"use strict";
/* Socket Lib - Built with rolldown */
Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
const require_crypto_hash = require('./crypto/hash.js');
const require_primordials_buffer = require('./primordials/buffer.js');
const require_primordials_error = require('./primordials/error.js');
const require_primordials_string = require('./primordials/string.js');
let node_crypto = require("node:crypto");

//#region src/integrity.ts
/**
* @file Integrity specification helpers for downloads and file verification.
*   Used by `dlx/binary-download` and external-tools resolvers; safe to consume
*   from any module that needs to verify bytes against an expected hash. Single
*   supported format per flavor:
*
*   - integrity: SRI with sha512 only (what npm registry returns)
*   - checksum: sha256 hex (what `shasum -a 256` produces; common for binary
*     release assets on GitHub) Callers may pass a {@link HashSpec} as a bare
*     string (sniffed via format) or as an explicit `{ type, value }` object.
*     The normalized form carried around internally is always the object.
*/
const INTEGRITY_PREFIX = "sha512-";
const INTEGRITY_BODY_RE = /^[A-Za-z0-9+/=]+$/;
const CHECKSUM_RE = /^[a-f0-9]{64}$/i;
/**
* Compute both integrity (sha512 SRI) and checksum (sha256 hex) for a buffer of
* bytes.
*/
function computeHashes(bytes) {
	return {
		integrity: `sha512-${/* @__PURE__ */ require_crypto_hash.hash("sha512", bytes, "base64")}`,
		checksum: /* @__PURE__ */ require_crypto_hash.hash("sha256", bytes, "hex")
	};
}
function isChecksumString(s) {
	return CHECKSUM_RE.test(s);
}
function isIntegrityString(s) {
	if (!require_primordials_string.StringPrototypeStartsWith(s, INTEGRITY_PREFIX)) return false;
	const body = require_primordials_string.StringPrototypeSlice(s, 7);
	return body.length > 0 && INTEGRITY_BODY_RE.test(body);
}
/**
* Normalize a {@link HashSpec} to its canonical `{ type, value }` form.
*
* - Object form is trusted (its `value` is validated for shape).
* - Bare string matching sha512 SRI → integrity.
* - Bare string of 64 hex chars → checksum.
* - Anything else throws TypeError.
*
* @throws TypeError if the string is not a recognized format, or if an explicit
*   object's value doesn't match its declared type.
*/
function normalizeHash(spec) {
	if (typeof spec === "object" && spec !== null) {
		if (spec.type === "integrity") {
			if (!isIntegrityString(spec.value)) throw new require_primordials_error.TypeErrorCtor(`Expected SRI integrity string "sha512-<base64>", got: ${spec.value}`);
			return {
				type: "integrity",
				value: spec.value
			};
		}
		if (spec.type === "checksum") {
			if (!isChecksumString(spec.value)) throw new require_primordials_error.TypeErrorCtor(`Expected sha256 hex string (64 hex chars), got: ${spec.value}`);
			return {
				type: "checksum",
				value: spec.value
			};
		}
		throw new require_primordials_error.TypeErrorCtor(`Unknown hash type: ${spec.type}`);
	}
	if (typeof spec !== "string") throw new require_primordials_error.TypeErrorCtor(`HashSpec must be a string or { type, value } object, got: ${typeof spec}`);
	if (isIntegrityString(spec)) return {
		type: "integrity",
		value: spec
	};
	if (isChecksumString(spec)) return {
		type: "checksum",
		value: spec
	};
	throw new require_primordials_error.TypeErrorCtor(`Unrecognized hash format. Expected SRI integrity ("sha512-<base64>") or sha256 hex (64 hex chars), got: ${spec}`);
}
/**
* Verify computed hashes against an expected {@link NormalizedHash}. Uses
* `crypto.timingSafeEqual` for constant-time comparison.
*
* @throws DlxHashMismatchError when the hash of the matching type doesn't match
*   the expected value.
*/
function verifyHash(expected, computed) {
	const actual = expected.type === "integrity" ? computed.integrity : computed.checksum;
	const expectedBuf = require_primordials_buffer.BufferFrom(expected.value);
	const actualBuf = require_primordials_buffer.BufferFrom(actual);
	if (expectedBuf.length !== actualBuf.length || !(0, node_crypto.timingSafeEqual)(expectedBuf, actualBuf)) throw new DlxHashMismatchError(expected, computed);
}
/**
* Thrown when an expected hash doesn't match the computed hash of the
* downloaded bytes. Carries both sides for diagnostics.
*/
var DlxHashMismatchError = class extends Error {
	expected;
	actual;
	constructor(expected, actual) {
		const actualValue = expected.type === "integrity" ? actual.integrity : actual.checksum;
		super(`Hash mismatch (${expected.type}): expected ${expected.value}, got ${actualValue}`);
		this.name = "DlxHashMismatchError";
		this.expected = expected;
		this.actual = actual;
	}
};

//#endregion
exports.DlxHashMismatchError = DlxHashMismatchError;
exports.computeHashes = computeHashes;
exports.isChecksumString = isChecksumString;
exports.isIntegrityString = isIntegrityString;
exports.normalizeHash = normalizeHash;
exports.verifyHash = verifyHash;