create-windy 0.5.2 → 0.6.0

package/template/apps/server/src/index.ts

@@ -16,6 +16,10 @@ import { readPositiveInt } from "./runtime-config.js";
 // @windy-module system.agent begin
 import { registerAgentPlatformRuntime } from "./agent/runtime-bootstrap.js";
 import { DeferredAgentBackgroundOperationPortFactory } from "./agent/background-operation-port.js";
+import {
+  projectAiScreenshotIntakeFactoryV1,
+  projectAiScreenshotPageRegistryV2,
+} from "./app/ai-screenshot-intake-binding.js";
 import { resolveCurrentSystemActor } from "./system/actor.js";
 // @windy-module system.agent end
 import { createAuthRuntime } from "./auth/runtime.js";
@@ -38,10 +42,9 @@ import { createPlatformSettingsRuntime } from "./settings/runtime.js";
 import { registerNotificationRoutes } from "./notification/routes.js";
 // @windy-module system.notification end
 // @windy-module system.storage begin
-import { createStorageRuntime } from "./storage/runtime.js";
+import { createStorageHostRuntime } from "./storage/host-runtime.js";
 import { registerStorageRoutes } from "./storage/routes.js";
 // @windy-module system.storage end
-import { validateInstalledRuntime } from "./module-runtime-validation.js";
 import { installModuleHttpRuntime } from "./module-host/http-runtime.js";
 // @windy-module system.search begin
 import { adaptModuleSearchProviders } from "./module-host.js";
@@ -56,15 +59,10 @@ import { createSearchHost } from "./search/host.js";
 import { registerWorkflowRoutes } from "./workflow/routes.js";
 // @windy-module system.workflow end
 import { bootstrapServerModules } from "./module-bootstrap.js";
-import {
-  createHttpObservability,
-  listenPlatformServer,
-  logServerStartup,
-} from "./platform-http-runtime.js";
+import { createHttpObservability } from "./platform-http-runtime.js";
 import { bootstrapPlatformApp } from "./platform-app-bootstrap.js";
 import { createPreparedPlatformBootstrap } from "./startup-preflight.js";
-import { validateCompositionBeforeStartup } from "./startup-composition-validation.js";
-validateCompositionBeforeStartup();
+import { finalizePlatformStartup } from "./startup-finalization.js";
 const { logger, persistence, platformConfig, preparedModules } =
   await createPreparedPlatformBootstrap();
 const {
@@ -126,7 +124,7 @@ const {
   // @windy-module system.audit end
 });
 // @windy-module system.storage begin
-const storageRuntime = createStorageRuntime(
+const { storageRuntime, reportStagingRuntime } = createStorageHostRuntime(
   process.env,
   persistence?.db,
   moduleHosts.uploadPolicies,
@@ -184,6 +182,7 @@ const {
   runtime,
   // @windy-module system.storage begin
   storage: storageRuntime,
+  reportStaging: reportStagingRuntime,
   // @windy-module system.storage end
   moduleTasks: moduleTaskDefinitions,
   // @windy-module system.bulk-data begin
@@ -279,19 +278,22 @@ registerSystemOperationRoutes(app, runtime, features, {
 });
 // @windy-module system.operations end
 // @windy-module system.agent begin
-const { toolHandlers, aiArtifacts, aiOperations } =
-  registerAgentPlatformRuntime({
-    app,
-    platformConfig,
-    modules: foundationModules,
-    hosts: moduleHosts,
-    runtime,
-    systemRepositories,
-    storage: storageRuntime,
-    workflow: workflowService,
-    db: persistence?.db,
-    backgroundAi: moduleBackgroundAi,
-  });
+const agentRuntime = registerAgentPlatformRuntime({
+  app,
+  platformConfig,
+  modules: foundationModules,
+  hosts: moduleHosts,
+  runtime,
+  systemRepositories,
+  storage: storageRuntime,
+  workflow: workflowService,
+  db: persistence?.db,
+  backgroundAi: moduleBackgroundAi,
+  screenshotPageRegistry: platformConfig.enableAI
+    ? projectAiScreenshotPageRegistryV2
+    : undefined,
+});
+const { toolHandlers, aiArtifacts, aiOperations, aiReadiness } = agentRuntime;
 // @windy-module system.agent end
 // @windy-module system.scheduler begin
 registerSchedulerRoutes(app, scheduler, runtime, features);
@@ -308,11 +310,16 @@ installModuleHttpRuntime(moduleHosts, app, {
   // @windy-module system.scheduler end
   // @windy-module system.storage begin
   storage: storageRuntime,
+  reportStaging: reportStagingRuntime,
   // @windy-module system.storage end
   systemRepositories,
   // @windy-module system.agent begin
   aiArtifacts,
   aiOperations,
+  aiReadiness,
+  screenshots: platformConfig.enableAI
+    ? projectAiScreenshotIntakeFactoryV1
+    : undefined,
   // @windy-module system.agent end
   // @windy-module system.data-governance begin
   reauthenticate: (actorId, password) =>
@@ -320,24 +327,24 @@ installModuleHttpRuntime(moduleHosts, app, {
   governedExportService,
   // @windy-module system.data-governance end
 });
-validateInstalledRuntime({
+finalizePlatformStartup({
+  app,
   modules: foundationModules,
-  routes: app.routes,
   // @windy-module system.scheduler begin
   tasks: scheduledTaskDefinitions,
   // @windy-module system.scheduler end
   // @windy-module system.agent begin
   tools: toolHandlers,
+  disposeAgentRuntime: agentRuntime.disposeAgentRuntime,
   // @windy-module system.agent end
   // @windy-module system.search begin
   providers: searchHost.providerKeys,
   // @windy-module system.search end
   hosts: moduleHosts,
-});
-if (!process.argv.includes("--validate-module-composition")) {
-  const port = listenPlatformServer(app);
   // @windy-module system.scheduler begin
-  schedulerWorker.start();
+  schedulerWorker,
   // @windy-module system.scheduler end
-  logServerStartup(logger, featureSync, Boolean(persistence), port);
-}
+  logger,
+  featureSync,
+  persistenceEnabled: Boolean(persistence),
+});

package/template/apps/server/src/module-host/ai-operation-port.ts

@@ -106,7 +106,7 @@ export function createModuleAiOperationPort(
         );
       }
       if (input.kind === "document") {
-        services.documentFacade.authorizeRun(input.runId, context);
+        await services.documentFacade.authorizeRun(input.runId, context);
         return responseJson(
           await services.documentRemote.result(input.runId, signal),
         );
@@ -131,10 +131,10 @@ export function createModuleAiOperationPort(
           signal,
         );
       } else if (input.kind === "document") {
-        services.documentFacade.authorizeRun(input.runId, context);
-        response = await services.documentRemote.cancel(
+        response = await services.documentFacade.cancel(
           input.runId,
           input.reason,
+          context,
           signal,
         );
       } else {

package/template/apps/server/src/module-host/durable-context.ts

@@ -9,8 +9,15 @@ import type {
 import type {
   ModuleBackgroundAiPort,
   ModuleDurableHandlerContext,
+  ModuleDurableStoragePort,
 } from "@southwind-ai/server-sdk";
+// @windy-module system.storage begin
+import type { ModuleReportStagingPortV1 } from "@southwind-ai/server-sdk";
+// @windy-module system.storage end
 import { ModuleBackgroundAiError } from "@southwind-ai/server-sdk";
+// @windy-module system.storage begin
+import { ModuleReportStagingError } from "@southwind-ai/server-sdk";
+// @windy-module system.storage end
 import { evaluateAccessGuards } from "../access-guards.js";
 import {
   captureAuthorizationScope,
@@ -25,13 +32,23 @@ import {
   unavailableModuleStoragePort,
 } from "./storage-port.js";
 import { createModuleStorageScope } from "./storage-scope.js";
+import { createModuleStorageWritePort } from "./storage-write-port.js";
+import { unavailableModuleStorageWritePort } from "./storage-write-unavailable.js";
 import { toModuleActor } from "./request-context.js";
+import { createModuleSecretPort } from "./module-secret-port.js";
+// @windy-module system.storage begin
+import type { ReportStagingService } from "../report-staging/service.js";
+import { createModuleReportStagingPort } from "./report-staging-port.js";
+// @windy-module system.storage end
 
 export interface ModuleDurableContextServices {
   readonly hosts: InitializedModuleHosts;
   readonly runtime: ReturnType<typeof createServerRuntime>;
   readonly features: readonly FeatureFlagDefinition[];
   readonly storage?: ModuleStorageServices;
+  // @windy-module system.storage begin
+  readonly reportStaging?: ReportStagingService;
+  // @windy-module system.storage end
   readonly backgroundAi?: {
     create(
       moduleName: string,
@@ -63,7 +80,11 @@ export function createModuleDurableContextualizer(
       throw denied("MODULE_AUTHORIZATION_SCOPE_MISSING");
     }
     const actor = await services.resolveActor(input.claim.job.requestedBy);
-    if (!actor?.scopeContext) {
+    if (
+      !actor?.scopeContext ||
+      actor.id !== input.claim.job.requestedBy ||
+      actor.scopeContext.actorId !== actor.id
+    ) {
       throw denied("MODULE_ACTOR_UNAVAILABLE");
     }
     const current = captureAuthorizationScope(actor.scopeContext);
@@ -111,28 +132,93 @@ export function createModuleDurableContextualizer(
         reason: access.decision.reason,
       });
     }
+    const storageScope = createModuleStorageScope({
+      moduleName: input.moduleName,
+      purposes: services.hosts.uploadPurposesOf(input.moduleName),
+      uploadPolicies: services.hosts.uploadPoliciesOf(input.moduleName),
+      resourceFileAccessPolicies: services.hosts.resourceFileAccessPoliciesOf(
+        input.moduleName,
+      ),
+      guardContext,
+      runtime: services.runtime,
+      features: services.features,
+      signal: input.context.signal,
+      uploadAuditMetadata: {
+        jobId: input.claim.job.id,
+        attemptNumber: input.context.attemptNumber,
+      },
+    });
     const storage = services.storage
-      ? createModuleStoragePort(
-          services.storage,
-          createModuleStorageScope({
-            moduleName: input.moduleName,
-            purposes: services.hosts.uploadPurposesOf(input.moduleName),
-            resourceFileAccessPolicies:
-              services.hosts.resourceFileAccessPoliciesOf(input.moduleName),
+      ? createDurableStoragePort(services.storage, storageScope)
+      : unavailableDurableStoragePort(input.moduleName);
+    const storageWriter = services.storage
+      ? createModuleStorageWritePort(services.storage, storageScope)
+      : unavailableModuleStorageWritePort(input.moduleName);
+    // @windy-module system.storage begin
+    const reportStaging: ModuleReportStagingPortV1 | undefined =
+      services.reportStaging && services.storage
+        ? createModuleReportStagingPort({
+            service: services.reportStaging,
+            policies: services.hosts.reportStagingPoliciesOf(input.moduleName),
+            storage: {
+              async open(request) {
+                const current = await resolveDurableReportAccess(
+                  services,
+                  input,
+                  binding,
+                );
+                if (
+                  !current ||
+                  !sameReportScope(storageScope, current.storageScope)
+                ) {
+                  throw new ModuleReportStagingError(
+                    "REPORT_STAGING_FORBIDDEN",
+                    "报告源文件访问未授权",
+                  );
+                }
+                return createDurableStoragePort(
+                  services.storage!,
+                  current.storageScope,
+                ).openResourceFile(request);
+              },
+            },
+            storageScope,
             guardContext,
             runtime: services.runtime,
-            features: services.features,
-            signal: input.context.signal,
-          }),
-        )
-      : unavailableModuleStoragePort(input.moduleName);
+            auditMetadata: {
+              jobId: input.claim.job.id,
+              attemptNumber: input.context.attemptNumber,
+            },
+            reauthorize: async () => {
+              const current = await resolveDurableReportAccess(
+                services,
+                input,
+                binding,
+              );
+              return Boolean(
+                current && sameReportScope(storageScope, current.storageScope),
+              );
+            },
+          })
+        : undefined;
+    // @windy-module system.storage end
     const moduleContext: ModuleDurableHandlerContext = {
       ...input.context,
       actor: toModuleActor(actor),
       requestId: guardContext.requestId,
-      storage: {
-        openResourceFile: (request) => storage.openResourceFile(request),
-      },
+      secrets: createModuleSecretPort({
+        moduleName: input.moduleName,
+        declarations: services.hosts.secretDeclarationsOf(input.moduleName),
+        bindings: services.hosts.secretBindingsOf(input.moduleName),
+        guardContext,
+        runtime: services.runtime,
+        features: services.features,
+      }),
+      storage,
+      storageWriter,
+      // @windy-module system.storage begin
+      reportStaging,
+      // @windy-module system.storage end
       ai:
         services.backgroundAi?.create(
           input.moduleName,
@@ -144,6 +230,98 @@ export function createModuleDurableContextualizer(
   };
 }
 
+// @windy-module system.storage begin
+async function resolveDurableReportAccess(
+  services: ModuleDurableContextServices,
+  input: Parameters<ReturnType<typeof createModuleDurableContextualizer>>[0],
+  binding: NonNullable<ReturnType<InitializedModuleHosts["durableHandlerOf"]>>,
+) {
+  const moduleName = input.moduleName;
+  if (!moduleName) return undefined;
+  const actor = await services.resolveActor(input.claim.job.requestedBy);
+  if (
+    !actor?.scopeContext ||
+    actor.id !== input.claim.job.requestedBy ||
+    actor.scopeContext.actorId !== actor.id
+  ) {
+    return false;
+  }
+  const snapshot = input.claim.job.authorizationScope;
+  if (
+    !snapshot ||
+    captureAuthorizationScope(actor.scopeContext).hash !==
+      hashAuthorizationScope(snapshot)
+  ) {
+    return false;
+  }
+  const request = new Request(
+    `http://durable.internal/jobs/${encodeURIComponent(input.claim.job.id)}`,
+    { signal: input.context.signal },
+  );
+  const guardContext = await services.runtime.createGuardContextForActor(
+    request,
+    actor,
+  );
+  const feature = services.hosts
+    .manifestOf(moduleName)
+    .features.find(({ key }) => key === binding.featureKey);
+  if (!feature) return undefined;
+  const access = await evaluateAccessGuards(services.runtime, guardContext, {
+    permission: { permissionKey: binding.permissionKey },
+    feature,
+  });
+  if (!access.decision.allowed) return undefined;
+  return {
+    guardContext,
+    storageScope: createModuleStorageScope({
+      moduleName,
+      purposes: services.hosts.uploadPurposesOf(moduleName),
+      uploadPolicies: services.hosts.uploadPoliciesOf(moduleName),
+      resourceFileAccessPolicies:
+        services.hosts.resourceFileAccessPoliciesOf(moduleName),
+      guardContext,
+      runtime: services.runtime,
+      features: services.features,
+      signal: input.context.signal,
+      uploadAuditMetadata: {
+        jobId: input.claim.job.id,
+        attemptNumber: input.context.attemptNumber,
+      },
+    }),
+  };
+}
+
+function sameReportScope(
+  expected: ReturnType<typeof createModuleStorageScope>,
+  current: ReturnType<typeof createModuleStorageScope>,
+) {
+  return (
+    current.ownerId === expected.ownerId &&
+    current.authorizationBinding?.scopeHash ===
+      expected.authorizationBinding?.scopeHash
+  );
+}
+// @windy-module system.storage end
+
+function createDurableStoragePort(
+  services: ModuleStorageServices,
+  scope: ReturnType<typeof createModuleStorageScope>,
+): ModuleDurableStoragePort {
+  const read = createModuleStoragePort(services, scope);
+  return {
+    openResourceFile: (request) => read.openResourceFile(request),
+  };
+}
+
+function unavailableDurableStoragePort(
+  moduleName: string,
+): ModuleDurableStoragePort {
+  const read = unavailableModuleStoragePort(moduleName);
+  return {
+    openResourceFile: (request) => read.openResourceFile(request),
+  };
+}
+
 function unavailableBackgroundAi(moduleName: string): ModuleBackgroundAiPort {
   return {
     async enqueueOperation() {

package/template/apps/server/src/module-host/durable-handler-registration.ts

@@ -150,6 +150,7 @@ function requireModuleDurableContext(
   if (
     !("actor" in context) ||
     !("requestId" in context) ||
+    !("secrets" in context) ||
     !("storage" in context) ||
     !("ai" in context)
   ) {

package/template/apps/server/src/module-host/durable-storage-filesystem-restart.test.ts

@@ -0,0 +1,265 @@
+import { createHash } from "node:crypto";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, test } from "bun:test";
+import type { DurableHandlerContext } from "@southwind-ai/jobs";
+import {
+  requireModuleStorageWritePortV1,
+  type ModuleDurableHandlerContext,
+} from "@southwind-ai/server-sdk";
+import {
+  artifactRef,
+  FileService,
+  InMemoryUploadRepository,
+  LocalFileBlobStore,
+  sha256ContentHash,
+  UploadService,
+  type UploadPart,
+  type UploadSession,
+} from "@southwind-ai/storage";
+import { captureAuthorizationScope } from "../data-access/scope-snapshot.js";
+import type { RequestActor } from "../guards.js";
+import { createServerRuntime } from "../runtime.js";
+import { createModuleDurableContextualizer } from "./durable-context.js";
+import {
+  createRestartHosts,
+  restartActor,
+  restartModuleManifest,
+  restartUploadPolicy,
+} from "./storage-restart-fixture.test-support.js";
+
+describe("Durable Storage filesystem 重建", () => {
+  test("不复用 Host/Repository/BlobStore 对象即可恢复、续传并幂等完成", async () => {
+    const root = await mkdtemp(join(tmpdir(), "windy-storage-restart-"));
+    try {
+      const actor = restartActor("all");
+      const firstRepository = new InMemoryUploadRepository();
+      const first = await stack(firstRepository, root, actor, 1);
+      const whole = bytes("abcdef");
+      const session = await requireModuleStorageWritePortV1(
+        first.context,
+      ).createUploadSession({
+        purpose: restartUploadPolicy.purpose,
+        filename: "evidence.txt",
+        mimeType: "text/plain",
+        expectedByteSize: whole.byteLength,
+        expectedSha256: digest(whole),
+      });
+      await requireModuleStorageWritePortV1(first.context).appendUploadPart(
+        part(session.id, 0, 0, bytes("abc")),
+      );
+      const checkpointFile = join(root, "upload-facts.json");
+      await Bun.write(
+        checkpointFile,
+        JSON.stringify({
+          formatVersion: 1,
+          session: await firstRepository.getSession(session.id),
+          parts: await firstRepository.listParts(session.id),
+        }),
+      );
+
+      const persisted = parseCheckpoint(
+        JSON.parse(await Bun.file(checkpointFile).text()) as unknown,
+      );
+      const driftedRepository = await restoreRepository(persisted);
+      const drifted = await stack(
+        driftedRepository,
+        root,
+        restartActor("self"),
+        2,
+      );
+      await expect(
+        requireModuleStorageWritePortV1(drifted.context).getUploadSession(
+          session.id,
+        ),
+      ).rejects.toMatchObject({
+        code: "UPLOAD_FORBIDDEN",
+        message: "上传会话未授权",
+      });
+
+      const restartedRepository = await restoreRepository(persisted);
+      const restarted = await stack(restartedRepository, root, actor, 3);
+      await expect(
+        requireModuleStorageWritePortV1(restarted.context).getUploadSession(
+          session.id,
+        ),
+      ).resolves.toMatchObject({
+        receivedByteSize: 3,
+        nextPartNumber: 1,
+        status: "uploading",
+      });
+      await requireModuleStorageWritePortV1(restarted.context).appendUploadPart(
+        part(session.id, 1, 3, bytes("def")),
+      );
+      const completed = await requireModuleStorageWritePortV1(
+        restarted.context,
+      ).completeUpload(session.id);
+      const replayed = await requireModuleStorageWritePortV1(
+        restarted.context,
+      ).completeUpload(session.id);
+      expect(replayed).toEqual(completed);
+
+      const opened = await restarted.files.open(completed.id, actor.id);
+      expect(await new Response(opened.body).text()).toBe("abcdef");
+      expect(opened.contentHash.value).toBe(digest(whole));
+      expect(await restartedRepository.listParts(session.id)).toEqual([]);
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+});
+
+interface Checkpoint {
+  readonly session: UploadSession;
+  readonly parts: readonly UploadPart[];
+}
+
+async function stack(
+  repository: InMemoryUploadRepository,
+  root: string,
+  actor: RequestActor,
+  attemptNumber: number,
+) {
+  const blobStore = new LocalFileBlobStore({ root });
+  const uploads = new UploadService({
+    repository,
+    blobStore,
+    policies: [restartUploadPolicy],
+  });
+  const files = new FileService(repository, blobStore);
+  const hosts = await createRestartHosts();
+  const runtime = createServerRuntime(
+    { NODE_ENV: "test" },
+    { featureCatalog: restartModuleManifest.features },
+  );
+  const contextualize = createModuleDurableContextualizer({
+    hosts,
+    runtime,
+    features: restartModuleManifest.features,
+    storage: { uploads, files },
+    resolveActor: async () => actor,
+  });
+  const context = (await contextualize({
+    claim: {
+      job: {
+        id: "job-evidence",
+        handlerKey: "evidence.generate.run",
+        requestedBy: actor.id,
+        authorizationScope: captureAuthorizationScope(actor.scopeContext)
+          .snapshot,
+      },
+    },
+    moduleName: "evidence",
+    context: durableContext(attemptNumber),
+  })) as ModuleDurableHandlerContext;
+  return { context, files };
+}
+
+async function restoreRepository(checkpoint: Checkpoint) {
+  const repository = new InMemoryUploadRepository();
+  const session = checkpoint.session;
+  await repository.createSession({
+    id: session.id,
+    ownerId: session.ownerId,
+    purpose: session.purpose,
+    authorizationBinding: session.authorizationBinding
+      ? { ...session.authorizationBinding }
+      : undefined,
+    filename: session.filename,
+    extension: session.extension,
+    mimeType: session.mimeType,
+    expectedByteSize: session.expectedByteSize,
+    expectedContentHash: session.expectedContentHash
+      ? sha256ContentHash(session.expectedContentHash.value)
+      : undefined,
+    expiresAt: session.expiresAt,
+    fileExpiresAt: session.fileExpiresAt,
+    fileId: session.fileId,
+    createdAt: session.createdAt,
+  });
+  for (const rawPart of checkpoint.parts) {
+    const committed = await repository.commitPart(
+      {
+        ...rawPart,
+        artifactRef: artifactRef(String(rawPart.artifactRef)),
+        contentHash: sha256ContentHash(rawPart.contentHash.value),
+      },
+      rawPart.byteOffset,
+    );
+    if (!committed) throw new Error("上传 checkpoint 分片恢复失败");
+  }
+  return repository;
+}
+
+function parseCheckpoint(value: unknown): Checkpoint {
+  const root = record(value);
+  const session = record(root.session);
+  const binding = record(session.authorizationBinding);
+  const parts = Array.isArray(root.parts) ? root.parts : [];
+  if (
+    root.formatVersion !== 1 ||
+    !/^upload_[0-9a-f]{32}$/.test(String(session.id)) ||
+    session.status !== "uploading" ||
+    !/^[a-z0-9][a-z0-9._-]{0,79}$/.test(String(binding.moduleName)) ||
+    !/^[0-9a-f]{64}$/.test(String(binding.scopeHash)) ||
+    parts.some((item) => !record(item).artifactRef)
+  ) {
+    throw new Error("上传 checkpoint 格式无效");
+  }
+  return {
+    session: root.session as UploadSession,
+    parts: parts as UploadPart[],
+  };
+}
+
+function durableContext(attemptNumber: number): DurableHandlerContext {
+  return {
+    jobId: "job-evidence",
+    stageKey: "main",
+    attemptNumber,
+    signal: new AbortController().signal,
+    heartbeat: async () => undefined,
+    progress: async () => undefined,
+    publishArtifact: async () => undefined,
+  };
+}
+
+function part(
+  sessionId: string,
+  partNumber: number,
+  byteOffset: number,
+  value: Uint8Array,
+) {
+  return {
+    sessionId,
+    partNumber,
+    byteOffset,
+    byteSize: value.byteLength,
+    sha256: digest(value),
+    body: stream(value),
+  };
+}
+
+function stream(value: Uint8Array) {
+  return new ReadableStream<Uint8Array>({
+    start(controller) {
+      controller.enqueue(Uint8Array.from(value));
+      controller.close();
+    },
+  });
+}
+
+function record(value: unknown): Record<string, unknown> {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : {};
+}
+
+function bytes(value: string) {
+  return new TextEncoder().encode(value);
+}
+
+function digest(value: Uint8Array) {
+  return createHash("sha256").update(value).digest("hex");
+}