rapier-html 1.1.102 → 1.2.3

package/dist/ledger/format.mjs

@@ -1,13 +1,33 @@
 // SPDX-License-Identifier: MIT
-import {_rapierValidLedgerRecord, _rapierRecordSplices, _rapierTransformSplices, _rapierRecordMetadata, _rapierValidMetadata, _rapierTransformMetadata, _rapierReplayMetadata, _rapierHistoryEffects} from './journal-records.mjs';
+import {_rapierPrepareHistoryRecords, _rapierValidMetadata, _rapierTransformMetadata} from './journal-records.mjs';
 import {pictureHistorySplices} from './history.mjs';
+import {HistorySource} from './inverse-source.mjs';
 import {authoredHistory} from './transport.mjs';
-import {textRoot, rootAfter, sha256} from './hash.mjs';
-import {canonicalJSON, plainData, documentText, exactKeys, nonnegative, fault} from './data.mjs';
+import {textRoot, rootAfter, sha256, sha256Parts, createSHA256} from './hash.mjs';
+import {canonicalJSON, canonicalParts, plainData, documentText, utf8Length, exactKeys, nonnegative, fault} from './data.mjs';
 export {textRoot, rootAfter};
-const digest = value => sha256(canonicalJSON(value));
+const digest = value => sha256Parts(canonicalParts(value));
 const rootShape = value => typeof value === 'string' && /^\d+:[a-z0-9]+:[a-z0-9]+$/.test(value);
-export function readLedger(input, expectedText, expectedMetadata) {
+// Structural/history admission is shared by the reader and the producer. The producer
+// proves source replay by reversing exact admitted splices; it need not replay its output.
+function* checkedRecords(ledger, prepared) {
+  if (!prepared.ok || ledger.records.length !== prepared.records.length) throw fault('record chain differs');
+  let root = ledger.start.root, revision = ledger.start.revision;
+  for (let index = 0; index < prepared.records.length; index++) {
+    const record = ledger.records[index];
+    if (!Array.isArray(record.splices) || !prepared.validRecord(index,
+        ledger.documentAuthority, 64 * 1024 * 1024, utf8Length, !ledger.complete) ||
+        record.transaction.baseRevision < revision || (record.transaction.baseRevision !== revision && ledger.complete) ||
+        (record.transaction.baseRevision === revision && record.beforeHash !== root)) throw fault('record chain differs');
+    if (record.transaction.baseRevision !== revision) root = record.beforeHash;
+    for (const row of record.splices) root = rootAfter(root, row);
+    if (root !== record.afterHash) throw fault('record root differs');
+    revision = record.transaction.revision;
+    yield record;
+  }
+  if (ledger.head.revision !== revision || ledger.head.root !== root) throw fault('history does not describe this document');
+}
+function readLedgerState(input, expectedText, expectedMetadata) {
   const ledger = plainData(input);
   if (!exactKeys(ledger, ['format','documentAuthority','start','records','head','complete','sha256']) || ledger.format !== 'rapier-ledger/2' ||
       typeof ledger.documentAuthority !== 'string' || !ledger.documentAuthority || ledger.documentAuthority.length > 256 ||
@@ -19,102 +39,204 @@ export function readLedger(input, expectedText, expectedMetadata) {
   if (!_rapierValidMetadata(ledger.start.metadata) || !_rapierValidMetadata(ledger.head.metadata)) throw fault('invalid document metadata');
   if (!nonnegative(revision) || !rootShape(root) || (revision === 0 && root !== textRoot(text)) || ledger.start.sha256 !== sha256(text) ||
       (ledger.complete && revision !== 0)) throw fault('invalid start');
-  const earlier = [];
-  for (const record of ledger.records) {
-    if (!Array.isArray(record.splices) || !_rapierValidLedgerRecord(record, earlier.at(-1) || null, earlier,
-        ledger.documentAuthority, 64 * 1024 * 1024, text => new TextEncoder().encode(text).length, !ledger.complete) ||
-        record.transaction.baseRevision < revision || (record.transaction.baseRevision !== revision && ledger.complete) ||
-        (record.transaction.baseRevision === revision && record.beforeHash !== root)) throw fault('record chain differs');
-    // A pruned cancelling pair leaves a stated revision gap, just as in the editor's restore reader.
-    if (record.transaction.baseRevision !== revision) root = record.beforeHash;
-    const next = _rapierTransformSplices(text, record.splices);
+  const prepared = _rapierPrepareHistoryRecords(ledger.records);
+  if (!prepared.ok) throw fault('record chain differs');
+  let source = new HistorySource(text), bytes = utf8Length(text);
+  for (const record of checkedRecords(ledger, prepared)) {
+    const next = source.apply(record.splices);
     if (next === null) throw fault('splice does not replay');
-    text = documentText(next);
-    for (const row of record.splices) root = rootAfter(root, row);
-    if (root !== record.afterHash) throw fault('record root differs');
-    revision = record.transaction.revision; earlier.push(record);
+    source = next;
+    for (const row of record.splices) bytes += utf8Length(row.inserted) - utf8Length(row.removed);
+    if (bytes > 64 * 1024 * 1024) throw fault('document exceeds the editor text limit');
+    root = record.afterHash; revision = record.transaction.revision;
   }
+  text = source.slice();
   if (ledger.records.some(row => Object.hasOwn(row, 'authored'))) {
     try { authoredHistory(ledger.start.text, ledger.records); } catch (_) { throw fault('authored origin differs'); }
   }
-  const metadata = _rapierReplayMetadata(ledger.start.metadata, ledger.records);
+  const metadata = prepared.replayMetadata(ledger.start.metadata);
   if (!metadata || canonicalJSON(metadata) !== canonicalJSON(ledger.head.metadata) ||
       (expectedMetadata !== undefined && (!_rapierValidMetadata(expectedMetadata) || canonicalJSON(metadata) !== canonicalJSON(expectedMetadata))))
     throw fault('metadata does not describe this document');
   if (ledger.head.revision !== revision || ledger.head.root !== root || ledger.head.sha256 !== sha256(text) ||
       (expectedText !== undefined && text !== expectedText)) throw fault('history does not describe this document');
-  return {ledger, text, metadata, root, revision, complete: ledger.complete};
+  return {value: {ledger, text, metadata, root, revision, complete: ledger.complete}, prepared, source};
+}
+// A stored copy may hold the head text alone. Its start is that text with every record reversed; readLedger proves it.
+export function ledgerWithStart(input, text) {
+  let source = new HistorySource(documentText(text));
+  for (let i = input.records.length - 1; i >= 0; i--) {
+    source = source.apply(input.records[i].splices, true);
+    if (source === null) throw fault('history does not reverse from this document');
+  }
+  return {...input, start: {...input.start, text: source.slice()}};
 }
-export function exportLedger({text, metadata, records, documentAuthority, revision, root, complete = false, earlier = records} = {}) {
-  documentText(text);
+export function readLedger(input, expectedText, expectedMetadata) {
+  return readLedgerState(input, expectedText, expectedMetadata).value;
+}
+function* checksum(parts) {
+  const hash = createSHA256();
+  for (const part of parts) { hash.update(part); yield; }
+  return hash.digest();
+}
+function* sourceFacts(text) {
+  if (typeof text !== 'string') throw fault('document is not whole-character text');
+  const hash = createSHA256();
+  let fnv = 0x811c9dc5, a = 1, b = 0, bytes = 0;
+  for (let at = 0; at < text.length;) {
+    const start = at, end = Math.min(text.length, at + 65536);
+    for (; at < end;) {
+      const stop = Math.min(end, at + 4096);
+      for (; at < stop; at++) {
+        const code = text.charCodeAt(at);
+        fnv = Math.imul(fnv ^ code, 16777619); a += code; b += a;
+        if (code < 0x80) bytes++;
+        else if (code < 0x800) bytes += 2;
+        else if ((code & 0xfc00) === 0xd800) {
+          if ((text.charCodeAt(at + 1) & 0xfc00) !== 0xdc00) throw fault('document is not whole-character text');
+          bytes += 3;
+        } else if ((code & 0xfc00) === 0xdc00) {
+          if (!at || (text.charCodeAt(at - 1) & 0xfc00) !== 0xd800) throw fault('document is not whole-character text');
+          bytes++;
+        } else bytes += 3;
+      }
+      a %= 65521; b %= 65521;
+    }
+    if (bytes > 64 * 1024 * 1024) throw fault('document exceeds the editor text limit');
+    hash.update(text.slice(start, end)); yield;
+  }
+  return {utf8Bytes: bytes, sha256: hash.digest(), contentRoot: text.length + ':' +
+    (fnv >>> 0).toString(36) + ':' + (((b << 16) | a) >>> 0).toString(36)};
+}
+function* produceLedger({text, metadata, records, documentAuthority, revision, root, complete = false, earlier = records} = {}) {
   if (!_rapierValidMetadata(metadata)) throw fault('document metadata required');
+  // Metadata has two admitted scalar fields. Keep its insertion order in the
+  // emitted envelope while capturing it before the first cooperative boundary.
+  metadata = {...metadata};
   if (!Array.isArray(records) || !Array.isArray(earlier)) throw fault('records required');
   // Inspect before touching properties: exporting must not call accessors on an alleged record.
-  records = plainData(records); earlier = plainData(earlier);
-  const expanded = records.map(record => {
-    const rows = _rapierRecordSplices(record, earlier), effect = _rapierRecordMetadata(record, earlier);
+  const prepared = _rapierPrepareHistoryRecords(records, earlier);
+  if (!prepared.ok) throw fault('navigation target was not retained');
+  const headFacts = yield* sourceFacts(text);
+  let bytes = headFacts.utf8Bytes;
+  const expanded = [];
+  for (const {record, splices: rows, metadata: effect} of prepared.rows) {
     if (!rows || effect === undefined) throw fault('navigation target was not retained');
-    return {transaction: record.transaction, splices: rows.map(row => ({pos: row.pos, removed: row.removed, inserted: row.inserted})),
-      beforeHash: record.beforeHash, afterHash: record.afterHash, ...(Object.hasOwn(record, 'authored') ? {authored: record.authored} : {}), ...(effect ? {metadata: effect} : {}),
-      ...(record.changeSet && Object.hasOwn(record.changeSet, 'label') ? {changeSet: {label: record.changeSet.label}} : {}),
-      ...(record.derivedCommentIndex == null ? {} : {derivedCommentIndex: record.derivedCommentIndex})};
-  });
-  let startText = text, startMetadata = {...metadata};
+    expanded.push({transaction: plainData(record.transaction), splices: rows.map(row => ({pos: row.pos, removed: row.removed, inserted: row.inserted})),
+      beforeHash: record.beforeHash, afterHash: record.afterHash, ...(Object.hasOwn(record, 'authored') ? {authored: plainData(record.authored)} : {}), ...(effect ? {metadata: plainData(effect)} : {}),
+      ...(record.changeSet && Object.hasOwn(record.changeSet, 'label') ? {changeSet: {label: typeof record.changeSet.label === 'string' ? record.changeSet.label : plainData(record.changeSet.label)}} : {}),
+      ...(record.derivedCommentIndex == null ? {} : {derivedCommentIndex: typeof record.derivedCommentIndex === 'string' ? record.derivedCommentIndex : plainData(record.derivedCommentIndex)})});
+    yield;
+  }
+  const headBytes = bytes;
+  let startSource = new HistorySource(text), startMetadata = {...metadata};
   for (let i = expanded.length - 1; i >= 0; i--) {
-    startText = _rapierTransformSplices(startText, expanded[i].splices, true);
+    startSource = startSource.apply(expanded[i].splices, true);
     startMetadata = _rapierTransformMetadata(startMetadata, expanded[i].metadata, true);
-    if (startText === null || !startMetadata) throw fault('history does not reverse from this document');
+    if (startSource === null || !startMetadata) throw fault('history does not reverse from this document');
+    // Whole scalars and exact splice boundaries were just checked. Count the changed
+    // bytes, rather than re-encoding every reconstructed whole-document revision.
+    for (const row of expanded[i].splices) bytes += utf8Length(row.removed) - utf8Length(row.inserted);
+    if (bytes > 64 * 1024 * 1024) throw fault('document exceeds the editor text limit');
+    yield;
   }
+  const startText = startSource.slice();
+  const unchangedText = expanded.every(row => !row.splices.length);
+  const contentRoot = headFacts.contentRoot;
   revision ??= expanded.at(-1)?.transaction.revision ?? 0;
-  root ??= expanded.at(-1)?.afterHash ?? textRoot(text);
+  root ??= expanded.at(-1)?.afterHash ?? contentRoot;
   documentAuthority ??= expanded[0]?.transaction.documentAuthority;
-  const startRevision = expanded[0]?.transaction.baseRevision ?? revision;
+  const startRevision = expanded[0]?.transaction.baseRevision ?? revision, startRoot = expanded[0]?.beforeHash ?? root;
+  if (typeof documentAuthority !== 'string' || !documentAuthority || documentAuthority.length > 256) throw fault('unsupported or invalid envelope');
+  if (!nonnegative(startRevision) || !rootShape(startRoot)) throw fault('invalid start');
+  const startFacts = unchangedText ? headFacts : yield* sourceFacts(startText);
+  if (startRevision === 0 && startRoot !== startFacts.contentRoot) throw fault('invalid start');
+  const headSHA = headFacts.sha256, startSHA = startFacts.sha256;
   const payload = {format: 'rapier-ledger/2', documentAuthority,
-    start: {text: startText, revision: startRevision, root: expanded[0]?.beforeHash ?? root, sha256: sha256(startText), metadata: startMetadata},
-    records: expanded, head: {revision, root, sha256: sha256(text), metadata: {...metadata}}, complete: complete === true && startRevision === 0 && expanded.every((row, i) => !i || row.transaction.baseRevision === expanded[i - 1].transaction.revision)};
-  const ledger = {...payload, sha256: digest(payload)};
-  readLedger(ledger, text, metadata); return ledger;
+    start: {text: startText, revision: startRevision, root: startRoot, sha256: startSHA, metadata: startMetadata},
+    records: expanded, head: {revision, root, sha256: headSHA, metadata: {...metadata}}, complete: complete === true && startRevision === 0 && expanded.every((row, i) => !i || row.transaction.baseRevision === expanded[i - 1].transaction.revision)};
+  // Expanded rows are the exact canonical projection of this owned preparation.
+  // Keep its navigation/effect proof instead of admitting another copied graph.
+  for (const _record of checkedRecords(payload, prepared)) yield;
+  if (expanded.some(row => Object.hasOwn(row, 'authored'))) {
+    try { authoredHistory(startText, expanded); } catch (_) { throw fault('authored origin differs'); }
+  }
+  const replayedMetadata = prepared.replayMetadata(startMetadata);
+  if (!replayedMetadata || canonicalJSON(replayedMetadata) !== canonicalJSON(metadata)) throw fault('metadata does not describe this document');
+  const ledger = {...payload, sha256: yield* checksum(canonicalParts(payload))};
+  return {ledger, contentRoot, utf8Bytes: headBytes};
+}
+function finish(producer) {
+  let step;
+  do { step = producer.next(); } while (!step.done);
+  return step.value;
+}
+export function exportLedger(input) { return finish(produceLedger(input)).ledger; }
+// Both synchronous public export and cooperative recovery use the same producer.
+// Its returned facts were computed while admitting/hashing the exact head, never supplied.
+export function prepareLedger(input) { return finish(produceLedger(input)); }
+export async function prepareLedgerAsync(input, {yield: yieldWork, signal} = {}) {
+  const producer = produceLedger(input);
+  let step;
+  do {
+    signal?.throwIfAborted();
+    step = producer.next();
+    if (!step.done && yieldWork) {
+      // The caller owns scheduling and its clock; ledger admission reads neither.
+      const pending = yieldWork();
+      if (pending) await pending;
+    }
+  } while (!step.done);
+  signal?.throwIfAborted();
+  return step.value;
 }
 // Derived navigation, never a second history. A target older than start is intentionally unavailable.
-export function historyEnvelope(input, segmentIdentity = []) {
-  const {ledger, text, metadata} = readLedger(input), ids = new Set(ledger.records.map(row => row.transaction.id));
-  const pictures = _rapierHistoryEffects(ledger.records).pictures;
+export function historyEnvelope(input, segmentIdentity = [], expectedText, expectedMetadata) {
+  const {value: {ledger, text, metadata}, prepared, source} = readLedgerState(input, expectedText, expectedMetadata);
+  const {byId, effects: {pictures}} = prepared;
   let branch = [], cursor = 0;
   for (const {transaction: tx} of ledger.records) {
     if (pictures.has(tx.id)) continue;
     const target = tx.reverts || tx.reapplies;
     if (target) {
-      if (!ids.has(target)) continue;
+      if (!byId.has(target)) continue;
       if (tx.reverts && branch[cursor - 1] === target) cursor--;
       else if (tx.reapplies && branch[cursor] === target) cursor++;
       else throw fault('invalid navigation order');
-    } else { branch = branch.slice(0, cursor); branch.push(tx.id); cursor = branch.length; }
+    } else { branch.length = cursor; branch.push(tx.id); cursor = branch.length; }
   }
-  const byId = new Map(ledger.records.map(row => [row.transaction.id, row]));
   const step = (source, id, redo) => {
-    const target = byId.get(id), folded = pictureHistorySplices({source, records: ledger.records}, target, redo);
-    return _rapierTransformSplices(source, folded || target.splices, !folded && !redo);
+    const target = byId.get(id), folded = pictures.size
+      ? pictureHistorySplices({get source() { return source.slice(); }, records: prepared.records}, target, redo) : null;
+    return source.apply(folded || target.splices, !folded && !redo);
   };
-  let traversed = text, traversedMetadata = {...metadata};
+  let traversed = source, traversedMetadata = {...metadata};
   for (let i = cursor - 1; i >= 0; i--) {
     traversed = step(traversed, branch[i], false);
     traversedMetadata = _rapierTransformMetadata(traversedMetadata, byId.get(branch[i]).metadata, true);
     if (traversed === null || !traversedMetadata) throw fault('undo branch does not reverse');
   }
-  traversed = text; traversedMetadata = {...metadata};
+  if (ledger.complete) {
+    if (ledger.records.length && !branch.length) throw fault('complete history lost its branch');
+    // Literal admitted splices are reversible. Proving the actual head back to
+    // the exact start also proves its forward active branch, without replaying it.
+    if (traversed.length !== ledger.start.text.length || !traversed.matches(0, ledger.start.text) ||
+        canonicalJSON(traversedMetadata) !== canonicalJSON(ledger.start.metadata)) throw fault('complete branch differs');
+  }
+  traversed = source; traversedMetadata = {...metadata};
   for (let i = cursor; i < branch.length; i++) {
     traversed = step(traversed, branch[i], true);
     traversedMetadata = _rapierTransformMetadata(traversedMetadata, byId.get(branch[i]).metadata);
     if (traversed === null || !traversedMetadata) throw fault('redo branch does not replay');
   }
-  if (ledger.complete) {
-    if (ledger.records.length && !branch.length) throw fault('complete history lost its branch');
-    let active = ledger.start.text, activeMetadata = {...ledger.start.metadata};
-    if (!cursor && (active !== text || canonicalJSON(activeMetadata) !== canonicalJSON(metadata))) throw fault('complete history start differs');
+  // Picture folding may relocate finished definitions while navigating. Keep its
+  // distinct forward proof; the literal-only case above needs no second traversal.
+  if (ledger.complete && pictures.size) {
+    let active = new HistorySource(ledger.start.text), activeMetadata = {...ledger.start.metadata};
     for (let i = 0; i < branch.length; i++) {
       active = step(active, branch[i], true);
       activeMetadata = _rapierTransformMetadata(activeMetadata, byId.get(branch[i]).metadata);
-      if (active === null || !activeMetadata || (i + 1 === cursor && (active !== text || canonicalJSON(activeMetadata) !== canonicalJSON(metadata)))) throw fault('complete branch differs');
+      if (active === null || !activeMetadata || (i + 1 === cursor && (active.length !== text.length || !active.matches(0, text) || canonicalJSON(activeMetadata) !== canonicalJSON(metadata)))) throw fault('complete branch differs');
     }
   }
   return {schemaVersion: 5, documentAuthority: ledger.documentAuthority, documentRevision: ledger.head.revision,

package/dist/ledger/hash.mjs

@@ -1,12 +1,20 @@
 // SPDX-License-Identifier: MIT
 // The editor's path-dependent root, plus synchronous SHA-256 for file readers (including offline wrappers).
 export function textRoot(text) {
-  let fnv = 0x811c9dc5, a = 1, b = 0;
-  for (let i = 0; i < text.length; i++) {
-    const c = text.charCodeAt(i);
-    fnv = Math.imul(fnv ^ c, 16777619); a = (a + c) % 65521; b = (b + a) % 65521;
+  return textRootParts([text]);
+}
+// The same UTF-16 root over shared source pieces, without joining a historical body.
+export function textRootParts(parts) {
+  let fnv = 0x811c9dc5, a = 1, b = 0, length = 0;
+  for (const text of parts) {
+    length += text.length;
+    for (let i = 0; i < text.length;) {
+      const end = Math.min(text.length, i + 4096);
+      for (; i < end; i++) { const c = text.charCodeAt(i); fnv = Math.imul(fnv ^ c, 16777619); a += c; b += a; }
+      a %= 65521; b %= 65521;
+    }
   }
-  return text.length + ':' + (fnv >>> 0).toString(36) + ':' + (((b << 16) | a) >>> 0).toString(36);
+  return length + ':' + (fnv >>> 0).toString(36) + ':' + (((b << 16) | a) >>> 0).toString(36);
 }
 export function rootAfter(root, row) {
   return textRoot(String(root || '') + ':' + row.pos + ':' + textRoot(row.removed) + ':' + textRoot(row.inserted));
@@ -22,26 +30,91 @@ const K = new Uint32Array([
   0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208,0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2,
 ]);
 const rotate = (x, n) => (x >>> n) | (x << (32 - n));
-export function sha256(text) {
-  const bytes = new TextEncoder().encode(text);
-  const padded = new Uint8Array(Math.ceil((bytes.length + 9) / 64) * 64);
-  padded.set(bytes); padded[bytes.length] = 0x80;
-  const data = new DataView(padded.buffer), bits = bytes.length * 8;
-  data.setUint32(padded.length - 8, Math.floor(bits / 0x100000000)); data.setUint32(padded.length - 4, bits >>> 0);
-  const h = new Uint32Array([0x6a09e667,0xbb67ae85,0x3c6ef372,0xa54ff53a,0x510e527f,0x9b05688c,0x1f83d9ab,0x5be0cd19]), w = new Uint32Array(64);
-  for (let offset = 0; offset < padded.length; offset += 64) {
-    for (let i = 0; i < 16; i++) w[i] = data.getUint32(offset + i * 4);
+// One bounded SHA-256 compression state for file bytes and encoded source text.
+export function sha256State() {
+  const h = new Uint32Array([0x6a09e667,0xbb67ae85,0x3c6ef372,0xa54ff53a,0x510e527f,0x9b05688c,0x1f83d9ab,0x5be0cd19]);
+  const w = new Uint32Array(64), block = new Uint8Array(64);
+  let used = 0, bytes = 0, finished = false;
+  const compress = (input, offset) => {
+    for (let i = 0; i < 16; i++) {
+      const at = offset + i * 4;
+      w[i] = (input[at] << 24) | (input[at + 1] << 16) | (input[at + 2] << 8) | input[at + 3];
+    }
     for (let i = 16; i < 64; i++) {
       const x = w[i - 15], y = w[i - 2];
       w[i] = w[i - 16] + (rotate(x, 7) ^ rotate(x, 18) ^ (x >>> 3)) + w[i - 7] + (rotate(y, 17) ^ rotate(y, 19) ^ (y >>> 10));
     }
-    let [a,b,c,d,e,f,g,k] = h;
+    let a=h[0], b=h[1], c=h[2], d=h[3], e=h[4], f=h[5], g=h[6], k=h[7];
     for (let i = 0; i < 64; i++) {
       const t1 = (k + (rotate(e, 6) ^ rotate(e, 11) ^ rotate(e, 25)) + ((e & f) ^ (~e & g)) + K[i] + w[i]) >>> 0;
       const t2 = ((rotate(a, 2) ^ rotate(a, 13) ^ rotate(a, 22)) + ((a & b) ^ (a & c) ^ (b & c))) >>> 0;
       k = g; g = f; f = e; e = (d + t1) >>> 0; d = c; c = b; b = a; a = (t1 + t2) >>> 0;
     }
-    for (const [i, value] of [a,b,c,d,e,f,g,k].entries()) h[i] += value;
-  }
-  return [...h].map(x => x.toString(16).padStart(8, '0')).join('');
+    h[0]+=a; h[1]+=b; h[2]+=c; h[3]+=d; h[4]+=e; h[5]+=f; h[6]+=g; h[7]+=k;
+  };
+  const feed = (input, size) => {
+    bytes += size;
+    let at = 0;
+    if (used) {
+      const take = Math.min(64 - used, size);
+      block.set(input.subarray(0, take), used); used += take; at = take;
+      if (used === 64) { compress(block, 0); used = 0; }
+    }
+    for (; at + 64 <= size; at += 64) compress(input, at);
+    if (at < size) { block.set(input.subarray(at, size), 0); used = size - at; }
+  };
+  return {
+    update(input) {
+      if (finished || !(input instanceof Uint8Array)) throw new TypeError('SHA-256 needs bytes before finish');
+      if (!Number.isSafeInteger(bytes + input.length)) throw new Error('SHA-256 input length is not exact');
+      feed(input, input.length);
+    },
+    finish() {
+      if (finished) throw new Error('SHA-256 is already finished');
+      finished = true;
+      block[used++] = 0x80; block.fill(0, used);
+      if (used > 56) { compress(block, 0); block.fill(0); }
+      const view = new DataView(block.buffer);
+      view.setUint32(56, Math.floor(bytes / 0x20000000)); view.setUint32(60, (bytes * 8) >>> 0);
+      compress(block, 0);
+      return Array.from(h, x => x.toString(16).padStart(8, '0')).join('');
+    },
+    get bytes() { return bytes; },
+  };
+}
+// UTF-16 chunks share that byte state. Retain a trailing high surrogate so a
+// caller can split a character between updates without changing its UTF-8 digest.
+export function createSHA256() {
+  const hash = sha256State(), encoded = new Uint8Array(65536), encoder = new TextEncoder();
+  let high = '', finished = false;
+  const write = text => {
+    for (let at = 0; at < text.length;) {
+      // Bound both the substring and byte allocation; encodeInto never cuts a scalar.
+      let end = Math.min(text.length, at + 32768);
+      if (end < text.length && (text.charCodeAt(end - 1) & 0xfc00) === 0xd800 && (text.charCodeAt(end) & 0xfc00) === 0xdc00) end--;
+      const part = encoder.encodeInto(text.slice(at, end), encoded);
+      hash.update(encoded.subarray(0, part.written)); at += part.read;
+    }
+  };
+  return {
+    update(value) {
+      if (finished) throw new Error('SHA-256 is finished');
+      let text = high + String(value === undefined ? '' : value); high = '';
+      if (text.length && (text.charCodeAt(text.length - 1) & 0xfc00) === 0xd800) { high = text.slice(-1); text = text.slice(0, -1); }
+      write(text); return this;
+    },
+    digest() {
+      if (finished) throw new Error('SHA-256 is finished');
+      if (high) { write(high); high = ''; }
+      finished = true;
+      return hash.finish();
+    },
+    get bytes() { return hash.bytes; },
+  };
+}
+export function sha256Parts(parts) {
+  const hash = createSHA256();
+  for (const part of parts) hash.update(part);
+  return hash.digest();
 }
+export function sha256(text) { return createSHA256().update(text).digest(); }