feat: CDN module imports with SHA-384 integrity verification (CPL-206) by GTC6244 · Pull Request #268 · LIT-Protocol/chipotle

GTC6244 · 2026-04-03T18:45:32Z

Summary

Replaces NoopModuleLoader with a custom CdnModuleLoader that enables ES module imports from jsDelivr inside Lit Actions. Developers can now use third-party npm packages directly in their action code.

Core implementation:

Custom Deno ModuleLoader that resolves npm specifiers (zod@3.22.4/+esm) to jsDelivr URLs
SHA-384 integrity verification against an integrity.lock manifest with constant-time hash comparison
Trust-on-first-use (TOFU): new modules are double-fetched with three-way verification (first fetch, second fetch, CDN SRI header) and auto-pinned to the lockfile
Inline integrity hashes via #sha384-<hash> fragment on import specifiers
Shared reqwest::Client with 30s timeout, redirect blocking, and 10MB response size limit
In-memory module cache shared across all worker instances

Security hardening (from /review):

Redirect blocking prevents SSRF via CDN redirect chains
Response size limits prevent OOM via large payloads
Constant-time hash comparison prevents timing side-channels
SRI header cross-reference during TOFU for three-way verification

Documentation:

New docs/lit-actions/imports.mdx with import syntax, examples, compatibility guide, and security model
Press release at docs/press_releases/2026-04-03.md
Navigation and cross-references updated

Pre-Landing Review

No issues found. All findings from the earlier /review pass (redirect blocking, size limits, constant-time comparison, shared client, caching) have been implemented.

Scope Drift

Scope Check: CLEAN
Intent: CDN module imports with integrity verification (CPL-206)
Delivered: CdnModuleLoader with TOFU, inline hashes, npm specifier resolution, docs, and press release

Test plan

cargo check -p lit-actions-server -p lit_actions passes
Build verified after final commit

🤖 Generated with Claude Code

The self-hosted runner doesn't have npm in PATH, causing cloudflare/wrangler-action@v3 to fail when trying to install wrangler. Add actions/setup-node@v4 with Node 20 before the deploy step, matching the pattern used by other workflows in this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…ains (#261) - api.dev.litprotocol.com → api.chipotle.litprotocol.com - dashboard.dev.litprotocol.com → dashboard.chipotle.litprotocol.com - docs.dev.litprotocol.com → developer.litprotocol.com - Fix broken swagger-ui path (/swagger-ui/ → /core/v1/swagger-ui) - Remove broken Support navbar link - Fix broken SDK link in encryption migration doc Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* docs: migrate README URLs from dev.litprotocol.com to new domains Same migration as the docs/ directory (PR #261): - api.dev.litprotocol.com → api.chipotle.litprotocol.com - dashboard.dev.litprotocol.com → dashboard.chipotle.litprotocol.com - docs.dev.litprotocol.com → developer.litprotocol.com Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * docs: update "dev API" to "API" in README quickstart Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * docs: add usage API key step to README quickstart Adds step 2 showing how to create a scoped usage API key before using the API, reinforcing the best practice of not embedding the account key in apps. Renumbers subsequent steps. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * docs: reorder quickstart — add funds before usage API key Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Replace localhost:8000 and api.dev.litprotocol.com references in curl examples across MDX docs with https://api.chipotle.litprotocol.com. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Replace NoopModuleLoader with CdnModuleLoader that allows ES module imports only from cdn.jsdelivr.net. Modules are verified against an integrity.lock manifest using SHA-384 hashes with constant-time comparison. New modules use trust-on-first-use (TOFU): double-fetch from CDN, compare hashes, and auto-pin to the lockfile on match. All events are logged with structured fields for auditability. Includes: shared reqwest client with timeouts, redirect blocking, 10MB response size limit, in-memory module cache, and CLI args for lockfile path and strict mode. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Add docs/lit-actions/imports.mdx with full CDN module import guide - Update docs/lit-actions/index.mdx to link imports page - Update docs/docs.json to register new imports page in nav - Add press release for 2026-04-03 CDN imports launch - Extend cdn_module_loader.rs with three-way SRI verification via CDN header

…ts-with-deno

…nning (CPL-206) Developers can now write short npm specifiers (zod@3.22.4/+esm) instead of full URLs. The resolver constructs the jsDelivr URL automatically. Adds inline integrity verification via #sha384-<hash> fragment on import specifiers. The hash is stripped before fetching and verified locally. TOFU flow: new modules are double-fetched with three-way verification (first fetch, second fetch, CDN SRI header) and auto-pinned to the integrity lockfile.

…ine hashes (CPL-206)

mintlify · 2026-04-03T18:45:37Z

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
chipotle	🟢 Ready	View Preview	Apr 3, 2026, 6:46 PM

Copilot

Pull request overview

This PR adds support for importing third-party ES modules from jsDelivr inside the Lit Actions runtime by replacing the prior no-op module loader with a CDN-aware loader that verifies SHA-384 integrity (lockfile and inline hashes), optionally supports TOFU pinning, and documents the feature for developers.

Changes:

Introduces CdnModuleLoader (Deno ModuleLoader) with jsDelivr/npm-specifier resolution, integrity verification, caching, and TOFU pinning to integrity.lock.
Wires the loader/config through the Lit Actions server runtime and CLI flags/env vars.
Adds new documentation (guide + nav updates) and a press release.

Reviewed changes

Copilot reviewed 11 out of 13 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
lit-actions/server/server.rs	Threads integrity manifest / strict mode / cache / lockfile path through server execution flow and `start_server`.
lit-actions/server/runtime.rs	Installs `CdnModuleLoader` as the Deno module loader and passes loader config into worker construction.
lit-actions/server/lib.rs	Exposes the new `cdn_module_loader` module publicly.
lit-actions/server/cdn_module_loader.rs	New CDN module loader implementation with integrity checks, TOFU, caching, and unit tests.
lit-actions/server/Cargo.toml	Adds dependencies needed for hashing, base64, futures, and HTTP fetching (reqwest).
lit-actions/integrity.lock	Adds initial lockfile format and instructions for generating hashes.
lit-actions/cli/main.rs	Adds CLI flags/env vars to load the integrity manifest and configure strict imports / lockfile path.
lit-actions/cli/Cargo.toml	Enables clap `env` feature for env-backed flags.
lit-actions/Cargo.lock	Locks new transitive dependencies (reqwest 0.12, base64, etc.).
docs/press_releases/2026-04-03.md	Announces the feature publicly with examples and security model.
docs/lit-actions/index.mdx	Adds “Module Imports” to Lit Actions next steps.
docs/lit-actions/imports.mdx	New end-user guide describing syntax, integrity model, TOFU, and limits.
docs/docs.json	Adds the new docs page to navigation.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

lit-actions/server/cdn_module_loader.rs

lit-actions/cli/main.rs

docs/lit-actions/imports.mdx

lit-actions/server/runtime.rs

…206) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Resolve relative imports (./dep.js) against jsDelivr referrer URLs - Stream response body with hard size cap to prevent OOM (both fetches) - TOFU second fetch now has identical redirect/status/size protections - Replace unwrap() with proper error propagation in ModuleSpecifier::parse - Share reqwest::Client across all worker instances (connection pooling) - Bound module cache at 100MB total - Fix CLI help text to clarify strict+lockfile TOFU behavior - Replace expect() with anyhow error on lockfile read - Fix docs: module fetches don't count toward JS fetch() limit Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…rrows, too_many_arguments (CPL-206) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lit-actions/server/cdn_module_loader.rs

Garandor and others added 10 commits April 1, 2026 11:18

Merge branch 'next'

829452e

fix: update curl examples to use production API URL (CPL-203) (#263)

2f61cba

Replace localhost:8000 and api.dev.litprotocol.com references in curl examples across MDX docs with https://api.chipotle.litprotocol.com. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Merge remote-tracking branch 'origin/main' into feature/cpl-206-impor…

4278c93

…ts-with-deno

docs: update imports guide and press release with npm specifiers, inl…

85ae61f

…ine hashes (CPL-206)

GTC6244 requested review from a team and Copilot April 3, 2026 18:45

mintlify bot deployed to staging - docs April 3, 2026 18:46 View deployment

Copilot started reviewing on behalf of GTC6244 April 3, 2026 18:46 View session

Copilot AI reviewed Apr 3, 2026

View reviewed changes

docs: update TOFU verification to reflect up to four-way checks (CPL-…

c765641

…206) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

mintlify bot deployed to staging - docs April 3, 2026 19:14 View deployment

GTC6244 self-assigned this Apr 3, 2026

GTC6244 and others added 2 commits April 3, 2026 15:23

style: cargo fmt (CPL-206)

ab16351

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

mintlify bot deployed to staging - docs April 3, 2026 19:29 View deployment

fix: address clippy lints — collapsible_if, manual_strip, needless_bo…

221feec

…rrows, too_many_arguments (CPL-206) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

graphite-app bot reviewed Apr 3, 2026

View reviewed changes

lit-actions/server/cdn_module_loader.rs Show resolved Hide resolved

GTC6244 changed the base branch from main to next April 3, 2026 20:59

GTC6244 merged commit ccab03f into next Apr 4, 2026
36 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: CDN module imports with SHA-384 integrity verification (CPL-206)#268

feat: CDN module imports with SHA-384 integrity verification (CPL-206)#268
GTC6244 merged 14 commits intonextfrom
feature/cpl-206-imports-with-deno

GTC6244 commented Apr 3, 2026

Uh oh!

mintlify bot commented Apr 3, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

GTC6244 commented Apr 3, 2026

Summary

Pre-Landing Review

Scope Drift

Test plan

Uh oh!

mintlify bot commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mintlify bot commented Apr 3, 2026 •

edited

Loading