing ${name}.`);
+    return value;
+}
+/**
+ * Verifies that a module only imports the Anubis host function and exports the
+ * interface the baseline solver needs, so a hostile server cannot pass a module
+ * that reaches outside its sandbox.
+ */
+function assertSupportedModule(module) {
+    const imports = WebAssembly.Module.imports(module);
+    if (imports.length !== 1 ||
+        imports[0].module !== ANUBIS_WASM_IMPORT.module ||
+        imports[0].name !== ANUBIS_WASM_IMPORT.name ||
+        imports[0].kind !== "function") {
+        throw new Error("Anubis challenge module requested unsupported imports.");
+    }
+    const exported = new Set(WebAssembly.Module.exports(module)
+        .filter((entry) => entry.kind === "function")
+        .map((entry) => entry.name));
+    for (const name of ANUBIS_WASM_EXPORTS) {
+        if (!exported.has(name))
+            throw new Error(`Anubis challenge module is missing ${name}.`);
+    }
+}
+/**
+ * Solves a `fast` or `slow` challenge by searching for a nonce whose
+ * `sha256(randomData + nonce)` has `difficulty` leading zero hexadecimal digits.
+ *
+ * @param randomData - The hex challenge string supplied by the server.
+ * @param difficulty - Required number of leading zero hex digits.
+ * @param deadline - Epoch milliseconds after which the search aborts.
+ * @returns The matching nonce and its hex digest.
+ */
+export function solveAnubisSha256Hex(randomData, difficulty, deadline) {
+    if (!Number.isInteger(difficulty) || difficulty < 0 || difficulty > 64)
+        throw new Error("Anubis challenge requested an unsupported difficulty.");
+    const prefix = "0".repeat(difficulty);
+    for (let nonce = 0; nonce <= 0xffff_ffff; nonce += 1) {
+        if ((nonce & 0xfff) === 0 && Date.now() > deadline)
+            throw new Error("Anubis proof of work exceeded the time budget.");
+        const hash = createHash("sha256").update(randomData).update(String(nonce)).digest("hex");
+        if (hash.startsWith(prefix))
+            return { nonce, hash };
+    }
+    throw new Error("Anubis proof of work exhausted the nonce space.");
+}
+/**
+ * Solves a `sha256`, `hashx`, or `argon2id` challenge by running the
+ * server-provided baseline WebAssembly module inside this process.
+ *
+ * The module is validated before instantiation: it may import only the
+ * `anubis_update_nonce` host function and must export the numeric interface the
+ * baseline solver uses. The returned hash is checked against the requested
+ * difficulty before it is submitted.
+ *
+ * @param moduleBytes - Compiled bytes of the baseline module.
+ * @param randomData - The hex challenge string supplied by the server.
+ * @param difficulty - Required number of leading zero bits in the result hash.
+ * @param deadline - Epoch milliseconds after which the solve is abandoned.
+ * @returns The matching nonce and its hex digest.
+ */
+export function solveAnubisWasm(moduleBytes, randomData, difficulty, deadline) {
+    if (moduleBytes.byteLength === 0 || moduleBytes.byteLength > ANUBIS_MAX_WASM_BYTES)
+        throw new Error("Anubis challenge module exceeded the size limit.");
+    if (!Number.isInteger(difficulty) || difficulty < 0 || difficulty > 0xffff_ffff)
+        throw new Error("Anubis challenge requested an unsupported difficulty.");
+    const data = decodeHex(randomData);
+    if (!data || data.byteLength > ANUBIS_MAX_RANDOM_DATA_BYTES)
+        throw new Error("Anubis challenge supplied unsupported random data.");
+    if (Date.now() > deadline)
+        throw new Error("Anubis proof of work exceeded the time budget.");
+    const module = new WebAssembly.Module(new Uint8Array(moduleBytes));
+    assertSupportedModule(module);
+    const instance = new WebAssembly.Instance(module, {
+        anubis: { anubis_update_nonce: () => { } },
+    });
+    const memory = instance.exports.memory;
+    if (!(memory instanceof WebAssembly.Memory))
+        throw new Error("Anubis challenge module is missing memory.");
+    const dataPtr = requireFunction(instance.exports, "data_ptr");
+    const setDataLength = requireFunction(instance.exports, "set_data_length");
+    const work = requireFunction(instance.exports, "anubis_work");
+    const resultHashPtr = requireFunction(instance.exports, "result_hash_ptr");
+    const resultHashSize = requireFunction(instance.exports, "result_hash_size");
+    writeMemory(memory, dataPtr(), data);
+    setDataLength(data.byteLength);
+    const nonce = work(difficulty, 0, 1);
+    const hashSize = resultHashSize() >>> 0;
+    if (hashSize < 1 || hashSize > 4_096)
+        throw new Error("Anubis challenge module returned an invalid hash size.");
+    const hashBytes = readMemory(memory, resultHashPtr(), hashSize);
+    if (Date.now() > deadline)
+        throw new Error("Anubis proof of work exceeded the time budget.");
+    if (difficulty > 0 && leadingZeroBits(hashBytes) < difficulty)
+        throw new Error("Anubis proof of work produced an invalid solution.");
+    const hash = Array.from(hashBytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+    return { nonce: nonce >>> 0, hash };
+}
+/** Dispatches one worker solve request to the matching pure solver. */
+export function solveAnubisRequest(request) {
+    if (request.kind === "sha256")
+        return solveAnubisSha256Hex(request.randomData, request.difficulty, request.deadline);
+    return solveAnubisWasm(request.moduleBytes, request.randomData, request.difficulty, request.deadline);
+}

package/workers/anubis-worker.js

@@ -0,0 +1,15 @@
+/* v8 ignore file -- executes only inside a worker thread; covered through the parent's integration tests. */
+import { parentPort, workerData } from "node:worker_threads";
+import { solveAnubisRequest } from "./anubis-solver.js";
+/** Solves the challenge supplied as worker data and reports the outcome to the parent. */
+function run() {
+    const request = workerData;
+    try {
+        parentPort?.postMessage({ kind: "solved", solution: solveAnubisRequest(request) });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : "Anubis worker failed.";
+        parentPort?.postMessage({ kind: "error", message });
+    }
+}
+run();