fix(tools): correctness and robustness fixes from the upstream backlog

Seven long-open upstream fixes, verified in a real browser.

ASCII text drawer (CorentinTh#1774/CorentinTh#1690/CorentinTh#1685/CorentinTh#1651 - four PRs for one bug): fonts were
fetched from a protocol-relative `//unpkg.com/figlet@1.6.0/fonts/` URL, pinned
to a version the project no longer installs. That resolves to file:// when the
build is opened from disk, is blocked by strict connect-src policies, and
leaves the tool stuck on "Loading font..." with no error whenever the CDN is
unreachable - which is exactly what it did here before this change. The fonts
are now emitted into the bundle by a small Vite plugin and served from the
deployment's own origin, so the tool works offline and has no third-party
runtime dependency. They are still fetched individually on demand, so the
initial payload is unchanged.

text-to-binary (CorentinTh#1085): encoded with charCodeAt per character, so anything
above U+00FF produced more than eight bits and broke the octet grouping, and
split('') tore surrogate pairs apart. Now encodes UTF-8, so every group is
exactly eight bits and any script round-trips.

text-to-unicode (CorentinTh#1087): same surrogate-pair bug - an emoji became two
meaningless entities. Now iterates by code point.

bcrypt (CorentinTh#1152): hashSync and compareSync throw on an out-of-range salt count
and on a malformed hash. Those throws escaped a computed during render and
blanked the whole tool; both are now guarded.

Hash text (CorentinTh#986): adds the explicit SHA3-224/256/384/512 output sizes, since
crypto-js silently defaults SHA3 to 512 bits.

UUID generator (CorentinTh#1441): adds v6 and v7, which required uuid 9 to 11. The node
identifier option changed from number[] to Uint8Array in that major, and the
validation pattern now accepts versions 1-7.

Command palette (CorentinTh#1440): the per-category result cap of five was written for
the original tool set; with well over a hundred tools a search for "json" or
"ip" hid most of its own matches. Raised to twelve.

The API's hash and UUID endpoints pick up the new algorithms and versions.

Lint, 356 unit tests, both typechecks, the build and all 72 Playwright e2e
tests pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019u4HjVENAajio7cxNSDzir

Author: claude

package.json

@@ -140,7 +140,7 @@
     "unicode-emoji-json": "^0.4.0",
     "unixcrypt-browser": "^2.0.4",
     "unplugin-auto-import": "^0.16.4",
-    "uuid": "^9.0.0",
+    "uuid": "^11.1.1",
     "vue": "^3.3.4",
     "vue-i18n": "^9.9.1",
     "vue-router": "^4.1.6",

pnpm-lock.yaml

@@ -144,7 +144,8 @@ describe('api', () => {
 
       expect(data.digests.MD5).toBe('5d41402abc4b2a76b9719d911017c592');
       expect(data.digests.SHA256).toBe('2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824');
-      expect(Object.keys(data.digests)).toHaveLength(8);
+      expect(Object.keys(data.digests)).toHaveLength(12);
+      expect(data.digests['SHA3-256']).toHaveLength(64);
     });
 
     it('hashes with a single algorithm and encoding', async () => {

server/app.test.ts

@@ -1,7 +1,7 @@
 import { HmacMD5, HmacRIPEMD160, HmacSHA1, HmacSHA224, HmacSHA256, HmacSHA3, HmacSHA384, HmacSHA512, enc } from 'crypto-js';
 import bcrypt from 'bcryptjs';
 import { ulid } from 'ulid';
-import { NIL as uuidNil, v1 as uuidV1, v3 as uuidV3, v4 as uuidV4, v5 as uuidV5 } from 'uuid';
+import { NIL as uuidNil, v1 as uuidV1, v3 as uuidV3, v4 as uuidV4, v5 as uuidV5, v6 as uuidV6, v7 as uuidV7 } from 'uuid';
 import { booleanQuery, defineEndpoint, z } from '../endpoint';
 import { badRequest } from '../errors';
 import {
@@ -144,7 +144,7 @@ export const cryptoEndpoints = [
     tag: 'Crypto',
     summary: 'Generate one or more UUIDs',
     input: z.object({
-      version: z.enum(['nil', 'v1', 'v3', 'v4', 'v5']).default('v4'),
+      version: z.enum(['nil', 'v1', 'v3', 'v4', 'v5', 'v6', 'v7']).default('v4'),
       count: z.coerce.number().int().min(1).max(100).default(1),
       namespace: z.string().optional().describe('Required for v3 and v5.'),
       name: z.string().optional().describe('Required for v3 and v5.'),
@@ -161,6 +161,12 @@ export const cryptoEndpoints = [
         if (version === 'v4') {
           return uuidV4();
         }
+        if (version === 'v6') {
+          return uuidV6();
+        }
+        if (version === 'v7') {
+          return uuidV7();
+        }
 
         if (!namespace || name === undefined) {
           throw badRequest(`UUID ${version} requires both "namespace" and "name".`);

server/routes/crypto.ts

@@ -81,8 +81,15 @@ export const useCommandPaletteStore = defineStore('command-palette', () => {
     },
   });
 
+  // Five was fine for the original tool set; with well over a hundred tools a search like "json"
+  // or "ip" was hiding most of its own matches behind the cap.
+  const maxSearchResultsPerCategory = 12;
+
   const filteredSearchResult = computed(() =>
-    _.chain(searchResult.value).groupBy('category').mapValues(categoryOptions => _.take(categoryOptions, 5)).value());
+    _.chain(searchResult.value)
+      .groupBy('category')
+      .mapValues(categoryOptions => _.take(categoryOptions, maxSearchResultsPerCategory))
+      .value());
 
   return {
     filteredSearchResult,

src/modules/command-palette/command-palette.store.ts

@@ -128,7 +128,7 @@ function activateOption(option: PaletteOption) {
       <c-input-text ref="inputRef" v-model:value="searchPrompt" raw-text placeholder="Type to search a tool or a command..." autofocus clearable />
 
       <div v-for="(options, category) in filteredSearchResult" :key="category">
-        <div ml-3 mt-3 text-sm font-bold text-primary op-60>
+        <div ml-3 mt-3 text-sm text-primary font-bold op-60>
           {{ category }}
         </div>
         <command-palette-option v-for="option in options" :key="option.name" :option="option" :selected="selectedOptionIndex === getOptionIndex(option)" @activated="activateOption" />

src/modules/command-palette/command-palette.vue

@@ -9,7 +9,11 @@ const output = ref('');
 const errored = ref(false);
 const processing = ref(false);
 
-figlet.defaults({ fontPath: '//unpkg.com/figlet@1.6.0/fonts/' });
+// Fonts are served from this deployment rather than from unpkg: the previous protocol-relative CDN
+// URL resolved to file:// when the build was opened from disk, was blocked by strict connect-src
+// policies, and left the tool stuck on "Loading font..." with no error whenever the CDN was
+// unreachable. See the figletFonts plugin in vite.config.ts.
+figlet.defaults({ fontPath: `${import.meta.env.BASE_URL}figlet-fonts/` });
 
 watchEffect(async () => {
   processing.value = true;

src/tools/ascii-text-drawer/ascii-text-drawer.vue

@@ -2,17 +2,23 @@
 import { compareSync, hashSync } from 'bcryptjs';
 import { useThemeVars } from 'naive-ui';
 import { useCopy } from '@/composable/copy';
+import { withDefaultOnError } from '@/utils/defaults';
 
 const themeVars = useThemeVars();
 
 const input = ref('');
 const saltCount = ref(10);
-const hashed = computed(() => hashSync(input.value, saltCount.value));
+
+// bcryptjs throws on an out-of-range salt count and on a malformed hash. Left unguarded, those
+// throws escape a computed during render and blank the whole tool.
+const hashed = computed(() => withDefaultOnError(() => hashSync(input.value, saltCount.value), ''));
 const { copy } = useCopy({ source: hashed, text: 'Hashed string copied to the clipboard' });
 
 const compareString = ref('');
 const compareHash = ref('');
-const compareMatch = computed(() => compareSync(compareString.value, compareHash.value));
+const compareMatch = computed(() =>
+  withDefaultOnError(() => compareSync(compareString.value, compareHash.value), false),
+);
 </script>
 
 <template>

src/tools/bcrypt/bcrypt.vue

@@ -9,14 +9,22 @@ export function convertHexToBin(hex: string) {
     .join('');
 }
 
+/**
+ * SHA3 defaults to a 512-bit digest in crypto-js, so the shorter Keccak output sizes are exposed
+ * explicitly rather than leaving callers to guess which one they got.
+ */
 export const hashAlgorithms = {
   MD5,
   SHA1,
-  SHA256,
   SHA224,
-  SHA512,
+  SHA256,
   SHA384,
+  SHA512,
   SHA3,
+  'SHA3-224': (message: string) => SHA3(message, { outputLength: 224 }),
+  'SHA3-256': (message: string) => SHA3(message, { outputLength: 256 }),
+  'SHA3-384': (message: string) => SHA3(message, { outputLength: 384 }),
+  'SHA3-512': (message: string) => SHA3(message, { outputLength: 512 }),
   RIPEMD160,
 } as const;
 

src/tools/hash-text/hash-text.service.ts

@@ -29,4 +29,26 @@ describe('text-to-binary', () => {
       expect(() => convertAsciiBinaryToText('1')).toThrow('Invalid binary string');
     });
   });
+
+  describe('non-ASCII text', () => {
+    it('encodes accented characters as UTF-8 octets', () => {
+      expect(convertTextToAsciiBinary('é')).toBe('11000011 10101001');
+    });
+
+    it('encodes characters outside the Basic Multilingual Plane', () => {
+      expect(convertTextToAsciiBinary('😀')).toBe('11110000 10011111 10011000 10000000');
+    });
+
+    it('round-trips text in any script', () => {
+      for (const text of ['héllo', 'Привет', 'こんにちは', '👨‍👩‍👧 family', 'مرحبا']) {
+        expect(convertAsciiBinaryToText(convertTextToAsciiBinary(text))).toBe(text);
+      }
+    });
+
+    it('keeps every group exactly eight bits wide', () => {
+      const groups = convertTextToAsciiBinary('日本語').split(' ');
+
+      expect(groups.every(group => group.length === 8)).toBe(true);
+    });
+  });
 });