toolcraft 0.0.749 → 0.0.751

package/node_modules/@noble/hashes/src/_blake.ts

@@ -0,0 +1,67 @@
+/**
+ * Internal helpers for blake hash.
+ * @module
+ */
+import { rotr, type TRet } from './utils.ts';
+
+// Unrealized speed-up: a file-local copy of rotr measured ~1-2% faster blake2s/blake256/blake3
+// on Node 24 (V8 does not inline it into G1s/G2s across the module boundary). Reused from
+// utils for deduplication.
+
+/**
+ * Internal blake permutation table.
+ * Rows `0..9` serve BLAKE2s, rows `0..11` serve BLAKE2b with `10..11 = 0..1`, and Blake1 also
+ * reuses the later rows shown below. Blake1 expands rounds `10..15` as `SIGMA[i % 10]`, so rows
+ * `10..15` intentionally repeat rows `0..5` for the 14-round (256) and 16-round (512) variants.
+ */
+// prettier-ignore
+export const BSIGMA: TRet<Uint8Array> = /* @__PURE__ */ Uint8Array.from([
+  0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+  14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3,
+  11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4,
+  7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8,
+  9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13,
+  2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9,
+  12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11,
+  13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10,
+  6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5,
+  10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0,
+  0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+  14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3,
+  // Blake1, unused in others
+  11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4,
+  7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8,
+  9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13,
+  2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9,
+]);
+
+// prettier-ignore
+export type Num4 = { a: number; b: number; c: number; d: number; };
+
+// Unrealized speed-up: G1s/G2s return a fresh {a,b,c,d} per call (160×/blake2s block), which
+// V8's escape analysis does not eliminate when G stays a real call. Writing into one reused
+// module-level slot instead measured +4-6% blake2s/blake256 1MB throughput on Node 24 — but
+// ~2% slower blake3 (whose profile inlines G and scalar-replaces the fresh object) and no
+// difference on 32-byte inputs. Kept simple.
+
+// 32-bit / BLAKE2s first half of G, with the fixed `(16, 12)` rotation pair.
+// Parameter `x` is the RFC 7693 first-half message word, or Blake1's pre-mixed
+// `m[sigma[r][2i]] ^ u[sigma[r][2i+1]]` addend in the 32-bit path.
+export function G1s(a: number, b: number, c: number, d: number, x: number): Num4 {
+  a = (a + b + x) | 0;
+  d = rotr(d ^ a, 16);
+  c = (c + d) | 0;
+  b = rotr(b ^ c, 12);
+  return { a, b, c, d };
+}
+
+// 32-bit / BLAKE2s second half of G.
+// Parameter `x` is the RFC 7693 second-half (`y`) message word, or Blake1's pre-mixed
+// `m[sigma[r][2i + 1]] ^ u[sigma[r][2i]]` addend in the 32-bit path.
+export function G2s(a: number, b: number, c: number, d: number, x: number): Num4 {
+  a = (a + b + x) | 0;
+  d = rotr(d ^ a, 8);
+  c = (c + d) | 0;
+  b = rotr(b ^ c, 7);
+  return { a, b, c, d };
+}

package/node_modules/@noble/hashes/src/_md.ts

@@ -0,0 +1,227 @@
+/**
+ * Internal Merkle-Damgard hash utils.
+ * @module
+ */
+import { setU64FromNum } from './_u64.ts';
+import { abytes, aexists, aoutput, createView, type Hash, type TArg, type TRet } from './utils.ts';
+
+/**
+ * Shared 32-bit conditional boolean primitive reused by SHA-256, SHA-1, and MD5 `F`.
+ * Returns bits from `b` when `a` is set, otherwise from `c`.
+ * The XOR form is equivalent to MD5's `F(X,Y,Z) = XY v not(X)Z` because the masked terms never
+ * set the same bit.
+ * @param a - selector word
+ * @param b - word chosen when selector bit is set
+ * @param c - word chosen when selector bit is clear
+ * @returns Mixed 32-bit word.
+ * @example
+ * Combine three words with the shared 32-bit choice primitive.
+ * ```ts
+ * Chi(0xffffffff, 0x12345678, 0x87654321);
+ * ```
+ */
+export function Chi(a: number, b: number, c: number): number {
+  return (a & b) ^ (~a & c);
+}
+
+/**
+ * Shared 32-bit majority primitive reused by SHA-256 and SHA-1.
+ * Returns bits shared by at least two inputs.
+ * @param a - first input word
+ * @param b - second input word
+ * @param c - third input word
+ * @returns Mixed 32-bit word.
+ * @example
+ * Combine three words with the shared 32-bit majority primitive.
+ * ```ts
+ * Maj(0xffffffff, 0x12345678, 0x87654321);
+ * ```
+ */
+export function Maj(a: number, b: number, c: number): number {
+  return (a & b) ^ (a & c) ^ (b & c);
+}
+
+/**
+ * Merkle-Damgard hash construction base class.
+ * Could be used to create MD5, RIPEMD, SHA1, SHA2.
+ * Accepts only byte-aligned `Uint8Array` input, even when the underlying spec describes bit
+ * strings with partial-byte tails.
+ * @param blockLen - internal block size in bytes
+ * @param outputLen - digest size in bytes
+ * @param padOffset - trailing length field size in bytes
+ * @param isLE - whether length and state words are encoded in little-endian
+ * @example
+ * Use a concrete subclass to get the shared Merkle-Damgard update/digest flow.
+ * ```ts
+ * import { _SHA1 } from '@noble/hashes/legacy.js';
+ * const hash = new _SHA1();
+ * hash.update(new Uint8Array([97, 98, 99]));
+ * hash.digest();
+ * ```
+ */
+export abstract class HashMD<T extends HashMD<T>> implements Hash<T> {
+  // Subclasses must treat `buf` as read-only: `update()` may pass a direct view over caller input
+  // when it can process whole blocks without buffering first.
+  protected abstract process(buf: DataView, offset: number): void;
+  protected abstract get(): number[];
+  protected abstract set(...args: number[]): void;
+  // Each state layout must own this call site. At a monomorphic site TurboFan inlines get()/set()
+  // and scalar-replaces the tuple, so no secret-bearing array is allocated. Sharing this site
+  // across HashMD shapes makes it megamorphic: the tuple is materialized, cannot be explicitly
+  // wiped, and clone-heavy KDFs regress.
+  abstract _cloneInto(to?: T): T;
+  abstract destroy(): void;
+  protected abstract roundClean(): void;
+
+  readonly blockLen: number;
+  readonly outputLen: number;
+  readonly canXOF = false;
+  readonly padOffset: number;
+  readonly isLE: boolean;
+
+  // For partial updates less than block size
+  protected buffer: Uint8Array;
+  protected view: DataView;
+  protected finished = false;
+  protected length = 0;
+  protected pos = 0;
+  protected destroyed = false;
+
+  constructor(blockLen: number, outputLen: number, padOffset: number, isLE: boolean) {
+    this.blockLen = blockLen;
+    this.outputLen = outputLen;
+    this.padOffset = padOffset;
+    this.isLE = isLE;
+    this.buffer = new Uint8Array(blockLen);
+    this.view = createView(this.buffer);
+  }
+  update(data: TArg<Uint8Array>): this {
+    aexists(this);
+    abytes(data);
+    const { view, buffer, blockLen } = this;
+    const len = data.length;
+    let processed = false;
+    for (let pos = 0; pos < len;) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      // Fast path only when there is no buffered partial block: `take === blockLen` implies
+      // `this.pos === 0`, so we can process full blocks directly from the input view.
+      if (take === blockLen) {
+        const dataView = createView(data);
+        for (; blockLen <= len - pos; pos += blockLen) this.process(dataView, pos);
+        processed = true;
+        continue;
+      }
+      // When the whole input is buffered in one go (common for short messages), passing `data`
+      // directly avoids allocating a subarray view.
+      buffer.set(pos === 0 && take === len ? data : data.subarray(pos, pos + take), this.pos);
+      this.pos += take;
+      pos += take;
+      if (this.pos === blockLen) {
+        this.process(view, 0);
+        this.pos = 0;
+        processed = true;
+      }
+    }
+    this.length += data.length;
+    // Shared schedule buffers only pick up input-derived words inside process(); if everything
+    // was buffered without processing, there is nothing to zero.
+    if (processed) this.roundClean();
+    return this;
+  }
+  digestInto(out: TArg<Uint8Array>): void {
+    aexists(this);
+    aoutput(out, this);
+    this.finished = true;
+    // Padding
+    // We can avoid allocation of buffer for padding completely if it
+    // was previously not allocated here. But it won't change performance.
+    const { buffer, view, blockLen, isLE } = this;
+    let { pos } = this;
+    // append the bit '1' to the message, then zero-pad the rest of the block
+    buffer[pos++] = 0b10000000;
+    buffer.fill(0, pos);
+    // we have less than padOffset left in buffer, so we cannot put length in
+    // current block, need process it and pad again
+    if (this.padOffset > blockLen - pos) {
+      this.process(view, 0);
+      buffer.fill(0);
+    }
+    // `padOffset` reserves the whole length field. For SHA-384/512 the high 64 bits stay zero from
+    // the padding fill above, and JS will overflow before user input can make that half non-zero.
+    // So we only need to write the low 64 bits here (`length * 8` only scales the exponent of an
+    // integer below 2**53, so the split inside the helper stays exact).
+    setU64FromNum(view, blockLen - 8, this.length * 8, isLE);
+    this.process(view, 0);
+    // The final block above is processed outside update(), so the shared message-schedule
+    // buffers (e.g. SHA256_W) would otherwise retain input-derived words after digest().
+    this.roundClean();
+    // digest() passes our own `buffer` as `out`; reuse its cached view instead of allocating one.
+    const oview = out === buffer ? view : createView(out);
+    const len = this.outputLen;
+    // NOTE: we do division by 4 later, which must be fused in single op with modulo by JIT
+    const outLen = len / 4;
+    const state = this.get();
+    // Subclass-misconfiguration invariant: outputLen must be 32-bit aligned and fit the state.
+    if (len % 4 || outLen > state.length) throw new Error('invalid outputLen');
+    for (let i = 0; i < outLen; i++) oview.setUint32(4 * i, state[i], isLE);
+  }
+  digest(): TRet<Uint8Array> {
+    const { buffer, outputLen } = this;
+    this.digestInto(buffer);
+    // Copy before destroy(): subclasses wipe `buffer` during cleanup, but `digest()` must return
+    // fresh bytes to the caller.
+    const res = buffer.slice(0, outputLen);
+    this.destroy();
+    return res as TRet<Uint8Array>;
+  }
+  protected _cloneIntoMeta(to: T): T {
+    const { buffer, length, finished, destroyed, pos } = this;
+    to.destroyed = destroyed;
+    to.finished = finished;
+    to.length = length;
+    to.pos = pos;
+    // Only partial-block bytes need copying: when `length % blockLen === 0`, `pos === 0` and
+    // later `update()` / `digestInto()` overwrite `to.buffer` from the start before reading it.
+    if (pos) to.buffer.set(buffer); // Avoid a hot modulo guard.
+    return to as unknown as any;
+  }
+  clone(): T {
+    return this._cloneInto();
+  }
+}
+
+/**
+ * Initial SHA-2 state: fractional parts of square roots of first 16 primes 2..53.
+ * Check out `test/misc/sha2-gen-iv.js` for recomputation guide.
+ */
+
+/** Initial SHA256 state from RFC 6234 §6.1: the first 32 bits of the fractional parts of the
+ * square roots of the first eight prime numbers. Exported as a shared table; callers must treat
+ * it as read-only because constructors copy words from it by index. */
+export const SHA256_IV: TRet<Uint32Array> = /* @__PURE__ */ Uint32Array.from([
+  0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
+]);
+
+/** Initial SHA224 state `H(0)` from RFC 6234 §6.1. Exported as a shared table; callers must
+ * treat it as read-only because constructors copy words from it by index. */
+export const SHA224_IV: TRet<Uint32Array> = /* @__PURE__ */ Uint32Array.from([
+  0xc1059ed8, 0x367cd507, 0x3070dd17, 0xf70e5939, 0xffc00b31, 0x68581511, 0x64f98fa7, 0xbefa4fa4,
+]);
+
+/** Initial SHA384 state from RFC 6234 §6.3: eight RFC 64-bit `H(0)` words stored as sixteen
+ * big-endian 32-bit halves. Derived from the fractional parts of the square roots of the ninth
+ * through sixteenth prime numbers. Exported as a shared table; callers must treat it as read-only
+ * because constructors copy halves from it by index. */
+export const SHA384_IV: TRet<Uint32Array> = /* @__PURE__ */ Uint32Array.from([
+  0xcbbb9d5d, 0xc1059ed8, 0x629a292a, 0x367cd507, 0x9159015a, 0x3070dd17, 0x152fecd8, 0xf70e5939,
+  0x67332667, 0xffc00b31, 0x8eb44a87, 0x68581511, 0xdb0c2e0d, 0x64f98fa7, 0x47b5481d, 0xbefa4fa4,
+]);
+
+/** Initial SHA512 state from RFC 6234 §6.3: eight RFC 64-bit `H(0)` words stored as sixteen
+ * big-endian 32-bit halves. Derived from the fractional parts of the square roots of the first
+ * eight prime numbers. Exported as a shared table; callers must treat it as read-only because
+ * constructors copy halves from it by index. */
+export const SHA512_IV: TRet<Uint32Array> = /* @__PURE__ */ Uint32Array.from([
+  0x6a09e667, 0xf3bcc908, 0xbb67ae85, 0x84caa73b, 0x3c6ef372, 0xfe94f82b, 0xa54ff53a, 0x5f1d36f1,
+  0x510e527f, 0xade682d1, 0x9b05688c, 0x2b3e6c1f, 0x1f83d9ab, 0xfb41bd6b, 0x5be0cd19, 0x137e2179,
+]);

package/node_modules/@noble/hashes/src/_u64.ts

@@ -0,0 +1,111 @@
+/**
+ * Internal helpers for u64.
+ * BigUint64Array is too slow as per 2026, so we implement it using
+ * Uint32Array.
+ * @privateRemarks TODO: re-check {@link https://issues.chromium.org/issues/42212588}
+ * @module
+ */
+import type { TRet } from './utils.ts';
+
+const U32_MASK64 = /* @__PURE__ */ (() => BigInt(2 ** 32 - 1))();
+const _32n = /* @__PURE__ */ BigInt(32);
+
+// Split bigint into two 32-bit halves. With `le=true`, returned fields become `{ h: low, l: high
+// }` to match little-endian word order rather than the property names.
+function fromBig(
+  n: bigint,
+  le = false
+): {
+  h: number;
+  l: number;
+} {
+  if (le) return { h: Number(n & U32_MASK64), l: Number((n >> _32n) & U32_MASK64) };
+  return { h: Number((n >> _32n) & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };
+}
+
+// Split bigint list into `[highWords, lowWords]` when `le=false`; with `le=true`, the first array
+// holds the low halves because `fromBig(...)` swaps the semantic meaning of `h` and `l`.
+function split(lst: bigint[], le = false): TRet<Uint32Array[]> {
+  const len = lst.length;
+  let Ah = new Uint32Array(len);
+  let Al = new Uint32Array(len);
+  for (let i = 0; i < len; i++) {
+    const { h, l } = fromBig(lst[i], le);
+    [Ah[i], Al[i]] = [h, l];
+  }
+  return [Ah, Al] as TRet<Uint32Array[]>;
+}
+
+// Combine explicit `(high, low)` 32-bit halves into a bigint; `>>> 0` normalizes signed JS
+// bitwise results back to uint32 first, and little-endian callers must swap.
+const toBig = (h: number, l: number): bigint => (BigInt(h >>> 0) << _32n) | BigInt(l >>> 0);
+// Split a JS number into u32 halves without a BigInt allocation. Exact only for integers
+// `0 <= n < 2**53`; callers use it on byte / bit counters, which JS length math caps far below
+// that (an ArrayBuffer cannot exceed 2**53 - 1 bytes).
+const fromNumH = (n: number): number => (n / 2 ** 32) | 0;
+const fromNumL = (n: number): number => n >>> 0;
+// Drop-in replacement for `view.setBigUint64(byteOffset, BigInt(n), isLE)` without the per-call
+// BigInt allocation. Same `n < 2**53` precondition as `fromNumH`/`fromNumL`.
+function setU64FromNum(view: DataView, byteOffset: number, n: number, isLE: boolean): void {
+  const h = fromNumH(n);
+  const l = fromNumL(n);
+  view.setUint32(byteOffset, isLE ? l : h, isLE);
+  view.setUint32(byteOffset + 4, isLE ? h : l, isLE);
+}
+// High 32-bit half of a 64-bit logical right shift for `s` in `0..31`.
+const shrSH = (h: number, _l: number, s: number): number => h >>> s;
+// Low 32-bit half of a 64-bit logical right shift, valid for `s` in `1..31`.
+const shrSL = (h: number, l: number, s: number): number => (h << (32 - s)) | (l >>> s);
+// High 32-bit half of a 64-bit right rotate, valid for `s` in `1..31`.
+const rotrSH = (h: number, l: number, s: number): number => (h >>> s) | (l << (32 - s));
+// Low 32-bit half of a 64-bit right rotate, valid for `s` in `1..31`.
+const rotrSL = (h: number, l: number, s: number): number => (h << (32 - s)) | (l >>> s);
+// High 32-bit half of a 64-bit right rotate, valid for `s` in `33..63`; `32` uses `rotr32*`.
+const rotrBH = (h: number, l: number, s: number): number => (h << (64 - s)) | (l >>> (s - 32));
+// Low 32-bit half of a 64-bit right rotate, valid for `s` in `33..63`; `32` uses `rotr32*`.
+const rotrBL = (h: number, l: number, s: number): number => (h >>> (s - 32)) | (l << (64 - s));
+// High 32-bit half of a 64-bit right rotate for `s === 32`; this is just the swapped low half.
+const rotr32H = (_h: number, l: number): number => l;
+// Low 32-bit half of a 64-bit right rotate for `s === 32`; this is just the swapped high half.
+const rotr32L = (h: number, _l: number): number => h;
+// 64-bit left rotates (rotl*) are not defined here: sha3.ts, their only consumer, keeps
+// local copies so V8 inlines them into keccakP.
+
+// Add two split 64-bit words and return the split `{ h, l }` sum.
+// JS uses 32-bit signed integers for bitwise operations, so we cannot simply shift the carry out
+// of the low sum and instead use division.
+function add(
+  Ah: number,
+  Al: number,
+  Bh: number,
+  Bl: number
+): {
+  h: number;
+  l: number;
+} {
+  const l = (Al >>> 0) + (Bl >>> 0);
+  return { h: (Ah + Bh + ((l / 2 ** 32) | 0)) | 0, l: l | 0 };
+}
+// Addition with more than 2 elements
+// Unmasked low-word accumulator for 3-way addition; pass the raw result into `add3H(...)`.
+const add3L = (Al: number, Bl: number, Cl: number): number => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);
+// High-word finalize step for 3-way addition; `low` must be the untruncated output of `add3L(...)`.
+const add3H = (low: number, Ah: number, Bh: number, Ch: number): number =>
+  (Ah + Bh + Ch + ((low / 2 ** 32) | 0)) | 0;
+// Unmasked low-word accumulator for 4-way addition; pass the raw result into `add4H(...)`.
+const add4L = (Al: number, Bl: number, Cl: number, Dl: number): number =>
+  (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);
+// High-word finalize step for 4-way addition; `low` must be the untruncated output of `add4L(...)`.
+const add4H = (low: number, Ah: number, Bh: number, Ch: number, Dh: number): number =>
+  (Ah + Bh + Ch + Dh + ((low / 2 ** 32) | 0)) | 0;
+// Unmasked low-word accumulator for 5-way addition; pass the raw result into `add5H(...)`.
+const add5L = (Al: number, Bl: number, Cl: number, Dl: number, El: number): number =>
+  (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
+// High-word finalize step for 5-way addition; `low` must be the untruncated output of `add5L(...)`.
+const add5H = (low: number, Ah: number, Bh: number, Ch: number, Dh: number, Eh: number): number =>
+  (Ah + Bh + Ch + Dh + Eh + ((low / 2 ** 32) | 0)) | 0;
+
+// prettier-ignore
+export {
+  add, add3H, add3L, add4H, add4L, add5H, add5L, fromBig, fromNumH, fromNumL, rotr32H, rotr32L, rotrBH, rotrBL, rotrSH, rotrSL, setU64FromNum, shrSH, shrSL, split, toBig
+};