1tube 0.1.13 → 0.1.15

package/deno.json

@@ -16,6 +16,7 @@
     "@std/assert": "jsr:@std/assert@^1",
     "hono": "npm:hono@4",
     "esbuild": "npm:esbuild@^0.28",
+    "es-module-lexer": "npm:es-module-lexer@^2",
     "@deno/esbuild-plugin": "jsr:@deno/esbuild-plugin@^1.2",
     "@zip-js/zip-js": "jsr:@zip-js/zip-js@^2.8"
   },

package/deno.lock

@@ -14,6 +14,7 @@
     "npm:@google/genai@1.39.0": "1.39.0",
     "npm:@supabase/supabase-js@2": "2.93.3",
     "npm:ai@6": "6.0.67_zod@3.25.76",
+    "npm:es-module-lexer@2": "2.0.0",
     "npm:esbuild@0.28": "0.28.0",
     "npm:esbuild@~0.25.5": "0.25.12",
     "npm:hono@4": "4.12.14",
@@ -514,6 +515,9 @@
         "safe-buffer"
       ]
     },
+    "es-module-lexer@2.0.0": {
+      "integrity": "sha512-5POEcUuZybH7IdmGsD8wlf0AI55wMecM9rVBTI/qEAy2c1kTOm3DjFYjrBdI2K3BaJjJYfYFeRtM0t9ssnRuxw=="
+    },
     "esbuild@0.25.12": {
       "integrity": "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==",
       "optionalDependencies": [
@@ -860,6 +864,7 @@
       "jsr:@std/assert@1",
       "jsr:@std/path@1",
       "jsr:@zip-js/zip-js@^2.8.0",
+      "npm:es-module-lexer@2",
       "npm:esbuild@0.28",
       "npm:hono@4"
     ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "1tube",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "private": false,
   "description": "Self-hosted Supabase Edge Functions gateway for Deno, plus an ESLint plugin for consumers",
   "license": "MIT",

package/src/backends/workerd/backend.ts

@@ -639,6 +639,15 @@ export function resolveEnvAllowlist(
   return { resolved, missing, mode: "restricted" };
 }
 
+function runtimeSecretNames(envSource: EnvSource = Deno.env): string[] {
+  const raw = envSource.get("1TUBE_SECRET_NAMES") ?? "";
+  const names = raw
+    .split(",")
+    .map((s) => s.trim())
+    .filter((s) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(s));
+  return [...new Set(names)].sort();
+}
+
 /**
  * Compute the env vars exposed to a single function as workerd
  * `fromEnvironment` bindings.
@@ -1121,16 +1130,22 @@ export function createWorkerdBackend(opts: WorkerdBackendOptions): WorkerdBacken
         }
       }
 
-      // Resolve the gateway-wide env allowlist. This is the *maximum*
-      // surface any single function can ask for; per-function manifests
-      // narrow it further via `permissions.env`. Most-restrictive wins
-      // — operator declares what's available, the function declares
-      // what it actually uses, and we hand workerd the intersection.
+      // Resolve the gateway-wide env policy. Workerd gets live secrets
+      // plus the operator's explicit allowlist. We deliberately do not
+      // infer source usage here: dynamic access is common, and secrets
+      // are runtime configuration.
+      const hasConfiguredEnvPolicy = (opts.envAllowlist?.length ?? 0) > 0 ||
+        ((Deno.env.get("1TUBE_WORKERD_ENV") ?? "").trim().length > 0);
+      const secretNames = runtimeSecretNames();
       const {
-        resolved: envBindings,
+        resolved: configuredEnvBindings,
         missing: missingEnv,
-        mode: envMode,
+        mode: configuredEnvMode,
       } = resolveEnvAllowlist(opts.envAllowlist);
+      const gatewayEnvBindings = [...new Set([
+        ...secretNames,
+        ...(hasConfiguredEnvPolicy ? configuredEnvBindings : []),
+      ])].sort();
       if (missingEnv.length > 0) {
         console.warn(
           `[1tube] workerd env allowlist references vars not present in the gateway env: ` +
@@ -1138,17 +1153,20 @@ export function createWorkerdBackend(opts: WorkerdBackendOptions): WorkerdBacken
             `Set them before starting the gateway, or remove them from the allowlist.`,
         );
       }
-      if (envBindings.length > 0) {
-        if (envMode === "all") {
+      if (hasConfiguredEnvPolicy && configuredEnvBindings.length > 0) {
+        if (configuredEnvMode === "all") {
           console.log(
-            `[1tube] forwarding all ${envBindings.length} env var(s) to workerd ` +
-              `(default; pass --workerd-env=A,B,C or set 1TUBE_WORKERD_ENV to restrict)`,
+            `[1tube] forwarding all ${configuredEnvBindings.length} env var(s) to workerd ` +
+              `plus ${secretNames.length} runtime secret name(s) (explicit '*')`,
           );
         } else {
           console.log(
-            `[1tube] forwarding ${envBindings.length} env var(s) to workerd: ${envBindings.join(", ")}`,
+            `[1tube] forwarding ${gatewayEnvBindings.length} env var(s) to workerd ` +
+              `(${secretNames.length} secret(s), ${configuredEnvBindings.length} explicit): ${gatewayEnvBindings.join(", ")}`,
           );
         }
+      } else if (secretNames.length > 0) {
+        console.log(`[1tube] forwarding ${secretNames.length} runtime secret env var(s) to workerd: ${secretNames.join(", ")}`);
       }
 
       // Load each function's 1tube.json. Missing files yield
@@ -1202,7 +1220,7 @@ export function createWorkerdBackend(opts: WorkerdBackendOptions): WorkerdBacken
         const m = newManifests.get(r.name)!;
         const bundleEmbedPath = prebuiltBundleFiles?.get(r.name) ??
           r.bundlePath.split(/[\\/]/).pop()!;
-        const fnEnvBindings = intersectEnvForFunction(envBindings, m.permissions.env, enforceManifest);
+        const fnEnvBindings = intersectEnvForFunction(gatewayEnvBindings, m.permissions.env, enforceManifest);
         for (const internalName of internalEnvBindings) {
           if (!fnEnvBindings.includes(internalName)) fnEnvBindings.push(internalName);
         }
@@ -1241,6 +1259,21 @@ export function createWorkerdBackend(opts: WorkerdBackendOptions): WorkerdBacken
 
       const newRoutesByName = new Map(capnp.routes.map((r) => [r.name, r]));
       const newNames = capnp.routes.map((r) => r.name).sort();
+      if (args.gen === 0) {
+        const ports = capnp.routes.map((r) => r.port);
+        const minPort = Math.min(...ports);
+        const maxPort = Math.max(...ports);
+        const totalEnvBindings = capnpInputs.reduce((sum, input) => sum + (input.envBindings?.length ?? 0), 0);
+        const maxEnvBindings = capnpInputs.reduce((max, input) => Math.max(max, input.envBindings?.length ?? 0), 0);
+        console.log(
+          `[1tube] workerd config: path=${capnpPath} services=${capnp.routes.length} ` +
+            `ports=${minPort}${minPort === maxPort ? "" : `-${maxPort}`} ` +
+            `compat=${effectiveCompatDate ?? "default"} ` +
+            `flags=${(opts.compatibilityFlags ?? ["default"]).join(",")} ` +
+            `envMode=${hasConfiguredEnvPolicy ? configuredEnvMode : "secrets"} ` +
+            `envBindingsTotal=${totalEnvBindings} envBindingsMaxPerFn=${maxEnvBindings}`,
+        );
+      }
 
       // Preflight: refuse to spawn workerd against ports that are
       // already in use. Without this, a leftover workerd from a
@@ -1341,11 +1374,16 @@ export function createWorkerdBackend(opts: WorkerdBackendOptions): WorkerdBacken
 
       const maxHeapArgs = buildMaxHeapExtraArgs(opts.maxHeapMB);
       const extraArgs = [...inspectorArgs, ...maxHeapArgs];
+      const verboseWorkerd = (Deno.env.get("1TUBE_WORKERD_VERBOSE") ?? "") === "1";
+      if (verboseWorkerd) {
+        console.log(`[1tube] workerd verbose logging enabled (1TUBE_WORKERD_VERBOSE=1)`);
+      }
 
       const newProcess = createWorkerdProcess({
         binary: workerdBin,
         capnpPath,
         routes: capnp.routes,
+        ...(verboseWorkerd ? { globalArgs: ["-v"] } : {}),
         extraArgs,
         env: sharedRuntime
           ? {

package/src/backends/workerd/bundler.ts

@@ -290,6 +290,12 @@ export interface SharedBundleResult extends SharedRuntimeModule {
 
 export async function disposeBundlerResources(): Promise<void> {
   await esbuild.stop();
+  // esbuild.stop() tears down the service process synchronously from
+  // esbuild's point of view, but Deno's node:child_process shim settles
+  // the underlying spawn wait op on the next turn. Let that completion
+  // run before sanitizer-enabled tests assert that no child process
+  // resources remain.
+  await new Promise((resolve) => setTimeout(resolve, 0));
 }
 
 function sharedModuleStubSource(module: WorkerdSharedModuleInput): string {

package/src/backends/workerd/process.ts

@@ -44,6 +44,8 @@ const DEFAULT_READY_TIMEOUT_MS = 15_000;
 const DEFAULT_PROBE_INTERVAL_MS = 50;
 /** Default grace period before escalating from SIGTERM to SIGKILL. */
 const DEFAULT_SHUTDOWN_TIMEOUT_MS = 5_000;
+/** Bounded child-output tail attached to startup failures. */
+const OUTPUT_TAIL_LINES = 800;
 
 export interface WorkerdProcessOptions {
   /** Absolute or PATH-resolvable path to the `workerd` binary. */
@@ -362,6 +364,46 @@ function bestEffortKill(child: Deno.ChildProcess, signal: Deno.Signal): boolean
   }
 }
 
+function quoteArg(arg: string): string {
+  return /^[A-Za-z0-9_./:=@+-]+$/.test(arg) ? arg : JSON.stringify(arg);
+}
+
+function summarizeRoutes(routes: readonly CapnpRoute[]): string {
+  if (routes.length === 0) return "routes=0";
+  const ports = routes.map((r) => r.port);
+  const min = Math.min(...ports);
+  const max = Math.max(...ports);
+  const hosts = [...new Set(routes.map((r) => r.address))].join(",");
+  return `routes=${routes.length} hosts=${hosts} ports=${min}${min === max ? "" : `-${max}`}`;
+}
+
+function formatStartupFailure(opts: {
+  command: readonly string[];
+  cwd: string;
+  capnpPath: string;
+  routes: readonly CapnpRoute[];
+  exitCode: number | null | undefined;
+  outputTail: readonly string[];
+  cause: unknown;
+}): string {
+  const lines = [
+    "workerd exited before sockets became ready",
+    `  exitCode=${opts.exitCode ?? "<unknown>"}`,
+    `  command=${opts.command.map(quoteArg).join(" ")}`,
+    `  cwd=${opts.cwd}`,
+    `  capnp=${opts.capnpPath}`,
+    `  ${summarizeRoutes(opts.routes)}`,
+  ];
+  if (opts.cause instanceof Error) {
+    lines.push(`  readiness=${opts.cause.message}`);
+  }
+  if (opts.outputTail.length > 0) {
+    lines.push(`  -- last ${opts.outputTail.length} workerd output line(s) --`);
+    for (const line of opts.outputTail) lines.push(`  | ${line}`);
+  }
+  return lines.join("\n");
+}
+
 /** Build the manager. Stateful — caller owns lifecycle. */
 export function createWorkerdProcess(opts: WorkerdProcessOptions): WorkerdProcess {
   const sink = opts.logLineSink ?? defaultLogLineSink;
@@ -402,14 +444,23 @@ export function createWorkerdProcess(opts: WorkerdProcessOptions): WorkerdProces
       // a transitive node-path dependency on this module; the inline
       // separator-aware split is enough for our purposes.
       const cwd = opts.cwd ?? opts.capnpPath.replace(/[\\/][^\\/]+$/, "");
+      const args = [
+        ...(opts.globalArgs ?? []),
+        "serve",
+        opts.capnpPath,
+        ...(opts.extraArgs ?? []),
+      ];
+      const command = [opts.binary, ...args];
+      const outputTail: string[] = [];
+      let exitCode: number | null | undefined;
+      const captureLine = (line: string) => {
+        outputTail.push(line);
+        while (outputTail.length > OUTPUT_TAIL_LINES) outputTail.shift();
+        sink(line);
+      };
 
       const cmd = new Deno.Command(opts.binary, {
-        args: [
-          ...(opts.globalArgs ?? []),
-          "serve",
-          opts.capnpPath,
-          ...(opts.extraArgs ?? []),
-        ],
+        args,
         cwd,
         env: opts.env,
         stdout: "piped",
@@ -421,8 +472,8 @@ export function createWorkerdProcess(opts: WorkerdProcessOptions): WorkerdProces
       // Pump stdout + stderr into the sink. Both pumps are awaited at
       // shutdown so the consumer can be sure no lines are lost.
       pumpsDone = Promise.all([
-        pumpLines(child.stdout, sink),
-        pumpLines(child.stderr, sink),
+        pumpLines(child.stdout, captureLine),
+        pumpLines(child.stderr, captureLine),
       ]).then(() => {});
 
       // Watch for early exit so a workerd that crashes during boot
@@ -430,6 +481,7 @@ export function createWorkerdProcess(opts: WorkerdProcessOptions): WorkerdProces
       // the readiness wait instead of hanging until the timeout.
       const exitAbort = new AbortController();
       const exitWatch = child.status.then((status) => {
+        exitCode = status.code;
         const expected = stopRequested;
         if (!expected) {
           // Crash before ready or during runtime. Abort the readiness
@@ -455,11 +507,17 @@ export function createWorkerdProcess(opts: WorkerdProcessOptions): WorkerdProces
         // (extremely rare with workerd, but defence in depth).
         if (child) bestEffortKill(child, "SIGKILL");
         await exitWatch.catch(() => {}); // swallow — already in failure path
+        if (pumpsDone) await pumpsDone.catch(() => {});
         if (exitAbort.signal.aborted) {
-          throw new Error(
-            `workerd exited before sockets became ready` +
-              (err instanceof Error ? `: ${err.message}` : ""),
-          );
+          throw new Error(formatStartupFailure({
+            command,
+            cwd,
+            capnpPath: opts.capnpPath,
+            routes: opts.routes,
+            exitCode,
+            outputTail,
+            cause: err,
+          }));
         }
         throw err;
       }

package/src/cli/envelope.ts

@@ -53,6 +53,8 @@ export interface FirmwareEnvelope {
   createdBy: string;
   /** SHA-256 of `dist/manifest.json` bytes, lowercase hex. */
   manifestSha256: string;
+  /** Stable runtime-content fingerprint; excludes package/build metadata. */
+  contentSha256?: string;
   /** Number of functions in the inner manifest. Diagnostic. */
   functionCount: number;
   /** Sum of every bundle's byte length. Diagnostic. */
@@ -163,7 +165,11 @@ export async function signEnvelope(
     false,
     ["sign"],
   );
-  const sig = await crypto.subtle.sign("HMAC", cryptoKey, message as BufferSource);
+  const sig = await crypto.subtle.sign(
+    "HMAC",
+    cryptoKey,
+    message as BufferSource,
+  );
   return {
     ...unsigned,
     signature: {
@@ -252,7 +258,10 @@ export function parseEnvelope(raw: unknown): FirmwareEnvelope {
       throw new Error(`envelope.${k} missing or not a string`);
     }
   }
-  if (typeof o.functionCount !== "number" || typeof o.totalBundleBytes !== "number") {
+  if (
+    typeof o.functionCount !== "number" ||
+    typeof o.totalBundleBytes !== "number"
+  ) {
     throw new Error("envelope.functionCount / .totalBundleBytes missing");
   }
   return {
@@ -261,6 +270,9 @@ export function parseEnvelope(raw: unknown): FirmwareEnvelope {
     createdAt: o.createdAt as string,
     createdBy: o.createdBy as string,
     manifestSha256: o.manifestSha256 as string,
+    ...(typeof o.contentSha256 === "string" && o.contentSha256.length > 0
+      ? { contentSha256: o.contentSha256 }
+      : {}),
     functionCount: o.functionCount as number,
     totalBundleBytes: o.totalBundleBytes as number,
     signature: {

package/src/cli/package.ts

@@ -53,6 +53,7 @@ import {
   parsePrebuiltManifest,
   type PrebuiltManifest,
 } from "../backends/workerd/prebuilt.ts";
+import { computeFirmwareContentFingerprint } from "../firmware-content-hash.ts";
 import { VERSION } from "../version.ts";
 
 /**
@@ -326,6 +327,10 @@ export async function packageDist(
   const files = await collectDistFiles(distDir, manifest, opts.onProgress);
   const manifestEntry = files.find((f) => f.zipPath === "dist/manifest.json")!;
   const manifestSha256 = await sha256Hex(manifestEntry.bytes);
+  const contentFingerprint = await computeFirmwareContentFingerprint(
+    distDir,
+    manifest,
+  );
 
   const totalBundleBytes = manifest.functions.reduce(
     (acc, f) => acc + f.bundleBytes,
@@ -341,6 +346,7 @@ export async function packageDist(
     createdAt,
     createdBy: `1tube@${VERSION}`,
     manifestSha256,
+    contentSha256: contentFingerprint.sha256,
     functionCount: manifest.functions.length,
     totalBundleBytes,
   };
@@ -499,7 +505,12 @@ function makeProgressRenderer(): (e: PackageProgress) => void {
       : e.phase === "compress"
       ? "zipping"
       : "wrote";
-    const namePart = e.name ? ` ${truncateMiddle(e.name, 40)}` : "";
+    const displayName = e.phase === "finalize"
+      ? e.name
+      : e.name
+      ? truncateMiddle(e.name, 40)
+      : "";
+    const namePart = displayName ? ` ${displayName}` : "";
     const line = `[1tube package] ${tag} ${e.current}/${e.total}` +
       (pct ? ` (${pct})` : "") +
       ` ${sizeStr}${namePart}`;
@@ -675,7 +686,10 @@ export async function runPackage(args: string[]): Promise<number> {
     console.log(
       `[1tube package] envelope: ${result.envelope.functionCount} function(s), ` +
         `${fmt(result.envelope.totalBundleBytes)} bundle bytes, ` +
-        `manifest sha256=${result.envelope.manifestSha256.slice(0, 12)}…`,
+        `manifest sha256=${result.envelope.manifestSha256.slice(0, 12)}…, ` +
+        `content sha256=${
+          result.envelope.contentSha256?.slice(0, 12) ?? "<none>"
+        }…`,
     );
     return 0;
   } catch (err) {

package/src/firmware-content-hash.ts

@@ -0,0 +1,192 @@
+import { dirname, join, normalize } from "node:path";
+import { init, parse } from "es-module-lexer";
+import { canonicalJson } from "./cli/envelope.ts";
+import type { PrebuiltManifest } from "./backends/workerd/prebuilt.ts";
+
+async function sha256Hex(bytes: Uint8Array | string): Promise<string> {
+  const data = typeof bytes === "string"
+    ? new TextEncoder().encode(bytes)
+    : bytes;
+  const buf = await crypto.subtle.digest("SHA-256", data as BufferSource);
+  const view = new Uint8Array(buf);
+  let out = "";
+  for (let i = 0; i < view.length; i++) {
+    out += view[i].toString(16).padStart(2, "0");
+  }
+  return out;
+}
+
+function toPosix(path: string): string {
+  return path.replace(/\\/g, "/").replace(/^\/+/, "");
+}
+
+function uniqueSorted(values: Iterable<string>): string[] {
+  return [...new Set(values)].sort();
+}
+
+function sortPlain(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(sortPlain);
+  if (!value || typeof value !== "object") return value;
+  const obj = value as Record<string, unknown>;
+  const out: Record<string, unknown> = {};
+  for (const key of Object.keys(obj).sort()) {
+    out[key] = sortPlain(obj[key]);
+  }
+  return out;
+}
+
+function resolveModuleSpecifier(
+  fromFile: string,
+  specifier: string,
+): string | null {
+  if (!specifier.startsWith(".")) return null;
+  const resolved = normalize(join(dirname(fromFile), specifier));
+  return toPosix(resolved);
+}
+
+async function normalizeModule(
+  moduleFile: string,
+  source: string,
+  knownModules: ReadonlySet<string>,
+): Promise<{ source: string; dependencies: string[] }> {
+  const dependencies: string[] = [];
+  const withoutSourceMap = source.replace(
+    /\n?\/\/# sourceMappingURL=.*$/m,
+    "\n",
+  );
+  await init;
+  const [imports] = parse(withoutSourceMap);
+  const patches: Array<{ start: number; end: number; value: string }> = [];
+  for (const specifier of imports) {
+    const rawSpecifier = specifier.n ??
+      withoutSourceMap.slice(specifier.s, specifier.e);
+    if (!rawSpecifier.startsWith(".")) continue;
+    const target = resolveModuleSpecifier(moduleFile, rawSpecifier);
+    if (!target || !knownModules.has(target)) continue;
+
+    dependencies.push(target);
+    patches.push({
+      start: specifier.s,
+      end: specifier.e,
+      value: "__1tube_module_ref__",
+    });
+  }
+
+  let normalized = withoutSourceMap;
+  for (const patch of patches.sort((a, b) => b.start - a.start)) {
+    normalized = normalized.slice(0, patch.start) + patch.value +
+      normalized.slice(patch.end);
+  }
+
+  return { source: normalized, dependencies: uniqueSorted(dependencies) };
+}
+
+export interface FirmwareContentFingerprint {
+  sha256: string;
+  canonical: string;
+}
+
+export async function computeFirmwareContentFingerprint(
+  distDir: string,
+  manifest: PrebuiltManifest,
+): Promise<FirmwareContentFingerprint> {
+  const moduleFiles = uniqueSorted([
+    ...manifest.functions.flatMap((fn) =>
+      fn.moduleFiles?.length ? fn.moduleFiles : [fn.bundleFile]
+    ),
+    ...manifest.chunks.map((chunk) => chunk.file),
+    ...manifest.sharedModules.map((shared) => shared.bundleFile),
+  ]);
+
+  const rawSources = new Map<string, string>();
+  for (const file of moduleFiles) {
+    const bytes = await Deno.readFile(join(distDir, file));
+    const source = new TextDecoder().decode(bytes);
+    rawSources.set(file, source);
+  }
+
+  const knownModules = new Set(moduleFiles);
+  const normalizedModules = new Map(
+    await Promise.all(
+      moduleFiles.map(async (file) =>
+        [
+          file,
+          await normalizeModule(file, rawSources.get(file) ?? "", knownModules),
+        ] as const
+      ),
+    ),
+  );
+  const moduleHashes = new Map<string, string>();
+  async function hashModule(
+    file: string,
+    stack = new Set<string>(),
+  ): Promise<string> {
+    const cached = moduleHashes.get(file);
+    if (cached) return cached;
+
+    const normalized = normalizedModules.get(file);
+    if (!normalized) {
+      throw new Error(`firmware content fingerprint missing module ${file}`);
+    }
+    if (stack.has(file)) {
+      return await sha256Hex("__1tube_module_cycle__");
+    }
+
+    stack.add(file);
+    const dependencyHashes = [];
+    for (const dependency of normalized.dependencies) {
+      dependencyHashes.push(await hashModule(dependency, stack));
+    }
+    stack.delete(file);
+
+    const hash = await sha256Hex(canonicalJson({
+      source: normalized.source,
+      dependencies: uniqueSorted(dependencyHashes),
+    }));
+    moduleHashes.set(file, hash);
+    return hash;
+  }
+  for (const file of moduleFiles) {
+    await hashModule(file);
+  }
+
+  const functionEntries = manifest.functions
+    .map((fn) => {
+      const modules = fn.moduleFiles?.length ? fn.moduleFiles : [fn.bundleFile];
+      return {
+        name: fn.name,
+        manifest: sortPlain(fn.manifest),
+        modules: uniqueSorted(
+          modules.map((file) => moduleHashes.get(file) ?? ""),
+        ),
+      };
+    })
+    .sort((a, b) => a.name.localeCompare(b.name));
+
+  const sharedEntries = manifest.sharedModules
+    .map((shared) => ({
+      id: shared.id,
+      exportNames: uniqueSorted(shared.exportNames),
+      module: moduleHashes.get(shared.bundleFile) ?? "",
+    }))
+    .sort((a, b) => a.id.localeCompare(b.id));
+
+  const chunkEntries = uniqueSorted(
+    manifest.chunks.map((chunk) => moduleHashes.get(chunk.file) ?? ""),
+  );
+
+  const canonical = canonicalJson({
+    schema: manifest.schema,
+    compatibilityDate: manifest.compatibilityDate,
+    compatibilityFlags: uniqueSorted(manifest.compatibilityFlags ?? []),
+    envAllowlist: uniqueSorted(manifest.envAllowlist ?? []),
+    chunks: chunkEntries,
+    sharedModules: sharedEntries,
+    functions: functionEntries,
+  });
+
+  return {
+    sha256: await sha256Hex(canonical),
+    canonical,
+  };
+}