Snapshot verified references for extraction

internal/fileops/fileops.go

@@ -67,17 +67,29 @@ func CopyFileAtomicWithChecksum(src, dst string, perm os.FileMode) (string, erro
 	}
 	defer func() { _ = in.Close() }()
 
+	return WriteReaderAtomicWithChecksum(dst, in, perm)
+}
+
+// WriteReaderAtomicWithChecksum streams src through the durable replacement
+// sequence and returns the SHA-256 checksum of the installed bytes. The caller
+// retains ownership of src.
+func WriteReaderAtomicWithChecksum(dst string, src io.Reader, perm os.FileMode) (string, error) {
+	if strings.TrimSpace(dst) == "" {
+		return "", fmt.Errorf("destination path is required")
+	}
+	if src == nil {
+		return "", fmt.Errorf("source reader is required")
+	}
 	if err := EnsureWorkspaceDirectory(filepath.Dir(dst)); err != nil {
 		return "", fmt.Errorf("create destination directory: %w", err)
 	}
 
 	digest := sha256.New()
-	err = replaceFileFromReaderConfined(
+	if err := replaceFileFromReaderConfined(
 		dst,
-		io.TeeReader(in, digest),
+		io.TeeReader(src, digest),
 		ReplaceFileOptions{Mode: perm},
-	)
-	if err != nil {
+	); err != nil {
 		return "", err
 	}
 	return hex.EncodeToString(digest.Sum(nil)), nil