toolcraft 0.0.749 → 0.0.751

package/node_modules/@noble/hashes/src/hkdf.ts

@@ -0,0 +1,161 @@
+/**
+ * HKDF (RFC 5869): extract + expand in one step.
+ * See {@link https://soatok.blog/2021/11/17/understanding-hkdf/}.
+ * @module
+ */
+import { hmac, type _HMAC } from './hmac.ts';
+import { abytes, ahash, anumber, type CHash, clean, type TArg, type TRet } from './utils.ts';
+
+/**
+ * HKDF-extract from spec. Less important part. `HKDF-Extract(IKM, salt) -> PRK`
+ * Arguments position differs from spec (IKM is first one, since it is not optional)
+ * Local validation only checks `hash`; `ikm` / `salt` byte validation is delegated to `hmac()`.
+ * @param hash - hash function that would be used (e.g. sha256)
+ * @param ikm - input keying material, the initial key
+ * @param salt - optional salt value (a non-secret random value)
+ * @returns Pseudorandom key derived from input keying material.
+ * @example
+ * Run the HKDF extract step.
+ * ```ts
+ * import { extract } from '@noble/hashes/hkdf.js';
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * extract(sha256, new Uint8Array([1, 2, 3]), new Uint8Array([4, 5, 6]));
+ * ```
+ */
+export function extract(
+  hash: TArg<CHash>,
+  ikm: TArg<Uint8Array>,
+  salt?: TArg<Uint8Array>
+): TRet<Uint8Array> {
+  ahash(hash);
+  // NOTE: some libraries treat zero-length array as 'not provided';
+  // we don't, since we have undefined as 'not provided'
+  // https://github.com/RustCrypto/KDFs/issues/15
+  if (salt === undefined) salt = new Uint8Array(hash.outputLen);
+  return hmac(hash, salt, ikm);
+}
+
+// Shared mutable scratch byte for the RFC 5869 block counter `N`.
+// Safe to reuse because `expand()` is synchronous and resets it with `clean(...)` before returning.
+const HKDF_COUNTER = /* @__PURE__ */ Uint8Array.of(0);
+// Shared RFC 5869 empty string for both `info === undefined` and the first-block `T(0)` input.
+const EMPTY_BUFFER = /* @__PURE__ */ Uint8Array.of();
+
+/**
+ * HKDF-expand from the spec. The most important part. `HKDF-Expand(PRK, info, L) -> OKM`
+ * @param hash - hash function that would be used (e.g. sha256)
+ * @param prk - a pseudorandom key of at least HashLen octets
+ *   (usually, the output from the extract step)
+ * @param info - optional context and application specific information (can be a zero-length string)
+ * @param length - length of output keying material in bytes.
+ *   RFC 5869 §2.3 allows `0..255*HashLen`, so `0` returns an empty OKM.
+ * @param _recycled - Internal destroyed extract hashes owned by the combined `hkdf()` call.
+ * @returns Output keying material with the requested length.
+ * @throws If the requested output length exceeds the HKDF limit
+ *   for the selected hash. {@link Error}
+ * @example
+ * Run the HKDF expand step.
+ * ```ts
+ * import { expand } from '@noble/hashes/hkdf.js';
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * expand(sha256, new Uint8Array(32), new Uint8Array([1, 2, 3]), 16);
+ * ```
+ */
+export function expand(
+  hash: TArg<CHash>,
+  prk: TArg<Uint8Array>,
+  info?: TArg<Uint8Array>,
+  length: number = 32,
+  _recycled?: _HMAC<any>
+): TRet<Uint8Array> {
+  ahash(hash);
+  anumber(length, 'length');
+  abytes(prk, undefined, 'prk');
+  const olen = hash.outputLen;
+  // RFC 5869 §2.3: PRK is "a pseudorandom key of at least HashLen octets".
+  if (prk.length < olen) throw new Error('"prk" must be at least HashLen octets');
+  // RFC 5869 §2.3 only bounds `L` by `<= 255*HashLen`; `L=0` is valid and yields empty OKM.
+  if (length > 255 * olen) throw new Error('Length must be <= 255*HashLen');
+  const blocks = Math.ceil(length / olen);
+  if (info === undefined) info = EMPTY_BUFFER;
+  else abytes(info, undefined, 'info');
+  if (!blocks) {
+    if (_recycled) clean(prk); // Full hkdf() owns this intermediate PRK.
+    return new Uint8Array() as TRet<Uint8Array>;
+  }
+  // first L(ength) octets of T
+  // The private PRK can become both T and a one-block result after HMAC consumes the key.
+  const okm = _recycled && blocks === 1 ? prk : new Uint8Array(blocks * olen);
+  const { iHash, oHash } = hmac.create(hash, prk);
+  // Driving them directly also skips `_HMAC.digestInto`'s per-digest destroy.
+  const T = _recycled ? prk : new Uint8Array(olen);
+  // Full hkdf() donates one destroyed extract hash; standalone creates one alternating worker.
+  const worker = blocks > 1 ? _recycled?.iHash || hash.create() : undefined;
+  for (let counter = 0; counter < blocks - 1; counter++) {
+    HKDF_COUNTER[0] = counter + 1;
+    const iWork = iHash._cloneInto(worker);
+    // T(0) = empty string (zero length)
+    // T(N) = HMAC-Hash(PRK, T(N-1) | info | N)
+    if (counter) iWork.update(T);
+    iWork.update(info).update(HKDF_COUNTER).digestInto(T);
+    oHash._cloneInto(worker).update(T).digestInto(T);
+    okm.set(T, olen * counter);
+  }
+  // Midstates are key-equivalent: they allow computing HMAC(prk, ...) for any message.
+  HKDF_COUNTER[0] = blocks; // Final block consumes them; retain worker for cleanup.
+  if (blocks > 1) iHash.update(T);
+  iHash.update(info).update(HKDF_COUNTER).digestInto(T);
+  oHash.update(T).digestInto(T);
+  okm.set(T, olen * (blocks - 1));
+  iHash.destroy(); // Raw digests may leave key-derived base/worker state; wipe all explicitly.
+  oHash.destroy();
+  worker?.destroy();
+  if (T !== okm) clean(T); // Wipe private T/PRK; standalone preserves caller-owned PRK.
+  clean(HKDF_COUNTER);
+  // Exact fit: return without the extra copy.
+  if (length === okm.length) return okm as TRet<Uint8Array>;
+  // Copy the requested prefix, then wipe the full buffer: its tail holds
+  // up to HashLen-1 bytes of derived key material past `length`.
+  const res = okm.slice(0, length);
+  clean(okm);
+  return res as TRet<Uint8Array>;
+}
+
+/**
+ * HKDF (RFC 5869): derive keys from an initial input.
+ * Combines hkdf_extract + hkdf_expand in one step
+ * @param hash - hash function that would be used (e.g. sha256)
+ * @param ikm - input keying material, the initial key
+ * @param salt - optional salt value (a non-secret random value)
+ * @param info - optional context and application specific information bytes
+ * @param length - length of output keying material in bytes.
+ *   RFC 5869 §2.3 allows `0..255*HashLen`, so `0` returns an empty OKM.
+ * @returns Output keying material derived from the input key.
+ * @throws If the requested output length exceeds the HKDF limit
+ *   for the selected hash. {@link Error}
+ * @example
+ * HKDF (RFC 5869): derive keys from an initial input.
+ * ```ts
+ * import { hkdf } from '@noble/hashes/hkdf.js';
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * import { randomBytes, utf8ToBytes } from '@noble/hashes/utils.js';
+ * const inputKey = randomBytes(32);
+ * const salt = randomBytes(32);
+ * const info = utf8ToBytes('application-key');
+ * const okm = hkdf(sha256, inputKey, salt, info, 32);
+ * ```
+ */
+export const hkdf = (
+  hash: TArg<CHash>,
+  ikm: TArg<Uint8Array>,
+  salt: TArg<Uint8Array | undefined>,
+  info: TArg<Uint8Array | undefined>,
+  length: number
+): TRet<Uint8Array> => {
+  ahash(hash);
+  if (salt === undefined) salt = new Uint8Array(hash.outputLen);
+  const HMAC = hmac.create(hash, salt).update(ikm);
+  // The intermediate PRK is secret key material; wipe it instead of
+  // leaving it for GC.
+  return expand(hash, HMAC.digest(), info, length, HMAC); // expand() owns and consumes it.
+};

package/node_modules/@noble/hashes/src/hmac.ts

@@ -0,0 +1,130 @@
+/**
+ * HMAC: RFC2104 message authentication code.
+ * @module
+ */
+import {
+  abytes,
+  aexists,
+  ahash,
+  aoutput,
+  clean,
+  type CHash,
+  type Hash,
+  type TArg,
+  type TRet,
+} from './utils.ts';
+
+/**
+ * Internal class for HMAC.
+ * Accepts any byte key, although RFC 2104 §3 recommends keys at least
+ * `HashLen` bytes long.
+ */
+export class _HMAC<T extends Hash<T>> implements Hash<_HMAC<T>> {
+  oHash: T;
+  iHash: T;
+  blockLen: number;
+  outputLen: number;
+  canXOF = false;
+  private finished = false;
+  private destroyed = false;
+
+  constructor(hash: TArg<CHash>, key: TArg<Uint8Array>) {
+    ahash(hash);
+    abytes(key, undefined, 'key');
+    this.iHash = hash.create() as T;
+    if (typeof this.iHash.update !== 'function') throw new Error('expected Hash instance');
+    this.blockLen = this.iHash.blockLen;
+    this.outputLen = this.iHash.outputLen;
+    const blockLen = this.blockLen;
+    const pad = new Uint8Array(blockLen);
+    // blockLen can be bigger than outputLen
+    pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
+    for (let i = 0; i < pad.length; i++) pad[i] ^= 0x36;
+    this.iHash.update(pad);
+    // By doing update (processing of the first block) of the outer hash here,
+    // we can re-use it between multiple calls via clone.
+    this.oHash = hash.create() as T;
+    // Undo internal XOR && apply outer XOR
+    for (let i = 0; i < pad.length; i++) pad[i] ^= 0x36 ^ 0x5c;
+    this.oHash.update(pad);
+    clean(pad);
+  }
+  update(buf: TArg<Uint8Array>): this {
+    aexists(this);
+    this.iHash.update(buf);
+    return this;
+  }
+  digestInto(out: TArg<Uint8Array>): void {
+    aexists(this);
+    aoutput(out, this);
+    this.finished = true;
+    const buf = out.subarray(0, this.outputLen);
+    // Reuse the first outputLen bytes for the inner digest; the outer hash consumes them before
+    // overwriting that same prefix with the final tag, leaving any oversized tail untouched.
+    this.iHash.digestInto(buf);
+    this.oHash.update(buf);
+    this.oHash.digestInto(buf);
+    this.destroy();
+  }
+  digest(): TRet<Uint8Array> {
+    const out = new Uint8Array(this.oHash.outputLen);
+    this.digestInto(out);
+    return out as TRet<Uint8Array>;
+  }
+  _cloneInto(to?: _HMAC<T>): _HMAC<T> {
+    // Create new instance without calling constructor since the key
+    // is already in state and we don't know it.
+    to ||= Object.create(Object.getPrototypeOf(this), {});
+    const { oHash, iHash, finished, destroyed, blockLen, outputLen, canXOF } = this;
+    to = to as this;
+    to.finished = finished;
+    to.destroyed = destroyed;
+    to.blockLen = blockLen;
+    to.outputLen = outputLen;
+    to.canXOF = canXOF;
+    to.oHash = oHash._cloneInto(to.oHash);
+    to.iHash = iHash._cloneInto(to.iHash);
+    return to;
+  }
+  clone(): _HMAC<T> {
+    return this._cloneInto();
+  }
+  destroy(): void {
+    this.destroyed = true;
+    this.oHash.destroy();
+    this.iHash.destroy();
+  }
+}
+
+/**
+ * HMAC: RFC2104 message authentication code.
+ * @param hash - function that would be used e.g. sha256
+ * @param key - authentication key bytes
+ * @param message - message bytes to authenticate
+ * @returns Authentication tag bytes.
+ * @example
+ * Compute an RFC 2104 HMAC directly and with an incremental state.
+ * ```ts
+ * import { hmac } from '@noble/hashes/hmac.js';
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * const key = new Uint8Array([1, 2, 3]);
+ * const message = new Uint8Array([4, 5, 6]);
+ * const mac = hmac(sha256, key, message);
+ * const out = new Uint8Array(sha256.outputLen);
+ * hmac.create(sha256, key).update(message).digestInto(out);
+ * ```
+ */
+type HmacFn = {
+  (hash: TArg<CHash>, key: TArg<Uint8Array>, message: TArg<Uint8Array>): TRet<Uint8Array>;
+  create(hash: TArg<CHash>, key: TArg<Uint8Array>): TRet<_HMAC<any>>;
+};
+export const hmac: TRet<HmacFn> = /* @__PURE__ */ (() => {
+  const hmac_ = ((
+    hash: TArg<CHash>,
+    key: TArg<Uint8Array>,
+    message: TArg<Uint8Array>
+  ): TRet<Uint8Array> => new _HMAC<any>(hash, key).update(message).digest()) as TRet<HmacFn>;
+  hmac_.create = (hash: TArg<CHash>, key: TArg<Uint8Array>): TRet<_HMAC<any>> =>
+    new _HMAC<any>(hash, key) as TRet<_HMAC<any>>;
+  return hmac_;
+})();

package/node_modules/@noble/hashes/src/index.ts

@@ -0,0 +1,33 @@
+/**
+ * Audited & minimal JS implementation of hash functions, MACs, and KDFs.
+ * Check out individual modules.
+ * @module
+ * @example
+```js
+import {
+  sha256, sha384, sha512, sha224, sha512_224, sha512_256
+} from '@noble/hashes/sha2.js';
+import {
+  sha3_224, sha3_256, sha3_384, sha3_512,
+  keccak_224, keccak_256, keccak_384, keccak_512,
+  shake128, shake256
+} from '@noble/hashes/sha3.js';
+import {
+  cshake128, cshake256,
+  turboshake128, turboshake256,
+  kt128, kt256,
+  kmac128, kmac256,
+  tuplehash256, parallelhash256,
+  keccakprg
+} from '@noble/hashes/sha3-addons.js';
+import { blake3 } from '@noble/hashes/blake3.js';
+import { blake2b, blake2s } from '@noble/hashes/blake2.js';
+import { hmac } from '@noble/hashes/hmac.js';
+import { hkdf } from '@noble/hashes/hkdf.js';
+import { pbkdf2, pbkdf2Async } from '@noble/hashes/pbkdf2.js';
+import { scrypt, scryptAsync } from '@noble/hashes/scrypt.js';
+import { md5, ripemd160, sha1 } from '@noble/hashes/legacy.js';
+import * as utils from '@noble/hashes/utils.js';
+```
+ */
+throw new Error('root module cannot be imported: import submodules instead. Check out README');

package/node_modules/@noble/hashes/src/legacy.ts

@@ -0,0 +1,361 @@
+/**
+
+SHA1 (RFC 3174), MD5 (RFC 1321), and RIPEMD160 legacy, weak hash functions.
+RFC 2286 only covers HMAC-RIPEMD160 wrapper material and test vectors,
+not the base RIPEMD-160 compression spec.
+Don't use them in a new protocol. What "weak" means:
+
+- Collisions can be made with 2^18 effort in MD5, 2^60 in SHA1, 2^80 in RIPEMD160.
+- No practical pre-image attacks (only theoretical, 2^123.4)
+- HMAC seems kinda ok: https://www.rfc-editor.org/rfc/rfc6151
+ * @module
+ */
+import { Chi, HashMD, Maj } from './_md.ts';
+import { type CHash, clean, createHasher, rotl, type TRet } from './utils.ts';
+
+/** Initial SHA-1 state from RFC 3174 §6.1. */
+const SHA1_IV = /* @__PURE__ */ Uint32Array.from([
+  0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476, 0xc3d2e1f0,
+]);
+
+// Reusable 80-word SHA-1 message schedule buffer.
+const SHA1_W = /* @__PURE__ */ new Uint32Array(80);
+
+/** Internal SHA1 legacy hash class. */
+export class _SHA1 extends HashMD<_SHA1> {
+  private A = SHA1_IV[0] | 0;
+  private B = SHA1_IV[1] | 0;
+  private C = SHA1_IV[2] | 0;
+  private D = SHA1_IV[3] | 0;
+  private E = SHA1_IV[4] | 0;
+
+  constructor() {
+    super(64, 20, 8, false);
+  }
+  protected get(): [number, number, number, number, number] {
+    const { A, B, C, D, E } = this;
+    return [A, B, C, D, E];
+  }
+  protected set(A: number, B: number, C: number, D: number, E: number): void {
+    this.A = A | 0;
+    this.B = B | 0;
+    this.C = C | 0;
+    this.D = D | 0;
+    this.E = E | 0;
+  }
+  _cloneInto(to?: _SHA1): _SHA1 {
+    (to ||= new (this.constructor as any)() as _SHA1).set(...this.get());
+    return this._cloneIntoMeta(to);
+  }
+  protected process(view: DataView, offset: number): void {
+    for (let i = 0; i < 16; i++, offset += 4) SHA1_W[i] = view.getUint32(offset, false);
+    for (let i = 16; i < 80; i++)
+      SHA1_W[i] = rotl(SHA1_W[i - 3] ^ SHA1_W[i - 8] ^ SHA1_W[i - 14] ^ SHA1_W[i - 16], 1);
+    // Compression function main loop, 80 rounds
+    let { A, B, C, D, E } = this;
+    for (let i = 0; i < 80; i++) {
+      let F, K;
+      if (i < 20) {
+        F = Chi(B, C, D);
+        K = 0x5a827999;
+      } else if (i < 40) {
+        F = B ^ C ^ D;
+        K = 0x6ed9eba1;
+      } else if (i < 60) {
+        F = Maj(B, C, D);
+        K = 0x8f1bbcdc;
+      } else {
+        F = B ^ C ^ D;
+        K = 0xca62c1d6;
+      }
+      const T = (rotl(A, 5) + F + E + K + SHA1_W[i]) | 0;
+      E = D;
+      D = C;
+      C = rotl(B, 30);
+      B = A;
+      A = T;
+    }
+    // Add the compressed chunk to the current hash value
+    A = (A + this.A) | 0;
+    B = (B + this.B) | 0;
+    C = (C + this.C) | 0;
+    D = (D + this.D) | 0;
+    E = (E + this.E) | 0;
+    this.set(A, B, C, D, E);
+  }
+  protected roundClean(): void {
+    clean(SHA1_W);
+  }
+  destroy(): void {
+    // HashMD callers route post-destroy usability through `destroyed`; zeroizing alone still leaves
+    // update()/digest() callable on reused instances.
+    this.destroyed = true;
+    this.set(0, 0, 0, 0, 0);
+    clean(this.buffer);
+  }
+}
+
+/**
+ * SHA1 (RFC 3174) legacy hash function. It was cryptographically broken.
+ * @param msg - message bytes to hash
+ * @param opts - Reserved hash options.
+ * @returns Digest bytes.
+ * @example
+ * Hash a message with SHA1.
+ * ```ts
+ * sha1(new Uint8Array([97, 98, 99]));
+ * ```
+ */
+export const sha1: TRet<CHash> = /* @__PURE__ */ createHasher(() => new _SHA1());
+
+/** RFC 1321 `T[i]` uses `floor(2^32 * abs(sin(i)))`; this is the shared `2^32` scale factor. */
+const p32 = /* @__PURE__ */ Math.pow(2, 32);
+/** RFC 1321 `T[1..64]` table. */
+const K = /* @__PURE__ */ Array.from({ length: 64 }, (_, i) =>
+  Math.floor(p32 * Math.abs(Math.sin(i + 1)))
+);
+
+/** MD5 initial state from RFC 1321, stored as 4 u32 words. */
+const MD5_IV = /* @__PURE__ */ SHA1_IV.slice(0, 4);
+
+// Reusable 16-word MD5 message block buffer.
+const MD5_W = /* @__PURE__ */ new Uint32Array(16);
+// RFC 1321 §3.4 per-round rotate amounts, flattened to 64 entries so the round loop
+// avoids allocating a 4-element array literal every round (measured ~5% of md5).
+const MD5_SHIFTS = /* @__PURE__ */ (() => {
+  const S = [
+    [7, 12, 17, 22],
+    [5, 9, 14, 20],
+    [4, 11, 16, 23],
+    [6, 10, 15, 21],
+  ];
+  return Uint8Array.from({ length: 64 }, (_, i) => S[Math.floor(i / 16)][i % 4]);
+})();
+/** Internal MD5 legacy hash class. */
+export class _MD5 extends HashMD<_MD5> {
+  private A = MD5_IV[0] | 0;
+  private B = MD5_IV[1] | 0;
+  private C = MD5_IV[2] | 0;
+  private D = MD5_IV[3] | 0;
+
+  constructor() {
+    super(64, 16, 8, true);
+  }
+  protected get(): [number, number, number, number] {
+    const { A, B, C, D } = this;
+    return [A, B, C, D];
+  }
+  protected set(A: number, B: number, C: number, D: number): void {
+    this.A = A | 0;
+    this.B = B | 0;
+    this.C = C | 0;
+    this.D = D | 0;
+  }
+  _cloneInto(to?: _MD5): _MD5 {
+    (to ||= new (this.constructor as any)() as _MD5).set(...this.get());
+    return this._cloneIntoMeta(to);
+  }
+  protected process(view: DataView, offset: number): void {
+    for (let i = 0; i < 16; i++, offset += 4) MD5_W[i] = view.getUint32(offset, true);
+    // Compression function main loop, 64 rounds
+    let { A, B, C, D } = this;
+    for (let i = 0; i < 64; i++) {
+      let F, g;
+      if (i < 16) {
+        F = Chi(B, C, D);
+        g = i;
+      } else if (i < 32) {
+        // RFC 1321 round 2 uses G(B,C,D) = (B & D) | (C & ~D), which is `Chi(D, B, C)`.
+        F = Chi(D, B, C);
+        g = (5 * i + 1) % 16;
+      } else if (i < 48) {
+        F = B ^ C ^ D;
+        g = (3 * i + 5) % 16;
+      } else {
+        F = C ^ (B | ~D);
+        g = (7 * i) % 16;
+      }
+      F = F + A + K[i] + MD5_W[g];
+      A = D;
+      D = C;
+      C = B;
+      B = B + rotl(F, MD5_SHIFTS[i]);
+    }
+    // Add the compressed chunk to the current hash value
+    A = (A + this.A) | 0;
+    B = (B + this.B) | 0;
+    C = (C + this.C) | 0;
+    D = (D + this.D) | 0;
+    this.set(A, B, C, D);
+  }
+  protected roundClean(): void {
+    clean(MD5_W);
+  }
+  destroy(): void {
+    // HashMD callers route post-destroy usability through `destroyed`; zeroizing alone still leaves
+    // update()/digest() callable on reused instances.
+    this.destroyed = true;
+    this.set(0, 0, 0, 0);
+    clean(this.buffer);
+  }
+}
+
+/**
+ * MD5 (RFC 1321) legacy hash function. It was cryptographically broken.
+ * MD5 architecture is similar to SHA1, with some differences:
+ * - Reduced output length: 16 bytes (128 bit) instead of 20
+ * - 64 rounds, instead of 80
+ * - Little-endian: could be faster, but will require more code
+ * - Non-linear index selection: huge speed-up for unroll
+ * - Per round constants: more memory accesses, additional speed-up for unroll
+ * @param msg - message bytes to hash
+ * @param opts - Reserved hash options.
+ * @returns Digest bytes.
+ * @example
+ * Hash a message with MD5.
+ * ```ts
+ * md5(new Uint8Array([97, 98, 99]));
+ * ```
+ */
+export const md5: TRet<CHash> = /* @__PURE__ */ createHasher(() => new _MD5());
+
+// RIPEMD-160
+
+// Permutation repeatedly applied to derive the later RIPEMD-160 message-order tables.
+const Rho160 = /* @__PURE__ */ Uint8Array.from([
+  7, 4, 13, 1, 10, 6, 15, 3, 12, 0, 9, 5, 2, 14, 11, 8,
+]);
+const Id160 = /* @__PURE__ */ (() => Uint8Array.from(new Array(16).fill(0).map((_, i) => i)))();
+const Pi160 = /* @__PURE__ */ (() => Id160.map((i) => (9 * i + 5) % 16))();
+// Five left/right message-word orderings for the RIPEMD-160 dual-lane rounds.
+const idxLR = /* @__PURE__ */ (() => {
+  const L = [Id160];
+  const R = [Pi160];
+  const res = [L, R];
+  for (let i = 0; i < 4; i++) for (let j of res) j.push(j[i].map((k) => Rho160[k]));
+  return res;
+})();
+const idxL = /* @__PURE__ */ (() => idxLR[0])();
+const idxR = /* @__PURE__ */ (() => idxLR[1])();
+// const [idxL, idxR] = idxLR;
+
+// Base per-group shift table before the left/right message-order permutations are applied.
+const shifts160 = /* @__PURE__ */ [
+  [11, 14, 15, 12, 5, 8, 7, 9, 11, 13, 14, 15, 6, 7, 9, 8],
+  [12, 13, 11, 15, 6, 9, 9, 7, 12, 15, 11, 13, 7, 8, 7, 7],
+  [13, 15, 14, 11, 7, 7, 6, 8, 13, 14, 13, 12, 5, 5, 6, 9],
+  [14, 11, 12, 14, 8, 6, 5, 5, 15, 12, 15, 14, 9, 9, 8, 6],
+  [15, 12, 13, 13, 9, 5, 8, 6, 14, 11, 12, 11, 8, 6, 5, 5],
+].map((i) => Uint8Array.from(i));
+const shiftsL160 = /* @__PURE__ */ idxL.map((idx, i) => idx.map((j) => shifts160[i][j]));
+const shiftsR160 = /* @__PURE__ */ idxR.map((idx, i) => idx.map((j) => shifts160[i][j]));
+// Five left-lane additive constants for RIPEMD-160.
+const Kl160 = /* @__PURE__ */ Uint32Array.from([
+  0x00000000, 0x5a827999, 0x6ed9eba1, 0x8f1bbcdc, 0xa953fd4e,
+]);
+// Five right-lane additive constants for RIPEMD-160.
+const Kr160 = /* @__PURE__ */ Uint32Array.from([
+  0x50a28be6, 0x5c4dd124, 0x6d703ef3, 0x7a6d76e9, 0x00000000,
+]);
+// Called `f()` in the spec; valid `group` values are 0..4, and out-of-range
+// inputs currently fall through to the group-4 branch.
+function ripemd_f(group: number, x: number, y: number, z: number): number {
+  if (group === 0) return x ^ y ^ z;
+  if (group === 1) return (x & y) | (~x & z);
+  if (group === 2) return (x | ~y) ^ z;
+  if (group === 3) return (x & z) | (y & ~z);
+  return x ^ (y | ~z);
+}
+// Reusable 16-word RIPEMD-160 message block buffer.
+const BUF_160 = /* @__PURE__ */ new Uint32Array(16);
+/**
+ * Internal RIPEMD-160 legacy hash class.
+ * RFC 2286 only adds HMAC-RIPEMD160 material, not the core hash specification.
+ */
+export class _RIPEMD160 extends HashMD<_RIPEMD160> {
+  private h0 = 0x67452301 | 0;
+  private h1 = 0xefcdab89 | 0;
+  private h2 = 0x98badcfe | 0;
+  private h3 = 0x10325476 | 0;
+  private h4 = 0xc3d2e1f0 | 0;
+
+  constructor() {
+    super(64, 20, 8, true);
+  }
+  protected get(): [number, number, number, number, number] {
+    const { h0, h1, h2, h3, h4 } = this;
+    return [h0, h1, h2, h3, h4];
+  }
+  protected set(h0: number, h1: number, h2: number, h3: number, h4: number): void {
+    this.h0 = h0 | 0;
+    this.h1 = h1 | 0;
+    this.h2 = h2 | 0;
+    this.h3 = h3 | 0;
+    this.h4 = h4 | 0;
+  }
+  _cloneInto(to?: _RIPEMD160): _RIPEMD160 {
+    (to ||= new (this.constructor as any)() as _RIPEMD160).set(...this.get());
+    return this._cloneIntoMeta(to);
+  }
+  protected process(view: DataView, offset: number): void {
+    for (let i = 0; i < 16; i++, offset += 4) BUF_160[i] = view.getUint32(offset, true);
+    // prettier-ignore
+    let al = this.h0 | 0, ar = al,
+        bl = this.h1 | 0, br = bl,
+        cl = this.h2 | 0, cr = cl,
+        dl = this.h3 | 0, dr = dl,
+        el = this.h4 | 0, er = el;
+
+    // Instead of iterating 0 to 80, we split it into 5 groups
+    // And use the groups in constants, functions, etc. Much simpler
+    for (let group = 0; group < 5; group++) {
+      const rGroup = 4 - group;
+      const hbl = Kl160[group], hbr = Kr160[group]; // prettier-ignore
+      const rl = idxL[group], rr = idxR[group]; // prettier-ignore
+      const sl = shiftsL160[group], sr = shiftsR160[group]; // prettier-ignore
+      for (let i = 0; i < 16; i++) {
+        const tl = (rotl(al + ripemd_f(group, bl, cl, dl) + BUF_160[rl[i]] + hbl, sl[i]) + el) | 0;
+        al = el, el = dl, dl = rotl(cl, 10) | 0, cl = bl, bl = tl; // prettier-ignore
+      }
+      // 2 loops are 10% faster
+      for (let i = 0; i < 16; i++) {
+        const tr = (rotl(ar + ripemd_f(rGroup, br, cr, dr) + BUF_160[rr[i]] + hbr, sr[i]) + er) | 0;
+        ar = er, er = dr, dr = rotl(cr, 10) | 0, cr = br, br = tr; // prettier-ignore
+      }
+    }
+    // Add the compressed chunk to the current hash value
+    // Final recombination cross-adds the left/right lane accumulators into the next h0..h4 order.
+    this.set(
+      (this.h1 + cl + dr) | 0,
+      (this.h2 + dl + er) | 0,
+      (this.h3 + el + ar) | 0,
+      (this.h4 + al + br) | 0,
+      (this.h0 + bl + cr) | 0
+    );
+  }
+  protected roundClean(): void {
+    clean(BUF_160);
+  }
+  destroy(): void {
+    this.destroyed = true;
+    clean(this.buffer);
+    this.set(0, 0, 0, 0, 0);
+  }
+}
+
+/**
+ * RIPEMD-160 - a legacy hash function from 1990s.
+ * RFC 2286 only covers HMAC-RIPEMD160 test material; the links below point
+ * at the base RIPEMD-160 references.
+ * * {@link https://homes.esat.kuleuven.be/~bosselae/ripemd160.html}
+ * * {@link https://homes.esat.kuleuven.be/~bosselae/ripemd160/pdf/AB-9601/AB-9601.pdf}
+ * @param msg - message bytes to hash
+ * @param opts - Reserved hash options.
+ * @returns Digest bytes.
+ * @example
+ * Hash a message with RIPEMD-160.
+ * ```ts
+ * ripemd160(new Uint8Array([97, 98, 99]));
+ * ```
+ */
+export const ripemd160: TRet<CHash> = /* @__PURE__ */ createHasher(() => new _RIPEMD160());