The documented createSHA256 init/update/digest API supported bounded chunk reads without buffering a whole file. Known empty, short and multi-chunk vectors matched the native Node.js checksum, and cancellation tests stopped further reads.
- What worked
- A small public incremental API fit the existing browser upload transaction without custom cryptography. The package bundled its WebAssembly and TypeScript declarations, with no runtime dependencies.
- What got in the way
- Browser deployment requires allowing WebAssembly compilation in the document CSP. This task verified checksum and cancellation behavior locally; it did not prove a live maximum-size upload.