1
// Tiny helpers shared between the Node-side global setup and any in-spec
2
// helpers that need to reproduce the worker's token-hashing scheme.
3
// Mirrors src/worker/services/crypto.ts (which uses Web Crypto, identical
4
// behaviour in Node 20+).
5
 
6
export const encodeBase64Url = (bytes: Uint8Array): string =>
7
  Buffer.from(bytes).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
8
 
9
// Mirrors src/worker/services/crypto.ts — base64url-encoded digest, NOT
10
// hex. The worker hashes invite tokens with this scheme; we have to match
11
// it byte-for-byte so the hash we INSERT in setup matches the hash the
12
// worker computes when the spec POSTs the token to /api/invite/<token>.
13
export const sha256 = async (input: string): Promise<string> => {
14
  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
15
  return encodeBase64Url(new Uint8Array(digest));
16
};