mihrab-methods 1.0.0 → 1.0.1

package/README.md

@@ -204,13 +204,13 @@ npm install mihrab-methods
 ```
 
 One entry point per authority, so an app ships only the data it needs
-(Indonesia's is 100 KB; Diyanet's worldwide points and list are 1.4 MB):
+(Indonesia's is 90 KB; Diyanet's worldwide points and list are 1.6 MB):
 
 | Import | Loads |
 |---|---|
 | `mihrab-methods` | all five |
 | `mihrab-methods/sweden`, `/diyanet`, `/morocco`, `/algeria`, `/indonesia` | one authority: its places, list and certification |
-| `mihrab-methods/locate` | `countryAt`, `defaultAuthorityFor` — the country at a point, and the authority whose table it prays by (400 KB of outlines) |
+| `mihrab-methods/locate` | `countryAt`, `defaultAuthorityFor` — the country at a point, and the authority whose table it prays by (470 KB of outlines) |
 | `mihrab-methods/core` | the calls and types with no data (load authorities yourself) |
 
 CommonJS and ES modules, with types. Node 18+, or any bundler; nothing is
@@ -231,7 +231,7 @@ timesFor(place, '2026-10-15');                // or { year: 2026, month: 10, day
 //                                            on the printed minute all but rarely, never a minute further
 //   date: '2026-10-15', certifiedFrom: '2024-01-01', certifiedUntil: '2027-12-31', revision: 1,
 //   clock: { zone: 'Europe/Stockholm', offsetMinutes: 120, label: 'Europe/Stockholm' },
-//   times: { fajr: { instant: Date, printed: '05:13' }, sunrise: …, dhuhr: …, asr: …, maghrib: …, isha: … }
+//   times: { fajr: { instant: Date, printed: '05:09' }, sunrise: …, dhuhr: …, asr: …, maghrib: …, isha: … }
 // }
 timesFor(place, '2031-01-01', { strict: true });   // throws UncertifiedMethodError instead
 timesFor(place, '2026-10-15', { asrShadow: 2 });   // the Hanafi Asr (the tables print the standard one)

package/dist/cjs/authorities/algeria.d.ts

@@ -1,3 +1,3 @@
 import type { Place } from '../core/types.js';
 export declare const algeria: import("../core/registry.js").AuthorityData;
-export declare const places: Place[];
+export declare const places: readonly Place[];

package/dist/cjs/authorities/indonesia.d.ts

@@ -1,4 +1,4 @@
 import type { Place } from '../core/types.js';
 export declare function indonesiaZone(province: string): string;
 export declare const indonesia: import("../core/registry.js").AuthorityData;
-export declare const places: Place[];
+export declare const places: readonly Place[];

package/dist/cjs/authorities/morocco.d.ts

@@ -2,4 +2,4 @@ import type { Place } from '../core/types.js';
 /** The ministry's clock: GMT+1, then GMT — its tables print GMT from 17 September 2026, three days before the clocks moved. */
 export declare const MOROCCO_CLOCK: [string, number][];
 export declare const morocco: import("../core/registry.js").AuthorityData;
-export declare const places: Place[];
+export declare const places: readonly Place[];

package/dist/cjs/authorities/sweden.d.ts

@@ -1,3 +1,3 @@
 import type { Place } from '../core/types.js';
 export declare const sweden: import("../core/registry.js").AuthorityData;
-export declare const places: Place[];
+export declare const places: readonly Place[];

package/dist/cjs/core/api.d.ts

@@ -17,7 +17,7 @@ export declare function certifiedSpan(authority: Authority): {
     to: string;
 } | null;
 /** The authority's places, each at the point its method is computed at. */
-export declare function placesOf(authority: Authority): Place[];
+export declare function placesOf(authority: Authority): readonly Place[];
 /** The authorities this build has loaded. */
 export declare function loadedAuthorityIds(): Authority[];
 /** A place by its stable id (`<authority>:<key>`), among the loaded authorities. */

package/dist/cjs/core/api.js

@@ -38,7 +38,8 @@ function certifiedSpan(authority) {
     if (!isCertified(authority))
         return null;
     const checks = certificationOf(authority).checks;
-    return { from: checks.map(c => c.from).sort()[0], to: checks.map(c => c.to).sort().at(-1) };
+    const tos = checks.map(c => c.to).sort();
+    return { from: checks.map(c => c.from).sort()[0], to: tos[tos.length - 1] };
 }
 /** The authority's places, each at the point its method is computed at. */
 function placesOf(authority) {

package/dist/cjs/core/clock.d.ts

@@ -5,7 +5,14 @@
  * the clocks go forward a Fajr before the change is printed in the new time.
  */
 import type { Place, TableClock } from './types.js';
-/** Minutes east of UTC that a zone keeps at noon UTC of a date (month 0-based). */
+/**
+ * Minutes east of UTC that a zone keeps at noon UTC of a date (month 0-based).
+ *
+ * Read from the zone's wall clock (year … minute, as every Intl has them),
+ * not from `timeZoneName: 'longOffset'`, which not every runtime supports:
+ * where it is missing the name comes back as 'GMT+1' or a zone's own
+ * abbreviation, and an offset parsed from that is silently wrong.
+ */
 export declare function clockOffsetAt(tz: string, year: number, month: number, day: number): number;
 /** The clock a place's table prints a date in: its own (`Place.clock`) where it has one, else its zone's. Month 0-based. */
 export declare function placeClockAt(place: Place, year: number, month: number, day: number): number;

package/dist/cjs/core/clock.js

@@ -5,15 +5,36 @@ exports.placeClockAt = placeClockAt;
 exports.offsetLabel = offsetLabel;
 exports.tableClockAt = tableClockAt;
 exports.printedAt = printedAt;
-const offsetFormats = new Map();
-/** Minutes east of UTC that a zone keeps at noon UTC of a date (month 0-based). */
+const formats = new Map();
+/**
+ * Minutes east of UTC that a zone keeps at noon UTC of a date (month 0-based).
+ *
+ * Read from the zone's wall clock (year … minute, as every Intl has them),
+ * not from `timeZoneName: 'longOffset'`, which not every runtime supports:
+ * where it is missing the name comes back as 'GMT+1' or a zone's own
+ * abbreviation, and an offset parsed from that is silently wrong.
+ */
 function clockOffsetAt(tz, year, month, day) {
-    let f = offsetFormats.get(tz);
-    if (!f)
-        offsetFormats.set(tz, (f = new Intl.DateTimeFormat('en-US', { timeZone: tz, timeZoneName: 'longOffset' })));
-    const z = f.formatToParts(new Date(Date.UTC(year, month, day, 12))).find(x => x.type === 'timeZoneName').value;
-    const m = /GMT([+-])(\d\d):?(\d\d)?/.exec(z);
-    return m ? (m[1] === '-' ? -1 : 1) * (Number(m[2]) * 60 + Number(m[3] ?? 0)) : 0;
+    const at = Date.UTC(year, month, day, 12);
+    let f = formats.get(tz);
+    if (!f) {
+        f = new Intl.DateTimeFormat('en-US', {
+            timeZone: tz,
+            year: 'numeric',
+            month: 'numeric',
+            day: 'numeric',
+            hour: 'numeric',
+            minute: 'numeric',
+            hourCycle: 'h23',
+        });
+        formats.set(tz, f);
+    }
+    const parts = f.formatToParts(new Date(at));
+    const n = (type) => Number(parts.find(p => p.type === type)?.value);
+    const wall = Date.UTC(n('year'), n('month') - 1, n('day'), n('hour') % 24, n('minute'));
+    if (!Number.isFinite(wall))
+        throw new RangeError(`The zone ${tz} could not be read on this runtime.`);
+    return Math.round((wall - at) / 60_000);
 }
 /** The clock a place's table prints a date in: its own (`Place.clock`) where it has one, else its zone's. Month 0-based. */
 function placeClockAt(place, year, month, day) {

package/dist/cjs/core/fetchLatest.d.ts

@@ -9,7 +9,7 @@ export type FetchOptions = {
     baseUrl?: string;
     /** The fetch to use (default: the global one). */
     fetch?: typeof fetch;
-    /** SHA-256 of a UTF-8 string as lowercase hex; default: WebCrypto, else node:crypto, else the hash is not checked. */
+    /** SHA-256 of a UTF-8 string as lowercase hex; default: WebCrypto where there is one, else a built-in digest. */
     sha256?: (text: string) => Promise<string>;
     /** Put a newer list in force in this process (default true). */
     apply?: boolean;
@@ -52,6 +52,10 @@ export type FetchResult =
     have: ListSummary;
 };
 export declare function summarize(list: CorrectionsFile): ListSummary;
+/** UTF-8 bytes of a string, without TextEncoder (not every runtime has it). */
+export declare function utf8(text: string): Uint8Array;
+/** SHA-256 (FIPS 180-4) of bytes. */
+export declare function sha256(data: Uint8Array): Uint8Array;
 /** Put a list in force for the process — one verified by `fetchLatestCorrections`, or restored from the app's own storage. */
 export declare function applyCorrections(authority: Authority, list: CorrectionsFile, revision: number): boolean;
 export declare function fetchLatestCorrections(opts: FetchOptions): Promise<FetchResult>;

package/dist/cjs/core/fetchLatest.js

@@ -1,40 +1,9 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_FEED_URL = void 0;
 exports.summarize = summarize;
+exports.utf8 = utf8;
+exports.sha256 = sha256;
 exports.applyCorrections = applyCorrections;
 exports.fetchLatestCorrections = fetchLatestCorrections;
 /**
@@ -52,20 +21,107 @@ function summarize(list) {
     return { from: list.from, to: list.to, entries: Object.values(list.points).reduce((n, e) => n + e.length, 0) };
 }
 const same = (a, b) => a.from === b.from && a.to === b.to && a.entries === b.entries;
+/**
+ * SHA-256 as lowercase hex. WebCrypto where the runtime has it (browsers,
+ * Node 18+, Deno, Bun); elsewhere — Hermes in React Native has none — the
+ * plain-JavaScript digest below. No `node:crypto` import: a bundler for a
+ * phone or a browser fails on the import itself, used or not.
+ */
 async function defaultSha256(text) {
-    const bytes = new TextEncoder().encode(text);
+    const bytes = utf8(text);
     const subtle = globalThis.crypto?.subtle;
     if (subtle) {
-        const buf = await subtle.digest('SHA-256', bytes);
-        return [...new Uint8Array(buf)].map(b => b.toString(16).padStart(2, '0')).join('');
+        try {
+            const buf = await subtle.digest('SHA-256', bytes);
+            return hex(new Uint8Array(buf));
+        }
+        catch {
+            /* a subtle that refuses (an insecure context): the digest below */
+        }
     }
-    try {
-        const { createHash } = await Promise.resolve().then(() => __importStar(require('node:crypto')));
-        return createHash('sha256').update(bytes).digest('hex');
+    return hex(sha256(bytes));
+}
+const hex = (b) => Array.from(b, x => x.toString(16).padStart(2, '0')).join('');
+/** UTF-8 bytes of a string, without TextEncoder (not every runtime has it). */
+function utf8(text) {
+    const out = [];
+    for (let i = 0; i < text.length; i++) {
+        let c = text.charCodeAt(i);
+        if (c >= 0xd800 && c < 0xdc00 && i + 1 < text.length) {
+            const d = text.charCodeAt(i + 1);
+            if (d >= 0xdc00 && d < 0xe000) {
+                c = 0x10000 + ((c - 0xd800) << 10) + (d - 0xdc00);
+                i++;
+            }
+        }
+        if (c < 0x80)
+            out.push(c);
+        else if (c < 0x800)
+            out.push(0xc0 | (c >> 6), 0x80 | (c & 63));
+        else if (c < 0x10000)
+            out.push(0xe0 | (c >> 12), 0x80 | ((c >> 6) & 63), 0x80 | (c & 63));
+        else
+            out.push(0xf0 | (c >> 18), 0x80 | ((c >> 12) & 63), 0x80 | ((c >> 6) & 63), 0x80 | (c & 63));
     }
-    catch {
-        return null;
+    return Uint8Array.from(out);
+}
+const K = new Uint32Array([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+/** SHA-256 (FIPS 180-4) of bytes. */
+function sha256(data) {
+    const bitLen = data.length * 8;
+    const padded = new Uint8Array(((data.length + 9 + 63) >> 6) << 6);
+    padded.set(data);
+    padded[data.length] = 0x80;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 8, Math.floor(bitLen / 0x100000000));
+    view.setUint32(padded.length - 4, bitLen >>> 0);
+    const h = new Uint32Array([0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19]);
+    const w = new Uint32Array(64);
+    const rotr = (x, n) => (x >>> n) | (x << (32 - n));
+    for (let off = 0; off < padded.length; off += 64) {
+        for (let i = 0; i < 16; i++)
+            w[i] = view.getUint32(off + i * 4);
+        for (let i = 16; i < 64; i++) {
+            const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >>> 3);
+            const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >>> 10);
+            w[i] = (w[i - 16] + s0 + w[i - 7] + s1) >>> 0;
+        }
+        let [a, b, c, d, e, f, g, hh] = h;
+        for (let i = 0; i < 64; i++) {
+            const t1 = (hh + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + ((e & f) ^ (~e & g)) + K[i] + w[i]) >>> 0;
+            const t2 = ((rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + ((a & b) ^ (a & c) ^ (b & c))) >>> 0;
+            hh = g;
+            g = f;
+            f = e;
+            e = (d + t1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (t1 + t2) >>> 0;
+        }
+        h[0] += a;
+        h[1] += b;
+        h[2] += c;
+        h[3] += d;
+        h[4] += e;
+        h[5] += f;
+        h[6] += g;
+        h[7] += hh;
     }
+    const out = new Uint8Array(32);
+    const ov = new DataView(out.buffer);
+    for (let i = 0; i < 8; i++)
+        ov.setUint32(i * 4, h[i]);
+    return out;
 }
 /** Put a list in force for the process — one verified by `fetchLatestCorrections`, or restored from the app's own storage. */
 function applyCorrections(authority, list, revision) {
@@ -123,14 +179,13 @@ async function fetchLatestCorrections(opts) {
     const summary = summarize(list);
     if (!same(summary, named))
         return { status: 'rejected', reason: 'the list is not the one the certification names', have };
+    // A certification without a hash (one written before 1.0.0) is taken on its identity alone.
     let integrity = 'unchecked';
     if (named.sha256) {
         const hash = opts.sha256 ? await opts.sha256(text) : await defaultSha256(text);
-        if (hash !== null) {
-            if (hash.toLowerCase() !== named.sha256.toLowerCase())
-                return { status: 'rejected', reason: 'the list’s SHA-256 is not the one the certification names', have };
-            integrity = 'verified';
-        }
+        if (hash.toLowerCase() !== named.sha256.toLowerCase())
+            return { status: 'rejected', reason: 'the list’s SHA-256 is not the one the certification names', have };
+        integrity = 'verified';
     }
     const applied = opts.apply === false ? false : applyCorrections(opts.authority, list, revision);
     return { status: 'updated', list, summary, integrity, applied };

package/dist/cjs/core/registry.d.ts

@@ -10,7 +10,7 @@ export type MethodDescription = Pick<MethodInfo, 'name' | 'method' | 'countries'
 export type AuthorityData = {
     authority: Authority;
     revision: number;
-    places: Place[];
+    places: readonly Place[];
     corrections: CorrectionList;
     certification: Certification | null;
     description: MethodDescription;

package/dist/cjs/core/registry.js

@@ -10,6 +10,11 @@ function registerAuthority(entry) {
     const have = registry.get(entry.authority);
     if (have)
         return have;
+    // Frozen: every caller shares these objects, and a place moved by one
+    // (`place.lat = …`) would move the corrections it is looked up by for all.
+    for (const p of entry.places)
+        Object.freeze(p);
+    Object.freeze(entry.places);
     const data = { ...entry, corrections: new correctionList_js_1.CorrectionList(entry.corrections) };
     registry.set(entry.authority, data);
     return data;

package/dist/cjs/locate.js

@@ -18,7 +18,7 @@ exports.defaultAuthorityFor = defaultAuthorityFor;
  * that into the authority whose table the point's community prays by, or
  * null where none of the five applies.
  *
- * Its own entry point because the outlines are 400 KB an app that already
+ * Its own entry point because the outlines are 470 KB an app that already
  * knows its country does not need.
  */
 const countryOutlines_js_1 = __importDefault(require("./data/generated/countryOutlines.js"));

package/dist/esm/authorities/algeria.d.ts

@@ -1,3 +1,3 @@
 import type { Place } from '../core/types.js';
 export declare const algeria: import("../core/registry.js").AuthorityData;
-export declare const places: Place[];
+export declare const places: readonly Place[];

package/dist/esm/authorities/indonesia.d.ts

@@ -1,4 +1,4 @@
 import type { Place } from '../core/types.js';
 export declare function indonesiaZone(province: string): string;
 export declare const indonesia: import("../core/registry.js").AuthorityData;
-export declare const places: Place[];
+export declare const places: readonly Place[];

package/dist/esm/authorities/morocco.d.ts

@@ -2,4 +2,4 @@ import type { Place } from '../core/types.js';
 /** The ministry's clock: GMT+1, then GMT — its tables print GMT from 17 September 2026, three days before the clocks moved. */
 export declare const MOROCCO_CLOCK: [string, number][];
 export declare const morocco: import("../core/registry.js").AuthorityData;
-export declare const places: Place[];
+export declare const places: readonly Place[];

package/dist/esm/authorities/sweden.d.ts

@@ -1,3 +1,3 @@
 import type { Place } from '../core/types.js';
 export declare const sweden: import("../core/registry.js").AuthorityData;
-export declare const places: Place[];
+export declare const places: readonly Place[];

package/dist/esm/core/api.d.ts

@@ -17,7 +17,7 @@ export declare function certifiedSpan(authority: Authority): {
     to: string;
 } | null;
 /** The authority's places, each at the point its method is computed at. */
-export declare function placesOf(authority: Authority): Place[];
+export declare function placesOf(authority: Authority): readonly Place[];
 /** The authorities this build has loaded. */
 export declare function loadedAuthorityIds(): Authority[];
 /** A place by its stable id (`<authority>:<key>`), among the loaded authorities. */

package/dist/esm/core/api.js

@@ -24,7 +24,8 @@ export function certifiedSpan(authority) {
     if (!isCertified(authority))
         return null;
     const checks = certificationOf(authority).checks;
-    return { from: checks.map(c => c.from).sort()[0], to: checks.map(c => c.to).sort().at(-1) };
+    const tos = checks.map(c => c.to).sort();
+    return { from: checks.map(c => c.from).sort()[0], to: tos[tos.length - 1] };
 }
 /** The authority's places, each at the point its method is computed at. */
 export function placesOf(authority) {

package/dist/esm/core/clock.d.ts

@@ -5,7 +5,14 @@
  * the clocks go forward a Fajr before the change is printed in the new time.
  */
 import type { Place, TableClock } from './types.js';
-/** Minutes east of UTC that a zone keeps at noon UTC of a date (month 0-based). */
+/**
+ * Minutes east of UTC that a zone keeps at noon UTC of a date (month 0-based).
+ *
+ * Read from the zone's wall clock (year … minute, as every Intl has them),
+ * not from `timeZoneName: 'longOffset'`, which not every runtime supports:
+ * where it is missing the name comes back as 'GMT+1' or a zone's own
+ * abbreviation, and an offset parsed from that is silently wrong.
+ */
 export declare function clockOffsetAt(tz: string, year: number, month: number, day: number): number;
 /** The clock a place's table prints a date in: its own (`Place.clock`) where it has one, else its zone's. Month 0-based. */
 export declare function placeClockAt(place: Place, year: number, month: number, day: number): number;

package/dist/esm/core/clock.js

@@ -1,12 +1,33 @@
-const offsetFormats = new Map();
-/** Minutes east of UTC that a zone keeps at noon UTC of a date (month 0-based). */
+const formats = new Map();
+/**
+ * Minutes east of UTC that a zone keeps at noon UTC of a date (month 0-based).
+ *
+ * Read from the zone's wall clock (year … minute, as every Intl has them),
+ * not from `timeZoneName: 'longOffset'`, which not every runtime supports:
+ * where it is missing the name comes back as 'GMT+1' or a zone's own
+ * abbreviation, and an offset parsed from that is silently wrong.
+ */
 export function clockOffsetAt(tz, year, month, day) {
-    let f = offsetFormats.get(tz);
-    if (!f)
-        offsetFormats.set(tz, (f = new Intl.DateTimeFormat('en-US', { timeZone: tz, timeZoneName: 'longOffset' })));
-    const z = f.formatToParts(new Date(Date.UTC(year, month, day, 12))).find(x => x.type === 'timeZoneName').value;
-    const m = /GMT([+-])(\d\d):?(\d\d)?/.exec(z);
-    return m ? (m[1] === '-' ? -1 : 1) * (Number(m[2]) * 60 + Number(m[3] ?? 0)) : 0;
+    const at = Date.UTC(year, month, day, 12);
+    let f = formats.get(tz);
+    if (!f) {
+        f = new Intl.DateTimeFormat('en-US', {
+            timeZone: tz,
+            year: 'numeric',
+            month: 'numeric',
+            day: 'numeric',
+            hour: 'numeric',
+            minute: 'numeric',
+            hourCycle: 'h23',
+        });
+        formats.set(tz, f);
+    }
+    const parts = f.formatToParts(new Date(at));
+    const n = (type) => Number(parts.find(p => p.type === type)?.value);
+    const wall = Date.UTC(n('year'), n('month') - 1, n('day'), n('hour') % 24, n('minute'));
+    if (!Number.isFinite(wall))
+        throw new RangeError(`The zone ${tz} could not be read on this runtime.`);
+    return Math.round((wall - at) / 60_000);
 }
 /** The clock a place's table prints a date in: its own (`Place.clock`) where it has one, else its zone's. Month 0-based. */
 export function placeClockAt(place, year, month, day) {

package/dist/esm/core/fetchLatest.d.ts

@@ -9,7 +9,7 @@ export type FetchOptions = {
     baseUrl?: string;
     /** The fetch to use (default: the global one). */
     fetch?: typeof fetch;
-    /** SHA-256 of a UTF-8 string as lowercase hex; default: WebCrypto, else node:crypto, else the hash is not checked. */
+    /** SHA-256 of a UTF-8 string as lowercase hex; default: WebCrypto where there is one, else a built-in digest. */
     sha256?: (text: string) => Promise<string>;
     /** Put a newer list in force in this process (default true). */
     apply?: boolean;
@@ -52,6 +52,10 @@ export type FetchResult =
     have: ListSummary;
 };
 export declare function summarize(list: CorrectionsFile): ListSummary;
+/** UTF-8 bytes of a string, without TextEncoder (not every runtime has it). */
+export declare function utf8(text: string): Uint8Array;
+/** SHA-256 (FIPS 180-4) of bytes. */
+export declare function sha256(data: Uint8Array): Uint8Array;
 /** Put a list in force for the process — one verified by `fetchLatestCorrections`, or restored from the app's own storage. */
 export declare function applyCorrections(authority: Authority, list: CorrectionsFile, revision: number): boolean;
 export declare function fetchLatestCorrections(opts: FetchOptions): Promise<FetchResult>;

package/dist/esm/core/fetchLatest.js

@@ -13,20 +13,107 @@ export function summarize(list) {
     return { from: list.from, to: list.to, entries: Object.values(list.points).reduce((n, e) => n + e.length, 0) };
 }
 const same = (a, b) => a.from === b.from && a.to === b.to && a.entries === b.entries;
+/**
+ * SHA-256 as lowercase hex. WebCrypto where the runtime has it (browsers,
+ * Node 18+, Deno, Bun); elsewhere — Hermes in React Native has none — the
+ * plain-JavaScript digest below. No `node:crypto` import: a bundler for a
+ * phone or a browser fails on the import itself, used or not.
+ */
 async function defaultSha256(text) {
-    const bytes = new TextEncoder().encode(text);
+    const bytes = utf8(text);
     const subtle = globalThis.crypto?.subtle;
     if (subtle) {
-        const buf = await subtle.digest('SHA-256', bytes);
-        return [...new Uint8Array(buf)].map(b => b.toString(16).padStart(2, '0')).join('');
+        try {
+            const buf = await subtle.digest('SHA-256', bytes);
+            return hex(new Uint8Array(buf));
+        }
+        catch {
+            /* a subtle that refuses (an insecure context): the digest below */
+        }
     }
-    try {
-        const { createHash } = await import('node:crypto');
-        return createHash('sha256').update(bytes).digest('hex');
+    return hex(sha256(bytes));
+}
+const hex = (b) => Array.from(b, x => x.toString(16).padStart(2, '0')).join('');
+/** UTF-8 bytes of a string, without TextEncoder (not every runtime has it). */
+export function utf8(text) {
+    const out = [];
+    for (let i = 0; i < text.length; i++) {
+        let c = text.charCodeAt(i);
+        if (c >= 0xd800 && c < 0xdc00 && i + 1 < text.length) {
+            const d = text.charCodeAt(i + 1);
+            if (d >= 0xdc00 && d < 0xe000) {
+                c = 0x10000 + ((c - 0xd800) << 10) + (d - 0xdc00);
+                i++;
+            }
+        }
+        if (c < 0x80)
+            out.push(c);
+        else if (c < 0x800)
+            out.push(0xc0 | (c >> 6), 0x80 | (c & 63));
+        else if (c < 0x10000)
+            out.push(0xe0 | (c >> 12), 0x80 | ((c >> 6) & 63), 0x80 | (c & 63));
+        else
+            out.push(0xf0 | (c >> 18), 0x80 | ((c >> 12) & 63), 0x80 | ((c >> 6) & 63), 0x80 | (c & 63));
     }
-    catch {
-        return null;
+    return Uint8Array.from(out);
+}
+const K = new Uint32Array([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+/** SHA-256 (FIPS 180-4) of bytes. */
+export function sha256(data) {
+    const bitLen = data.length * 8;
+    const padded = new Uint8Array(((data.length + 9 + 63) >> 6) << 6);
+    padded.set(data);
+    padded[data.length] = 0x80;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 8, Math.floor(bitLen / 0x100000000));
+    view.setUint32(padded.length - 4, bitLen >>> 0);
+    const h = new Uint32Array([0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19]);
+    const w = new Uint32Array(64);
+    const rotr = (x, n) => (x >>> n) | (x << (32 - n));
+    for (let off = 0; off < padded.length; off += 64) {
+        for (let i = 0; i < 16; i++)
+            w[i] = view.getUint32(off + i * 4);
+        for (let i = 16; i < 64; i++) {
+            const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >>> 3);
+            const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >>> 10);
+            w[i] = (w[i - 16] + s0 + w[i - 7] + s1) >>> 0;
+        }
+        let [a, b, c, d, e, f, g, hh] = h;
+        for (let i = 0; i < 64; i++) {
+            const t1 = (hh + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + ((e & f) ^ (~e & g)) + K[i] + w[i]) >>> 0;
+            const t2 = ((rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + ((a & b) ^ (a & c) ^ (b & c))) >>> 0;
+            hh = g;
+            g = f;
+            f = e;
+            e = (d + t1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (t1 + t2) >>> 0;
+        }
+        h[0] += a;
+        h[1] += b;
+        h[2] += c;
+        h[3] += d;
+        h[4] += e;
+        h[5] += f;
+        h[6] += g;
+        h[7] += hh;
     }
+    const out = new Uint8Array(32);
+    const ov = new DataView(out.buffer);
+    for (let i = 0; i < 8; i++)
+        ov.setUint32(i * 4, h[i]);
+    return out;
 }
 /** Put a list in force for the process — one verified by `fetchLatestCorrections`, or restored from the app's own storage. */
 export function applyCorrections(authority, list, revision) {
@@ -84,14 +171,13 @@ export async function fetchLatestCorrections(opts) {
     const summary = summarize(list);
     if (!same(summary, named))
         return { status: 'rejected', reason: 'the list is not the one the certification names', have };
+    // A certification without a hash (one written before 1.0.0) is taken on its identity alone.
     let integrity = 'unchecked';
     if (named.sha256) {
         const hash = opts.sha256 ? await opts.sha256(text) : await defaultSha256(text);
-        if (hash !== null) {
-            if (hash.toLowerCase() !== named.sha256.toLowerCase())
-                return { status: 'rejected', reason: 'the list’s SHA-256 is not the one the certification names', have };
-            integrity = 'verified';
-        }
+        if (hash.toLowerCase() !== named.sha256.toLowerCase())
+            return { status: 'rejected', reason: 'the list’s SHA-256 is not the one the certification names', have };
+        integrity = 'verified';
     }
     const applied = opts.apply === false ? false : applyCorrections(opts.authority, list, revision);
     return { status: 'updated', list, summary, integrity, applied };

package/dist/esm/core/registry.d.ts

@@ -10,7 +10,7 @@ export type MethodDescription = Pick<MethodInfo, 'name' | 'method' | 'countries'
 export type AuthorityData = {
     authority: Authority;
     revision: number;
-    places: Place[];
+    places: readonly Place[];
     corrections: CorrectionList;
     certification: Certification | null;
     description: MethodDescription;

package/dist/esm/core/registry.js

@@ -4,6 +4,11 @@ export function registerAuthority(entry) {
     const have = registry.get(entry.authority);
     if (have)
         return have;
+    // Frozen: every caller shares these objects, and a place moved by one
+    // (`place.lat = …`) would move the corrections it is looked up by for all.
+    for (const p of entry.places)
+        Object.freeze(p);
+    Object.freeze(entry.places);
     const data = { ...entry, corrections: new CorrectionList(entry.corrections) };
     registry.set(entry.authority, data);
     return data;

package/dist/esm/locate.js

@@ -10,7 +10,7 @@
  * that into the authority whose table the point's community prays by, or
  * null where none of the five applies.
  *
- * Its own entry point because the outlines are 400 KB an app that already
+ * Its own entry point because the outlines are 470 KB an app that already
  * knows its country does not need.
  */
 import outlines from './data/generated/countryOutlines.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mihrab-methods",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "The prayer-time authorities' own calculation methods, each reproducing its published timetable to the minute: Sweden (Diyanet, as Islamiska Förbundet prints it), Diyanet worldwide, Morocco (Habous), Algeria (Ministry of Religious Affairs), Indonesia (Kemenag).",
   "license": "MPL-2.0",
   "author": "Hassan El Ghamri",