@tokenoftrust/storefront-runner 4.13.0 → 4.14.0

package/apps/storefront/src/config/kvTenantResolver.ts

@@ -17,9 +17,10 @@
  */
 import type { TenantConfig, TenantResolver } from "@tot/public-runtime";
 import { withPlatformPolicy } from "@/config/tenants";
+import { TENANT_RECORD_PREFIX } from "@/config/storedTenantRecord";
 
 const DOMAIN_PREFIX = "domain:";
-const TENANT_PREFIX = "tenant:";
+const TENANT_PREFIX = TENANT_RECORD_PREFIX;
 const DEFAULT_KEY = "config:default_tenant";
 // Edge-cache KV reads briefly; tenant config changes are rare and propagate
 // within this window. Bump down if you need faster propagation after a write.

package/apps/storefront/src/config/storedTenantRecord.ts

@@ -0,0 +1,27 @@
+/**
+ * The `tenant:<id>` KV record exactly as stored, for an in-place edit of one field (the admin
+ * add-ons switch). Separate from kvTenantResolver so lib/pages can use it without importing the
+ * concrete resolver (depcruise `tenancy-resolver-fence`); the resolver takes its key prefix from here.
+ */
+export const TENANT_RECORD_PREFIX = "tenant:";
+
+/**
+ * Read with no edge cache (`cacheTtl`) and no platform-policy overlay. A read-modify-write must
+ * start here, never from `resolveStrict`, which can return a copy up to its cache TTL old and
+ * carries platform fields the record itself does not hold.
+ */
+export async function getStoredTenantRecord(kv: KVNamespace, tenantId: string): Promise<string | null> {
+  return kv.get(TENANT_RECORD_PREFIX + tenantId);
+}
+
+/**
+ * Write ONLY the `tenant:<id>` record key. Unlike putTenant it never touches the domain index or
+ * the default-tenant key, so an in-place edit of one field cannot re-point a hostname.
+ */
+export async function putStoredTenantRecord(
+  kv: KVNamespace,
+  tenantId: string,
+  record: Record<string, unknown>,
+): Promise<void> {
+  await kv.put(TENANT_RECORD_PREFIX + tenantId, JSON.stringify(record));
+}

package/apps/storefront/src/lib/assets/addons/addonsClient.ts

@@ -0,0 +1,59 @@
+/**
+ * Client island for `/admin/addons` (ADR 0013): each add-on card's button POSTs the mode it names to
+ * `/api/admin/addons` and redraws the card from the confirmed state the API returns. A no-op when
+ * the page rendered no cards (unauthorized viewer).
+ */
+export function initAddOnsPage(apiPath: string): void {
+  for (const button of document.querySelectorAll<HTMLButtonElement>("[data-addon-toggle]")) {
+    button.addEventListener("click", () => void toggle(apiPath, button));
+  }
+}
+
+async function toggle(apiPath: string, button: HTMLButtonElement): Promise<void> {
+  const card = button.closest<HTMLElement>("[data-addon-id]");
+  const id = card?.dataset.addonId;
+  const mode = button.dataset.addonNextMode;
+  const status = card?.querySelector<HTMLElement>("[data-addon-status]");
+  if (!card || !id || !mode) return;
+
+  button.disabled = true;
+  if (status) {
+    status.textContent = "Saving…";
+    status.dataset.tone = "";
+  }
+  try {
+    const res = await fetch(apiPath, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ id, mode }),
+    });
+    let body: { ok?: boolean; state?: { mode?: string }; status?: string };
+    try {
+      body = (await res.json()) as typeof body;
+    } catch {
+      throw new Error(`HTTP ${res.status}`);
+    }
+    if (!res.ok || !body.ok || !body.state?.mode) throw new Error(body.status || `HTTP ${res.status}`);
+    render(card, button, body.state.mode);
+    if (status) {
+      status.textContent = body.state.mode === "enabled" ? "Enabled." : "Disabled.";
+      status.dataset.tone = "ok";
+    }
+  } catch (error) {
+    if (status) {
+      status.textContent = `Could not save (${error instanceof Error ? error.message : "error"}).`;
+      status.dataset.tone = "error";
+    }
+  } finally {
+    button.disabled = false;
+  }
+}
+
+function render(card: HTMLElement, button: HTMLButtonElement, mode: string): void {
+  const enabled = mode === "enabled";
+  card.dataset.addonMode = mode;
+  const chip = card.querySelector<HTMLElement>("[data-addon-chip]");
+  if (chip) chip.textContent = enabled ? "Enabled" : "Off";
+  button.dataset.addonNextMode = enabled ? "disabled" : "enabled";
+  button.textContent = enabled ? "Turn off" : "Turn on";
+}

package/apps/storefront/src/lib/assets/addons/catalog.ts

@@ -0,0 +1,47 @@
+/**
+ * The add-ons a store owner can turn on or off from `/admin/addons`. Static on purpose: an add-on
+ * id or mode a request names is valid only if it appears here, so the API refuses anything else.
+ *
+ * State lives only in the tenant record (`addOns.<id>.mode`); nothing here reads the environment.
+ * High Fidelity / Large Images is read back by `resolveImageTier`, which treats every value but
+ * `"enabled"` as the standard tier.
+ */
+import { IMAGE_TIERS, LARGE_IMAGES_ADDON_NAME } from "@tot/public-runtime/image-limits";
+
+export const ADDON_MODES = ["enabled", "disabled"] as const;
+export type AddOnMode = (typeof ADDON_MODES)[number];
+
+export const ADDON_IDS = ["largeImages"] as const;
+export type AddOnId = (typeof ADDON_IDS)[number];
+
+export interface AddOnDefinition {
+  id: AddOnId;
+  name: string;
+  description: string;
+  modes: readonly AddOnMode[];
+}
+
+const MiB = 1024 * 1024;
+const mb = (bytes: number) => `${Math.round((bytes / MiB) * 10) / 10} MB`;
+const mp = (pixels: number) => `${Math.round((pixels / 1_000_000) * 10) / 10} MP`;
+const limits = (tier: { maxEncodedBytes: number; maxPixels: number; maxDimension: number }) =>
+  `${mb(tier.maxEncodedBytes)}, ${mp(tier.maxPixels)}, ${tier.maxDimension}px on a side`;
+
+export const ADDONS: readonly AddOnDefinition[] = Object.freeze([
+  {
+    id: "largeImages",
+    name: LARGE_IMAGES_ADDON_NAME,
+    description:
+      `Raises this store's image limit from the standard ${limits(IMAGE_TIERS.standard)} ` +
+      `to ${limits(IMAGE_TIERS.large)}. Takes effect on the next capture or upload.`,
+    modes: ADDON_MODES,
+  },
+]);
+
+export function isAddOnId(value: unknown): value is AddOnId {
+  return typeof value === "string" && (ADDON_IDS as readonly string[]).includes(value);
+}
+
+export function isAddOnMode(value: unknown): value is AddOnMode {
+  return typeof value === "string" && (ADDON_MODES as readonly string[]).includes(value);
+}

package/apps/storefront/src/lib/assets/addons/tenantAddOns.ts

@@ -0,0 +1,89 @@
+/**
+ * Read and write a tenant's add-on state (`addOns.<id>` on its KV record).
+ *
+ * The write is a read-modify-write of the RAW stored record: read `tenant:<id>` with no edge cache
+ * and no platform-policy overlay, change only `addOns.<id>`, and write back only that key. A cached
+ * read (`resolveStrict` caches 300 s) would clobber a field written since, and an overlaid read would
+ * persist platform policy into the record. A missing record is refused, never created: a tenant
+ * served from the static fallback has no record to edit.
+ *
+ * KV read-modify-write is not atomic; two simultaneous toggles can lose one. Acceptable for an
+ * owner switch, and no other field is at risk because both writers spread the same fresh read.
+ */
+import { getStoredTenantRecord, putStoredTenantRecord } from "@/config/storedTenantRecord";
+import { ADDONS, isAddOnId, isAddOnMode, type AddOnId, type AddOnMode } from "./catalog";
+
+export interface AddOnState {
+  mode: AddOnMode;
+  updatedAt?: string;
+  updatedBy?: string;
+}
+
+export type AddOnsState = Record<AddOnId, AddOnState>;
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+/** Every catalog add-on's state on `record`. Anything but `mode: "enabled"` reads as disabled. */
+export function readAddOns(record: unknown): AddOnsState {
+  const stored = isRecord(record) && isRecord(record.addOns) ? record.addOns : {};
+  const state = {} as AddOnsState;
+  for (const addOn of ADDONS) {
+    const entry = stored[addOn.id];
+    const out: AddOnState = { mode: isRecord(entry) && entry.mode === "enabled" ? "enabled" : "disabled" };
+    if (isRecord(entry) && typeof entry.updatedAt === "string") out.updatedAt = entry.updatedAt;
+    if (isRecord(entry) && typeof entry.updatedBy === "string") out.updatedBy = entry.updatedBy;
+    state[addOn.id] = out;
+  }
+  return state;
+}
+
+function parseStored(raw: string | null): Record<string, unknown> | null | "unreadable" {
+  if (raw === null) return null;
+  try {
+    const parsed: unknown = JSON.parse(raw);
+    return isRecord(parsed) ? parsed : "unreadable";
+  } catch {
+    return "unreadable";
+  }
+}
+
+/** The stored record's add-on state, or null when the tenant has no readable KV record. */
+export async function readStoredAddOns(kv: KVNamespace, tenantId: string): Promise<AddOnsState | null> {
+  const record = parseStored(await getStoredTenantRecord(kv, tenantId));
+  return record && record !== "unreadable" ? readAddOns(record) : null;
+}
+
+export type SetAddOnResult =
+  | { ok: true; state: AddOnState }
+  | { ok: false; status: 400; reason: "unknown_addon" | "unknown_mode" }
+  | { ok: false; status: 404; reason: "no_tenant_record" }
+  | { ok: false; status: 409; reason: "tenant_record_unreadable" }
+  | { ok: false; status: 503; reason: "write_not_confirmed" };
+
+export async function setAddOn(
+  kv: KVNamespace,
+  tenantId: string,
+  id: unknown,
+  mode: unknown,
+  actor: string,
+  now: Date,
+): Promise<SetAddOnResult> {
+  if (!isAddOnId(id)) return { ok: false, status: 400, reason: "unknown_addon" };
+  if (!isAddOnMode(mode)) return { ok: false, status: 400, reason: "unknown_mode" };
+
+  const record = parseStored(await getStoredTenantRecord(kv, tenantId));
+  if (record === null) return { ok: false, status: 404, reason: "no_tenant_record" };
+  if (record === "unreadable") return { ok: false, status: 409, reason: "tenant_record_unreadable" };
+
+  const addOns = isRecord(record.addOns) ? record.addOns : {};
+  const entry: AddOnState = { mode, updatedAt: now.toISOString(), updatedBy: actor };
+  await putStoredTenantRecord(kv, tenantId, { ...record, addOns: { ...addOns, [id]: entry } });
+
+  const confirmed = parseStored(await getStoredTenantRecord(kv, tenantId));
+  if (!confirmed || confirmed === "unreadable") return { ok: false, status: 503, reason: "write_not_confirmed" };
+  const state = readAddOns(confirmed)[id];
+  if (state.mode !== mode) return { ok: false, status: 503, reason: "write_not_confirmed" };
+  return { ok: true, state };
+}

package/apps/storefront/src/lib/assets/durableR2.ts

@@ -7,7 +7,6 @@
  * Order, always: write the references (version manifest already in R2, or the holds), wait while a
  * bundle-GC sweep holds its lease, then stage and verify every object those references name.
  */
-import { sha256Hex } from "@tot/public-runtime";
 import { PINNED_ASSET_MEDIA_TYPE_BY_EXTENSION, sealedMediaTypeAllowed } from "@tot/public-runtime/hosted-image-media-types";
 import {
   durableAssetsStatusKey,
@@ -21,6 +20,7 @@ import {
 import { GC_LEASE_KEY, awaitGcQuiescence } from "@tot/public-runtime/retention-holds";
 import { authorizeAssetReference, type AssetRegistryStore, type AssetWrite } from "@tot/public-runtime/asset-registry";
 import { imageLimitsFor, type ImageTier } from "@tot/public-runtime/image-limits";
+import { incrementalSha256 } from "@tot/public-runtime/incremental-sha256";
 
 const MAX_MANIFEST = 1024 * 1024;
 const POOL_ENTRY_RE = /^([0-9a-f]{64})(\.[A-Za-z0-9]+)$/;
@@ -30,13 +30,17 @@ export interface R2ObjectLike {
   size: number;
   body?: ReadableStream<Uint8Array> | null;
   arrayBuffer?(): Promise<ArrayBuffer>;
+  /** The sha256 R2 verified when the object was put with one (`put(..., { sha256 })`). */
+  checksums?: { sha256?: ArrayBuffer };
 }
 
 export interface R2BucketLike {
   get(key: string): Promise<R2ObjectLike | null>;
-  put?(key: string, body: Uint8Array, options: {
+  put?(key: string, body: Uint8Array | ReadableStream<Uint8Array>, options: {
     httpMetadata: { contentType: string; cacheControl: string };
     onlyIf?: Headers;
+    /** R2 hashes the body as it arrives and refuses the put, writing nothing, when it differs. */
+    sha256?: string;
   }): Promise<unknown>;
 }
 
@@ -90,27 +94,136 @@ export async function readBounded(bucket: R2BucketLike, key: string, limit: numb
   return bytes;
 }
 
+
+function toHex(buffer: ArrayBuffer): string {
+  return [...new Uint8Array(buffer)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+
+/**
+ * Size and sha256 of an object of at most `limit` bytes, never holding it whole: R2's own verified
+ * checksum when the object was put with one, else its body hashed as it streams. Null when absent,
+ * larger than `limit`, or its body is not the size R2 reports.
+ */
+export async function digestBounded(bucket: Pick<R2BucketLike, "get">, key: string, limit: number): Promise<{ size: number; sha256: string } | null> {
+  const object = await bucket.get(key);
+  if (!object) return null;
+  if (!Number.isSafeInteger(object.size) || object.size < 0 || object.size > limit) {
+    await object.body?.cancel().catch(() => {});
+    return null;
+  }
+  const checksum = object.checksums?.sha256;
+  if (checksum && checksum.byteLength === 32) {
+    await object.body?.cancel().catch(() => {});
+    return { size: object.size, sha256: toHex(checksum) };
+  }
+  if (!object.body) {
+    // Only an in-memory test double lacks a body; R2 always streams one.
+    if (!object.arrayBuffer) return null;
+    const whole = new Uint8Array(await object.arrayBuffer());
+    if (whole.byteLength !== object.size) return null;
+    const hash = incrementalSha256();
+    await hash.update(whole);
+    return { size: object.size, sha256: await hash.hex() };
+  }
+  const hash = incrementalSha256();
+  const reader = object.body.getReader();
+  let size = 0;
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > object.size || size > limit) {
+        await reader.cancel().catch(() => {});
+        return null;
+      }
+      await hash.update(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return size === object.size ? { size, sha256: await hash.hex() } : null;
+}
+
+/**
+ * `body` passed through unchanged, erroring the stream on an overrun or a short end: a copy can never
+ * be stored at a size other than the one verified. workerd's `FixedLengthStream` then gives R2 the
+ * known length a streamed put requires.
+ */
+function exactLength(body: ReadableStream<Uint8Array>, length: number): ReadableStream<Uint8Array> {
+  let seen = 0;
+  const counted = body.pipeThrough(new TransformStream<Uint8Array, Uint8Array>({
+    transform(chunk, controller) {
+      seen += chunk.byteLength;
+      if (seen > length) throw new R2StagingError("source-overrun");
+      controller.enqueue(chunk);
+    },
+    flush() {
+      if (seen !== length) throw new R2StagingError("source-short");
+    },
+  }));
+  const Fixed = (globalThis as { FixedLengthStream?: new (length: number) => TransformStream<Uint8Array, Uint8Array> }).FixedLengthStream;
+  return typeof Fixed === "function" ? counted.pipeThrough(new Fixed(length)) : counted;
+}
+
+/** A verified object to copy as a stream: its size, and a fresh read of its body. */
+export interface StreamSource {
+  size: number;
+  open(): Promise<ReadableStream<Uint8Array>>;
+}
+
+/**
+ * The object at `key` as a {@link StreamSource}, once its size and sha256 (hashed as a stream) are
+ * `address` within `limit`; null otherwise. Nothing is held: the copy re-reads the body.
+ */
+export async function verifiedObjectSource(bucket: Pick<R2BucketLike, "get">, key: string, address: string, limit: number): Promise<StreamSource | null> {
+  const digest = await digestBounded(bucket, key, limit);
+  if (!digest || digest.size < 1 || digest.sha256 !== address) return null;
+  return {
+    size: digest.size,
+    async open() {
+      const object = await bucket.get(key);
+      if (!object || object.size !== digest.size) {
+        await object?.body?.cancel().catch(() => {});
+        throw new R2StagingError("original-missing");
+      }
+      if (object.body) return object.body;
+      // Only an in-memory test double lacks a body; R2 always streams one.
+      if (!object.arrayBuffer) throw new R2StagingError("original-missing");
+      const whole = new Uint8Array(await object.arrayBuffer());
+      return new ReadableStream<Uint8Array>({ start(controller) { controller.enqueue(whole); controller.close(); } });
+    },
+  };
+}
+
 /** Wait while a bundle-GC sweep holds its lease in `bucket`. */
 export function awaitR2Quiescence(bucket: R2BucketLike, waiter: QuiescenceWaiter = awaitGcQuiescence): Promise<{ waited: boolean }> {
   return waiter({ readLease: () => readBounded(bucket, GC_LEASE_KEY, 64 * 1024) });
 }
 
-/** Present with exactly `bytes`, writing it create-only when absent; refuses a mismatched object. */
-export async function ensurePoolObject(bucket: R2BucketLike, key: string, bytes: Uint8Array, mediaType: string): Promise<void> {
+/**
+ * Present with exactly the source's bytes, writing it create-only when absent; refuses a mismatched
+ * object. A {@link StreamSource} is streamed into R2 with its sha256, so R2 refuses (writes nothing)
+ * on any other body; the existing object and the read-back are hashed as streams, never held whole.
+ */
+export async function ensurePoolObject(bucket: R2BucketLike, key: string, source: Uint8Array | StreamSource, mediaType: string): Promise<void> {
   const address = POOL_ENTRY_RE.exec(key.replace(/^assets\//, ""))?.[1];
   if (!address) throw new R2StagingError("pool-key");
-  // Bounded by the bytes being staged: an object of any other size cannot hold this address.
-  const existing = await readBounded(bucket, key, bytes.byteLength);
-  if (existing && await sha256Hex(existing) !== address) throw new R2StagingError("store-mismatch");
+  const size = source instanceof Uint8Array ? source.byteLength : source.size;
+  // Bounded by the size being staged: an object of any other size cannot hold this address.
+  const existing = await digestBounded(bucket, key, size);
+  if (existing && (existing.sha256 !== address || existing.size !== size)) throw new R2StagingError("store-mismatch");
   if (!existing) {
     if (!bucket.put) throw new R2StagingError("store-unwritable");
-    await bucket.put(key, bytes, {
+    await bucket.put(key, source instanceof Uint8Array ? source : exactLength(await source.open(), size), {
       httpMetadata: { contentType: mediaType, cacheControl: IMMUTABLE },
       onlyIf: new Headers({ "If-None-Match": "*" }),
+      sha256: address,
     });
   }
-  const readback = await readBounded(bucket, key, bytes.byteLength);
-  if (!readback || readback.byteLength !== bytes.byteLength || await sha256Hex(readback) !== address) {
+  const readback = await digestBounded(bucket, key, size);
+  if (!readback || readback.size !== size || readback.sha256 !== address) {
     throw new R2StagingError("store-mismatch");
   }
 }
@@ -132,13 +245,14 @@ function mediaTypeOf(entry: string): string {
   return mediaType;
 }
 
-/** The exact captured bytes for `<sha256><ext>` from the tenant's capture store, within its tier. */
-async function capturedBytes(captureBucket: R2BucketLike, tenant: string, entry: string, imageTier: ImageTier | undefined): Promise<Uint8Array> {
+/** The tenant's captured `<sha256><ext>`, verified as a stream within its tier; never held whole. */
+async function capturedSource(captureBucket: R2BucketLike, tenant: string, entry: string, imageTier: ImageTier | undefined): Promise<StreamSource> {
   const address = POOL_ENTRY_RE.exec(entry)?.[1];
   if (!address) throw new R2StagingError("pool-key");
-  const bytes = await readBounded(captureBucket, `original-images/${tenant}/objects/${address}`, imageLimitsFor(imageTier).maxEncodedBytes);
-  if (!bytes || bytes.byteLength < 1 || await sha256Hex(bytes) !== address) throw new R2StagingError("original-missing");
-  return bytes;
+  const source = await verifiedObjectSource(captureBucket, `original-images/${tenant}/objects/${address}`, address,
+    imageLimitsFor(imageTier).maxEncodedBytes);
+  if (!source) throw new R2StagingError("original-missing");
+  return source;
 }
 
 /**
@@ -151,7 +265,8 @@ async function capturedBytes(captureBucket: R2BucketLike, tenant: string, entry:
  * tenant's own capture store (which registers it); otherwise nothing is staged and the go-live
  * refuses `asset-unauthorized`.
  *
- * Originals are read one at a time, within the tenant's image tier, and never held across entries.
+ * Originals are hashed and copied as streams, one at a time, within the tenant's image tier: none is
+ * ever held whole.
  */
 export async function stageCapturedOriginalsR2(input: {
   tenant: string;
@@ -167,11 +282,11 @@ export async function stageCapturedOriginalsR2(input: {
   const unauthorized: string[] = [];
   for (const entry of input.entries) {
     if (authorizeAssetReference([registry], input.tenant, entry).ok) continue;
-    const own = await capturedBytes(input.captureBucket, input.tenant, entry, input.imageTier).catch((error: unknown) => {
+    const own = await capturedSource(input.captureBucket, input.tenant, entry, input.imageTier).catch((error: unknown) => {
       if (error instanceof R2StagingError) return null;
       throw error;
     });
-    if (own) owned.set(entry, own.byteLength);
+    if (own) owned.set(entry, own.size);
     else unauthorized.push(entry);
   }
   if (input.registry && owned.size > 0) {
@@ -184,10 +299,10 @@ export async function stageCapturedOriginalsR2(input: {
   let staged = 0;
   for (const entry of input.entries) {
     const key = `assets/${entry}`;
-    const present = await readBounded(input.publicBucket, key, imageLimitsFor(input.imageTier).maxEncodedBytes);
+    const present = await digestBounded(input.publicBucket, key, imageLimitsFor(input.imageTier).maxEncodedBytes);
     const address = POOL_ENTRY_RE.exec(entry)?.[1];
-    if (present && address && await sha256Hex(present) === address) continue;
-    await ensurePoolObject(input.publicBucket, key, await capturedBytes(input.captureBucket, input.tenant, entry, input.imageTier), mediaTypeOf(entry));
+    if (present && address && present.sha256 === address) continue;
+    await ensurePoolObject(input.publicBucket, key, await capturedSource(input.captureBucket, input.tenant, entry, input.imageTier), mediaTypeOf(entry));
     staged++;
   }
   return staged;
@@ -281,7 +396,7 @@ export async function designateDurableR2(input: {
   for (const item of prepared) {
     await createHold(input.publicBucket, item.holdKey, item.holdBody);
     await ensurePoolObject(input.publicBucket, `assets/${item.entry}`,
-      await capturedBytes(input.captureBucket, input.tenant, item.entry, input.imageTier), item.mediaType);
+      await capturedSource(input.captureBucket, input.tenant, item.entry, input.imageTier), item.mediaType);
   }
   await recordDurableStatusKv(input.kv, input.tenant, { revision: input.revision, at: now().toISOString(), declared,
     designated: prepared.map((item) => ({ entry: item.entry, name: item.image.name, source: item.image.source, verifiedStores: ["r2"] })) });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.13.0",
+  "version": "4.14.0",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/package.json

@@ -24,6 +24,7 @@
     "./asset-registry": "./src/asset-registry.ts",
     "./responsive-renditions": "./src/responsive-renditions.ts",
     "./svg-sanitize": "./src/svg-sanitize.ts",
+    "./incremental-sha256": "./src/incremental-sha256.ts",
     "./image-limits": "./src/image-limits.mjs",
     "./image-release-gate": "./src/image-release-gate.ts",
     "./pool-asset-headers": "./src/pool-asset-headers.ts",

package/packages/public-runtime/src/incremental-sha256.ts

@@ -0,0 +1,40 @@
+/**
+ * An incremental sha256 that holds one chunk at a time: workerd's `crypto.DigestStream`, else (Node,
+ * where the tests run) `node:crypto` through `process.getBuiltinModule`, never a static import, so
+ * this module stays safe to bundle into the Worker.
+ */
+type DigestStreamClass = new (algorithm: string) => WritableStream<Uint8Array> & { digest: Promise<ArrayBuffer> };
+type NodeHash = { update(chunk: Uint8Array): unknown; digest(encoding: "hex"): string };
+
+export type IncrementalSha256 = { update(chunk: Uint8Array): Promise<void>; hex(): Promise<string> };
+
+function toHex(buffer: ArrayBuffer): string {
+  return [...new Uint8Array(buffer)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+export function incrementalSha256(): IncrementalSha256 {
+  const Digest = (globalThis.crypto as unknown as { DigestStream?: DigestStreamClass } | undefined)?.DigestStream;
+  if (typeof Digest === "function") {
+    const stream = new Digest("SHA-256");
+    const writer = stream.getWriter();
+    return {
+      update: (chunk) => writer.write(chunk),
+      async hex() {
+        await writer.close();
+        return toHex(await stream.digest);
+      },
+    };
+  }
+  const nodeCrypto = (globalThis as { process?: { getBuiltinModule?(id: string): unknown } }).process
+    ?.getBuiltinModule?.("node:crypto") as { createHash(algorithm: string): NodeHash } | undefined;
+  if (!nodeCrypto) throw new Error("digest-unavailable");
+  const hash = nodeCrypto.createHash("sha256");
+  return {
+    async update(chunk) {
+      hash.update(chunk);
+    },
+    async hex() {
+      return hash.digest("hex");
+    },
+  };
+}