staticFunctionMiddleware crypto.subtle undefined in preview

Overview

The staticFunctionMiddleware middleware uses crypto.subtle on the client to create SHA1 hashes of the filename staticFunctionMiddleware.ts#L35C3-L35C68. This causes an issue when previewing a Tanstack application in non-https contexts such as when using npm run dev -- --host.

  VITE v7.3.1  ready in 855 ms

  ➜  Local:   http://localhost:3000/
+ ➜  Network: http://192.168.20.234:3000/
  ➜  press h + enter to show help

The specific issue in the browser is:

installHook.js:1 TypeError: Cannot read properties of undefined (reading 'digest')
    at e9 (main-BYcOxryC.js:137:26127)
    at iE (main-BYcOxryC.js:137:26284)
    at r9 (main-BYcOxryC.js:137:26907)
    at main-BYcOxryC.js:137:27120
    at c (main-BYcOxryC.js:137:20271)
    at HS (main-BYcOxryC.js:137:20898)
    at Object.assign (main-BYcOxryC.js:137:19321)
    at Object.loader (main-BYcOxryC.js:137:27912)
    at G0 (main-BYcOxryC.js:10:70591)
    at OA (main-BYcOxryC.js:10:72888)

Reproduction

This can be reproduced by:

• Create a tanstack start application with the staticFunctionMiddleware
• Create a build of the application npm run build
• Start a preview server: npm run preview -- --host
• Navigate to the Network: endpoint: http://192.168.20.234:3000/
• Click a link to navigate to another SSG route + error will be shown in browser

Outcome

a. Maybe this is not a huge deal as sites should be served in an https context when deploying?
b. Maybe the solution is just using a JS implemented SHA1 (or other) hash function. The doc comments state specifically this is not being used for security, just to avoid collisions when hashing a filename.

Start in packages/start-static-server-functions/src/staticFunctionMiddleware.ts at the crypto.subtle call around line 35. Reproduce with npm run build, npm run preview -- --host, and navigation to the Network endpoint over HTTP, then investigate the hashing behavior in that context. Done means SSG route navigation works in the non-HTTPS preview without the crypto.subtle error.