1tube 0.1.13 → 0.1.14

package/deno.json

@@ -16,6 +16,7 @@
     "@std/assert": "jsr:@std/assert@^1",
     "hono": "npm:hono@4",
     "esbuild": "npm:esbuild@^0.28",
+    "es-module-lexer": "npm:es-module-lexer@^2",
     "@deno/esbuild-plugin": "jsr:@deno/esbuild-plugin@^1.2",
     "@zip-js/zip-js": "jsr:@zip-js/zip-js@^2.8"
   },

package/deno.lock

@@ -14,6 +14,7 @@
     "npm:@google/genai@1.39.0": "1.39.0",
     "npm:@supabase/supabase-js@2": "2.93.3",
     "npm:ai@6": "6.0.67_zod@3.25.76",
+    "npm:es-module-lexer@2": "2.0.0",
     "npm:esbuild@0.28": "0.28.0",
     "npm:esbuild@~0.25.5": "0.25.12",
     "npm:hono@4": "4.12.14",
@@ -514,6 +515,9 @@
         "safe-buffer"
       ]
     },
+    "es-module-lexer@2.0.0": {
+      "integrity": "sha512-5POEcUuZybH7IdmGsD8wlf0AI55wMecM9rVBTI/qEAy2c1kTOm3DjFYjrBdI2K3BaJjJYfYFeRtM0t9ssnRuxw=="
+    },
     "esbuild@0.25.12": {
       "integrity": "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==",
       "optionalDependencies": [
@@ -860,6 +864,7 @@
       "jsr:@std/assert@1",
       "jsr:@std/path@1",
       "jsr:@zip-js/zip-js@^2.8.0",
+      "npm:es-module-lexer@2",
       "npm:esbuild@0.28",
       "npm:hono@4"
     ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "1tube",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "private": false,
   "description": "Self-hosted Supabase Edge Functions gateway for Deno, plus an ESLint plugin for consumers",
   "license": "MIT",

package/src/backends/workerd/bundler.ts

@@ -290,6 +290,12 @@ export interface SharedBundleResult extends SharedRuntimeModule {
 
 export async function disposeBundlerResources(): Promise<void> {
   await esbuild.stop();
+  // esbuild.stop() tears down the service process synchronously from
+  // esbuild's point of view, but Deno's node:child_process shim settles
+  // the underlying spawn wait op on the next turn. Let that completion
+  // run before sanitizer-enabled tests assert that no child process
+  // resources remain.
+  await new Promise((resolve) => setTimeout(resolve, 0));
 }
 
 function sharedModuleStubSource(module: WorkerdSharedModuleInput): string {

package/src/cli/envelope.ts

@@ -53,6 +53,8 @@ export interface FirmwareEnvelope {
   createdBy: string;
   /** SHA-256 of `dist/manifest.json` bytes, lowercase hex. */
   manifestSha256: string;
+  /** Stable runtime-content fingerprint; excludes package/build metadata. */
+  contentSha256?: string;
   /** Number of functions in the inner manifest. Diagnostic. */
   functionCount: number;
   /** Sum of every bundle's byte length. Diagnostic. */
@@ -163,7 +165,11 @@ export async function signEnvelope(
     false,
     ["sign"],
   );
-  const sig = await crypto.subtle.sign("HMAC", cryptoKey, message as BufferSource);
+  const sig = await crypto.subtle.sign(
+    "HMAC",
+    cryptoKey,
+    message as BufferSource,
+  );
   return {
     ...unsigned,
     signature: {
@@ -252,7 +258,10 @@ export function parseEnvelope(raw: unknown): FirmwareEnvelope {
       throw new Error(`envelope.${k} missing or not a string`);
     }
   }
-  if (typeof o.functionCount !== "number" || typeof o.totalBundleBytes !== "number") {
+  if (
+    typeof o.functionCount !== "number" ||
+    typeof o.totalBundleBytes !== "number"
+  ) {
     throw new Error("envelope.functionCount / .totalBundleBytes missing");
   }
   return {
@@ -261,6 +270,9 @@ export function parseEnvelope(raw: unknown): FirmwareEnvelope {
     createdAt: o.createdAt as string,
     createdBy: o.createdBy as string,
     manifestSha256: o.manifestSha256 as string,
+    ...(typeof o.contentSha256 === "string" && o.contentSha256.length > 0
+      ? { contentSha256: o.contentSha256 }
+      : {}),
     functionCount: o.functionCount as number,
     totalBundleBytes: o.totalBundleBytes as number,
     signature: {

package/src/cli/package.ts

@@ -53,6 +53,7 @@ import {
   parsePrebuiltManifest,
   type PrebuiltManifest,
 } from "../backends/workerd/prebuilt.ts";
+import { computeFirmwareContentFingerprint } from "../firmware-content-hash.ts";
 import { VERSION } from "../version.ts";
 
 /**
@@ -326,6 +327,10 @@ export async function packageDist(
   const files = await collectDistFiles(distDir, manifest, opts.onProgress);
   const manifestEntry = files.find((f) => f.zipPath === "dist/manifest.json")!;
   const manifestSha256 = await sha256Hex(manifestEntry.bytes);
+  const contentFingerprint = await computeFirmwareContentFingerprint(
+    distDir,
+    manifest,
+  );
 
   const totalBundleBytes = manifest.functions.reduce(
     (acc, f) => acc + f.bundleBytes,
@@ -341,6 +346,7 @@ export async function packageDist(
     createdAt,
     createdBy: `1tube@${VERSION}`,
     manifestSha256,
+    contentSha256: contentFingerprint.sha256,
     functionCount: manifest.functions.length,
     totalBundleBytes,
   };
@@ -499,7 +505,12 @@ function makeProgressRenderer(): (e: PackageProgress) => void {
       : e.phase === "compress"
       ? "zipping"
       : "wrote";
-    const namePart = e.name ? ` ${truncateMiddle(e.name, 40)}` : "";
+    const displayName = e.phase === "finalize"
+      ? e.name
+      : e.name
+      ? truncateMiddle(e.name, 40)
+      : "";
+    const namePart = displayName ? ` ${displayName}` : "";
     const line = `[1tube package] ${tag} ${e.current}/${e.total}` +
       (pct ? ` (${pct})` : "") +
       ` ${sizeStr}${namePart}`;
@@ -675,7 +686,10 @@ export async function runPackage(args: string[]): Promise<number> {
     console.log(
       `[1tube package] envelope: ${result.envelope.functionCount} function(s), ` +
         `${fmt(result.envelope.totalBundleBytes)} bundle bytes, ` +
-        `manifest sha256=${result.envelope.manifestSha256.slice(0, 12)}…`,
+        `manifest sha256=${result.envelope.manifestSha256.slice(0, 12)}…, ` +
+        `content sha256=${
+          result.envelope.contentSha256?.slice(0, 12) ?? "<none>"
+        }…`,
     );
     return 0;
   } catch (err) {

package/src/firmware-content-hash.ts

@@ -0,0 +1,192 @@
+import { dirname, join, normalize } from "node:path";
+import { init, parse } from "es-module-lexer";
+import { canonicalJson } from "./cli/envelope.ts";
+import type { PrebuiltManifest } from "./backends/workerd/prebuilt.ts";
+
+async function sha256Hex(bytes: Uint8Array | string): Promise<string> {
+  const data = typeof bytes === "string"
+    ? new TextEncoder().encode(bytes)
+    : bytes;
+  const buf = await crypto.subtle.digest("SHA-256", data as BufferSource);
+  const view = new Uint8Array(buf);
+  let out = "";
+  for (let i = 0; i < view.length; i++) {
+    out += view[i].toString(16).padStart(2, "0");
+  }
+  return out;
+}
+
+function toPosix(path: string): string {
+  return path.replace(/\\/g, "/").replace(/^\/+/, "");
+}
+
+function uniqueSorted(values: Iterable<string>): string[] {
+  return [...new Set(values)].sort();
+}
+
+function sortPlain(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(sortPlain);
+  if (!value || typeof value !== "object") return value;
+  const obj = value as Record<string, unknown>;
+  const out: Record<string, unknown> = {};
+  for (const key of Object.keys(obj).sort()) {
+    out[key] = sortPlain(obj[key]);
+  }
+  return out;
+}
+
+function resolveModuleSpecifier(
+  fromFile: string,
+  specifier: string,
+): string | null {
+  if (!specifier.startsWith(".")) return null;
+  const resolved = normalize(join(dirname(fromFile), specifier));
+  return toPosix(resolved);
+}
+
+async function normalizeModule(
+  moduleFile: string,
+  source: string,
+  knownModules: ReadonlySet<string>,
+): Promise<{ source: string; dependencies: string[] }> {
+  const dependencies: string[] = [];
+  const withoutSourceMap = source.replace(
+    /\n?\/\/# sourceMappingURL=.*$/m,
+    "\n",
+  );
+  await init;
+  const [imports] = parse(withoutSourceMap);
+  const patches: Array<{ start: number; end: number; value: string }> = [];
+  for (const specifier of imports) {
+    const rawSpecifier = specifier.n ??
+      withoutSourceMap.slice(specifier.s, specifier.e);
+    if (!rawSpecifier.startsWith(".")) continue;
+    const target = resolveModuleSpecifier(moduleFile, rawSpecifier);
+    if (!target || !knownModules.has(target)) continue;
+
+    dependencies.push(target);
+    patches.push({
+      start: specifier.s,
+      end: specifier.e,
+      value: "__1tube_module_ref__",
+    });
+  }
+
+  let normalized = withoutSourceMap;
+  for (const patch of patches.sort((a, b) => b.start - a.start)) {
+    normalized = normalized.slice(0, patch.start) + patch.value +
+      normalized.slice(patch.end);
+  }
+
+  return { source: normalized, dependencies: uniqueSorted(dependencies) };
+}
+
+export interface FirmwareContentFingerprint {
+  sha256: string;
+  canonical: string;
+}
+
+export async function computeFirmwareContentFingerprint(
+  distDir: string,
+  manifest: PrebuiltManifest,
+): Promise<FirmwareContentFingerprint> {
+  const moduleFiles = uniqueSorted([
+    ...manifest.functions.flatMap((fn) =>
+      fn.moduleFiles?.length ? fn.moduleFiles : [fn.bundleFile]
+    ),
+    ...manifest.chunks.map((chunk) => chunk.file),
+    ...manifest.sharedModules.map((shared) => shared.bundleFile),
+  ]);
+
+  const rawSources = new Map<string, string>();
+  for (const file of moduleFiles) {
+    const bytes = await Deno.readFile(join(distDir, file));
+    const source = new TextDecoder().decode(bytes);
+    rawSources.set(file, source);
+  }
+
+  const knownModules = new Set(moduleFiles);
+  const normalizedModules = new Map(
+    await Promise.all(
+      moduleFiles.map(async (file) =>
+        [
+          file,
+          await normalizeModule(file, rawSources.get(file) ?? "", knownModules),
+        ] as const
+      ),
+    ),
+  );
+  const moduleHashes = new Map<string, string>();
+  async function hashModule(
+    file: string,
+    stack = new Set<string>(),
+  ): Promise<string> {
+    const cached = moduleHashes.get(file);
+    if (cached) return cached;
+
+    const normalized = normalizedModules.get(file);
+    if (!normalized) {
+      throw new Error(`firmware content fingerprint missing module ${file}`);
+    }
+    if (stack.has(file)) {
+      return await sha256Hex("__1tube_module_cycle__");
+    }
+
+    stack.add(file);
+    const dependencyHashes = [];
+    for (const dependency of normalized.dependencies) {
+      dependencyHashes.push(await hashModule(dependency, stack));
+    }
+    stack.delete(file);
+
+    const hash = await sha256Hex(canonicalJson({
+      source: normalized.source,
+      dependencies: uniqueSorted(dependencyHashes),
+    }));
+    moduleHashes.set(file, hash);
+    return hash;
+  }
+  for (const file of moduleFiles) {
+    await hashModule(file);
+  }
+
+  const functionEntries = manifest.functions
+    .map((fn) => {
+      const modules = fn.moduleFiles?.length ? fn.moduleFiles : [fn.bundleFile];
+      return {
+        name: fn.name,
+        manifest: sortPlain(fn.manifest),
+        modules: uniqueSorted(
+          modules.map((file) => moduleHashes.get(file) ?? ""),
+        ),
+      };
+    })
+    .sort((a, b) => a.name.localeCompare(b.name));
+
+  const sharedEntries = manifest.sharedModules
+    .map((shared) => ({
+      id: shared.id,
+      exportNames: uniqueSorted(shared.exportNames),
+      module: moduleHashes.get(shared.bundleFile) ?? "",
+    }))
+    .sort((a, b) => a.id.localeCompare(b.id));
+
+  const chunkEntries = uniqueSorted(
+    manifest.chunks.map((chunk) => moduleHashes.get(chunk.file) ?? ""),
+  );
+
+  const canonical = canonicalJson({
+    schema: manifest.schema,
+    compatibilityDate: manifest.compatibilityDate,
+    compatibilityFlags: uniqueSorted(manifest.compatibilityFlags ?? []),
+    envAllowlist: uniqueSorted(manifest.envAllowlist ?? []),
+    chunks: chunkEntries,
+    sharedModules: sharedEntries,
+    functions: functionEntries,
+  });
+
+  return {
+    sha256: await sha256Hex(canonical),
+    canonical,
+  };
+}