1tube 0.1.45 → 0.1.47

package/README.md

@@ -62,25 +62,57 @@ npx 1tube package --functions supabase/functions --in dist --out fw.1tube --sign
 This replaces local-source invocations such as
 `deno run -A ../1tube/src/cli.ts ...` in downstream CI pipelines.
 
-### Passing deno flags through the launcher
+### One launcher, one path
 
-Arguments before a standalone `--` are 1tube CLI args; everything **after** `--`
-is forwarded verbatim to `deno run` (inserted before the entrypoint). This lets
-the launcher fully replace a project's bespoke `deno run … src/server.ts`
-command — including project-level deno flags like `--config`, `--env-file`,
-`--node-modules-dir` and `--no-lock`:
+There is a single launcher (`src/launch.ts`): the npm bin, the deno tasks, and
+host projects all funnel through it, and `serve` **always** spawns the gateway
+as a child `deno run`. That child process is what lets the launcher reconcile
+the lockfile with your installed dependencies _before_ Deno resolves any npm
+specifier — and fully reload it when a dependency changes (see below).
+
+The launcher recognizes its own flags and forwards everything else to the
+gateway, so it fully replaces a bespoke `deno run … src/server.ts` line — no
+`--` split needed:
 
 ```bash
 npx 1tube serve --functions ./supabase/functions --dev --hmr \
-  -- --no-lock --env-file=.env --config ./supabase/functions/deno.json --node-modules-dir=false
+  --config ./supabase/functions/deno.json --env-file=.env --node-modules-dir=false
 ```
 
-- If your passthrough includes its own `--config`, the launcher does **not** add
-  1tube's bundled `deno.json` — your import map wins (the gateway's own sources
-  use fully-qualified `npm:`/`jsr:` specifiers, so they resolve regardless).
+Launcher flags: `--lock <path>` (managed lockfile, default
+`<cwd>/.1tube/deno.lock`), `--no-lock`, `--refresh-lock`, `--config <path>`,
+`--env-file[=<path>]` (repeatable), `--minimum-dependency-age <n>`,
+`--node-modules-dir <v>`, `--no-pin`, `--no-dep-watch`. Anything after a `--`
+is forwarded verbatim to the gateway.
+
+- If you don't pass `--config`, the launcher falls back to 1tube's bundled
+  `deno.json`; the gateway's own sources use fully-qualified `npm:`/`jsr:`
+  specifiers, so they resolve either way.
 - Prefer keeping the command line clean? Set the same flags in
-  `1TUBE_DENO_ARGS` (space-separated) instead of after `--`. CLI passthrough
-  takes precedence on any duplicate flag.
+  `1TUBE_DENO_ARGS` (space-separated); they're appended to the launcher args.
+
+### Dependency pinning & live reload
+
+The edge runtime runs with `--node-modules-dir=false`, so Deno resolves npm
+specifiers from its own cache + lockfile, not from `node_modules`. An import map
+that maps a dependency with an **unconstrained** specifier (`npm:1tube/edge`,
+i.e. `@*`) is satisfied by _any_ locked version — so bumping that dependency in
+`package.json` would silently never reach the edge runtime, and the gateway
+could end up a different version than the edge surface its functions import.
+
+The launcher closes this gap: before spawning the gateway it rewrites every
+unconstrained `npm:` specifier in your `--config` import map to the **exact
+version installed in `node_modules`** (the source of truth your package manager
+controls), writing the result to `<.1tube>/deno.gen.json`. Now the specifier's
+version tracks the installed dependency, so Deno's native lockfile auto-update
+recomputes just that entry — every already-pinned dependency keeps its locked
+version (and the warm-boot speed a lockfile buys).
+
+While serving, the launcher watches your deno config and each pinned
+dependency's `package.json`. When an install or a config edit changes the
+effective version set, it prints `dependency change detected — reloading
+gateway` and fully restarts the gateway so Deno re-resolves. Disable with
+`--no-pin` / `--no-dep-watch`.
 
 ### Minimum dependency age
 

package/dist/edge.d.ts

@@ -117,6 +117,52 @@ export declare function internalServerError(message?: string, details?: unknown)
 export declare function badGateway(message?: string, details?: unknown): Response;
 export declare function serviceUnavailable(message?: string, details?: unknown): Response;
 export declare function gatewayTimeout(message?: string, details?: unknown): Response;
+/**
+ * How the rate limiter buckets requests for a function:
+ *   - "identity" (default): one bucket per authenticated user, falling back to
+ *     the client IP for unauthenticated/public functions.
+ *   - "ip": always bucket by client IP, even when a user is authenticated.
+ *   - "global": a single shared bucket for the whole function.
+ *
+ * Defined here (the self-contained `edge` surface) rather than in `manifest.ts`
+ * so the published `dist/edge.d.ts` has no dangling cross-module reference;
+ * `manifest.ts` re-exports it for the gateway side.
+ */
+export type RateLimitBy = "identity" | "ip" | "global";
+/** Full-control form of `serve({ rateLimit })`. */
+export interface RateLimitConfig {
+    /**
+     * Requests per minute. `0` = unlimited (the function is exempt). Omit to use
+     * the gateway default / any `1tube.json` value.
+     */
+    rpm?: number;
+    /**
+     * Bucket key strategy. Defaults to "identity" (per authenticated user,
+     * falling back to client IP). See {@link RateLimitBy}.
+     */
+    by?: RateLimitBy;
+}
+/**
+ * Per-function rate-limit declaration for `serve({ rateLimit })`:
+ *   - `false`  → exempt from rate limiting entirely (signed webhooks, trusted
+ *     server-to-server callers).
+ *   - `true`   → gateway default limit, keyed by identity (the implicit default
+ *     when `rateLimit` is omitted).
+ *   - `number` → requests-per-minute, keyed by identity.
+ *   - object   → full control over rpm + key strategy.
+ */
+export type RateLimitOption = boolean | number | RateLimitConfig;
+/** Normalized shape consumed by the registry / Worker `register()` contract. */
+export interface NormalizedRateLimit {
+    rpm?: number;
+    rateLimitBy?: RateLimitBy;
+}
+/**
+ * Collapse the friendly {@link RateLimitOption} into `{ rpm?, rateLimitBy? }`.
+ * `undefined`/`true` leave both unset (gateway default); `false` maps to the
+ * `rpm: 0` "unlimited" sentinel the gateway limiter understands.
+ */
+export declare function normalizeRateLimit(rl: RateLimitOption | undefined): NormalizedRateLimit;
 export interface ServeConfig<TContext = unknown> {
     name: string;
     require: unknown;
@@ -128,6 +174,13 @@ export interface ServeConfig<TContext = unknown> {
      * different prefix while keeping the same function modules.
      */
     pathPrefix?: string;
+    /**
+     * Per-function rate-limit declaration. Overrides any `1tube.json` `rpm`.
+     * Use `false` to exempt the function from rate limiting (e.g. a signed
+     * server-to-server webhook). Honoured by the 1tube gateway; standalone
+     * runtimes that front their own limiter ignore it.
+     */
+    rateLimit?: RateLimitOption;
 }
 export interface MatchedRoute {
     route: RouteDefinition<SchemaLike | undefined, SchemaLike | undefined, SchemaLike | undefined, RouteResponses, any>;

package/dist/edge.js

@@ -135,6 +135,20 @@ export function serviceUnavailable(message = "Service unavailable", details) {
 export function gatewayTimeout(message = "Gateway timeout", details) {
     return jsonError(HttpStatus.GATEWAY_TIMEOUT, message, details);
 }
+/**
+ * Collapse the friendly {@link RateLimitOption} into `{ rpm?, rateLimitBy? }`.
+ * `undefined`/`true` leave both unset (gateway default); `false` maps to the
+ * `rpm: 0` "unlimited" sentinel the gateway limiter understands.
+ */
+export function normalizeRateLimit(rl) {
+    if (rl === undefined || rl === true)
+        return {};
+    if (rl === false)
+        return { rpm: 0 };
+    if (typeof rl === "number")
+        return { rpm: rl };
+    return { rpm: rl.rpm, rateLimitBy: rl.by };
+}
 export function getStandaloneServe() {
     const runtime = globalThis;
     const standaloneServe = runtime.Deno?.serve;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "1tube",
-  "version": "0.1.45",
+  "version": "0.1.47",
   "private": false,
   "description": "Self-hosted Supabase Edge Functions gateway for Deno, plus an ESLint plugin for consumers",
   "license": "MIT",
@@ -55,7 +55,7 @@
     "serve": "deno task serve",
     "build:edge": "deno run -A npm:typescript@latest/tsc --target ES2022 --module ESNext --moduleResolution Bundler --declaration --outDir dist src/edge.ts src/edge-caller.ts src/warmup-client.ts",
     "prepack": "bun run build:edge",
-    "typecheck": "deno check src/server.ts src/cli.ts src/edge.ts src/edge-caller.ts src/warmup-client.ts eslint-plugin.js",
+    "typecheck": "deno check src/server.ts src/cli.ts src/launch.ts src/edge.ts src/edge-caller.ts src/warmup-client.ts eslint-plugin.js",
     "check": "deno cache --allow-scripts=npm:protobufjs src/server.ts",
     "smoke:bin": "node ./scripts/npm-cli.js --version",
     "prepublishOnly": "bun run build:edge && bun run typecheck && bun run check && bun run smoke:bin"

package/scripts/npm-cli.js

@@ -1,113 +1,49 @@
 #!/usr/bin/env node
 
+/**
+ * `1tube` npm bin — a tiny Node shim that locates Deno and runs the single
+ * launcher (`src/launch.ts`). All argument handling, the managed lockfile,
+ * dependency pinning, minimum-dependency-age, and live reload live in the
+ * launcher itself, so this shim stays trivial: find deno, forward argv, wire
+ * up signals + exit code.
+ *
+ * Machines using this need Deno on PATH (or set `DENO_BIN`). Arguments are
+ * forwarded verbatim — the launcher recognizes its own flags (`--lock`,
+ * `--config`, `--env-file`, `--node-modules-dir`, `--minimum-dependency-age`,
+ * `--no-lock`, `--no-pin`, `--no-dep-watch`, …) and forwards everything else
+ * to the gateway. `1TUBE_DENO_ARGS` (space-separated) is appended for projects
+ * that prefer to keep flags out of the command line.
+ */
+
 import { spawn } from "node:child_process";
-import { existsSync, mkdirSync, rmSync } from "node:fs";
+import { existsSync } from "node:fs";
 import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
 import process from "node:process";
 import { fileURLToPath } from "node:url";
 
 const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const denoConfig = resolve(packageRoot, "deno.json");
-const cliEntrypoint = resolve(packageRoot, "src", "cli.ts");
+const launcherEntrypoint = resolve(packageRoot, "src", "launch.ts");
 const denoBin = process.env.DENO_BIN || "deno";
 
-// Arg model
-// ---------
-// Everything BEFORE a standalone `--` is a 1tube CLI argument (forwarded
-// after the entrypoint). Everything AFTER `--` is a raw `deno run` flag,
-// inserted BEFORE the entrypoint — so this launcher can fully replace a
-// hand-rolled `deno run … src/server.ts` line:
-//
-//   1tube serve --functions ./supabase/functions --dev --hmr \
-//     -- --no-lock --env-file=.env --config ./supabase/functions/deno.json --node-modules-dir=false
-//
-// Projects that would rather not thread flags through the command line
-// can set `1TUBE_DENO_ARGS` instead (same flags, space-separated).
-const rawArgs = process.argv.slice(2);
-const sepIndex = rawArgs.indexOf("--");
-const tubeArgs = sepIndex === -1 ? rawArgs : rawArgs.slice(0, sepIndex);
-const cliDenoArgs = sepIndex === -1 ? [] : rawArgs.slice(sepIndex + 1);
-
-// CLI passthrough is appended last so it wins on any duplicate flag
-// (Deno applies last-one-wins for repeated flags).
-const denoPassthrough = [
+// The launcher needs no import map or lockfile of its own (it imports only
+// node: builtins + relative source), and it owns the gateway child's lock,
+// config and npm-config — so the outer `deno run` stays minimal and fast.
+const denoArgs = [
+  "run",
+  "--quiet",
+  "-A",
+  "--node-modules-dir=false",
+  launcherEntrypoint,
   ...tokenizeArgs(
     process.env.ONETUBE_DENO_ARGS ?? process.env["1TUBE_DENO_ARGS"] ?? "",
   ),
-  ...cliDenoArgs,
+  ...process.argv.slice(2),
 ];
 
-// Default to --help only when the user gave us nothing at all; if they
-// supplied deno flags but no 1tube subcommand, let cli.ts fall through to
-// its default `serve` path.
-const forwardedTubeArgs = tubeArgs.length === 0 && denoPassthrough.length === 0
-  ? ["--help"]
-  : tubeArgs;
-
-// 1tube ships its own deno.json (import map for the gateway's jsr:/npm:
-// dependencies). Only inject it when the project didn't supply its own
-// --config — a Supabase project points --config at
-// supabase/functions/deno.json so its function workers resolve the
-// project's bare specifiers. The gateway's own sources use fully
-// qualified npm:/jsr: specifiers, so they resolve without our config.
-const userSuppliedConfig = denoPassthrough.some((a) =>
-  a === "--config" || a === "-c" ||
-  a.startsWith("--config=") || a.startsWith("-c=")
-);
-
-// Managed lockfile
-// ----------------
-// A lockfile is what makes a big functions project boot fast: without one
-// (`--no-lock`) Deno re-solves the entire npm/jsr version graph from
-// scratch on every start, and a 100-function project pays that as a
-// multi-second floor every boot. People reach for `--no-lock` to dodge
-// "the lock went stale when I bumped a dep" pain — but in dev Deno's
-// lockfile is ADDITIVE and non-frozen: a changed dependency is appended
-// without error. So the right default is a lockfile we own, not none.
-//
-// We point `--lock` at `.1tube/deno.lock` — a gateway-owned scratch path
-// (already gitignored alongside `.1tube/logs.db`) so it never adds git
-// churn and never collides with a project's own committed `deno.lock`.
-// We never pass `--frozen`, so dep changes self-heal. `1TUBE_REFRESH_LOCK=1`
-// drops the managed lock for a clean rebuild. Any explicit `--lock`,
-// `--no-lock`, or `--frozen` the user passes wins — we don't second-guess.
-const managedLock = resolveManagedLock(denoPassthrough);
-
-const denoArgs = ["run", "--quiet", "-A"];
-if (!userSuppliedConfig) denoArgs.push("--config", denoConfig);
-if (managedLock) denoArgs.push("--lock", managedLock);
-denoArgs.push(...denoPassthrough, cliEntrypoint, ...forwardedTubeArgs);
-
-// Deno 2.9 enables a 24h "minimum dependency age" by default, which makes
-// a function that pins a freshly published npm version fail to resolve in
-// local dev ("…newer than the specified minimum dependency date"). This
-// setting cannot be changed from inside the process (Deno snapshots npm
-// config at startup), so the launcher is the place to neutralize it.
-//
-// NPM_CONFIG_MIN_RELEASE_AGE is the LOWEST explicit tier in Deno's
-// precedence chain (CLI flag > deno.json > .npmrc > this env var > the
-// 24h built-in default). Setting it to 0 cancels ONLY the built-in
-// default — any .npmrc `min-release-age`, deno.json `minimumDependencyAge`,
-// or `--minimum-dependency-age` the project sets still wins. We never
-// override a value the user already exported.
-const childEnv = { ...process.env };
-if (
-  childEnv.NPM_CONFIG_MIN_RELEASE_AGE === undefined &&
-  childEnv.npm_config_min_release_age === undefined
-) {
-  childEnv.NPM_CONFIG_MIN_RELEASE_AGE = "0";
-}
-// Let the gateway print which lockfile is in effect (it can't read its own
-// process's `--lock` flag back out of Deno).
-if (managedLock) childEnv.ONETUBE_LOCK = managedLock;
-
 // Resolve the real deno binary up front. Node ≥18.20 refuses to spawn a
-// `.cmd`/`.bat` shim without a shell, but spawning a real `.exe` (or a
-// bare binary on POSIX) with `shell:false` lets Node escape arguments
-// properly — important now that we forward arbitrary deno flags, some of
-// which carry paths with spaces (`--config "C:\My Project\deno.json"`).
-// We only fall back to a shell when we must (a `.cmd`/`.bat` shim, or we
-// couldn't locate the binary on a Windows PATH at all).
+// `.cmd`/`.bat` shim without a shell, but spawning a real `.exe` (or a bare
+// binary on POSIX) with `shell:false` lets Node escape arguments properly —
+// important since we forward arbitrary flags, some carrying paths with spaces.
 const resolvedDeno = resolveExecutable(denoBin);
 const needsShell = resolvedDeno
   ? /\.(cmd|bat)$/i.test(resolvedDeno)
@@ -116,26 +52,17 @@ const spawnBin = resolvedDeno ?? denoBin;
 
 let child;
 if (needsShell) {
-  // A `.cmd`/`.bat` shim (the npm-installed deno) — or an unresolved name
-  // on Windows — must go through a shell. We pass a single, manually
-  // quoted command string instead of an args array so that (a) paths
-  // with spaces survive and (b) we sidestep Node's DEP0190 "args are not
-  // escaped" deprecation, which fires only for the shell-plus-array form.
   const command = [spawnBin, ...denoArgs].map(quoteForCmd).join(" ");
   child = spawn(command, {
     stdio: "inherit",
     shell: true,
     windowsHide: false,
-    env: childEnv,
   });
 } else {
-  // Real executable (deno.exe / a POSIX binary): no shell, so Node
-  // escapes each argument for us.
   child = spawn(spawnBin, denoArgs, {
     stdio: "inherit",
     shell: false,
     windowsHide: false,
-    env: childEnv,
   });
 }
 
@@ -164,64 +91,10 @@ child.on("exit", (code, signal) => {
   process.exit(code ?? 1);
 });
 
-/**
- * Decide whether to inject a 1tube-managed lockfile, and where.
- *
- * Returns the absolute lock path to pass to `--lock`, or null when the
- * caller already made an explicit locking choice (`--lock`, `--no-lock`,
- * or `--frozen`) — in which case we stay out of the way entirely.
- *
- * The managed lock lives at `<cwd>/.1tube/deno.lock`: a scratch path that
- * 1tube already owns and gitignores, so enabling it adds no git churn and
- * never clashes with a project's own committed `deno.lock`.
- *
- * @param {string[]} passthrough  Raw deno flags being forwarded to `deno run`.
- * @returns {string | null}
- */
-function resolveManagedLock(passthrough) {
-  const explicit = passthrough.some((a) =>
-    a === "--lock" || a.startsWith("--lock=") ||
-    a === "--no-lock" || a.startsWith("--no-lock=") ||
-    a === "--frozen" || a.startsWith("--frozen=")
-  );
-  if (explicit) return null;
-
-  const dir = join(process.cwd(), ".1tube");
-  const lockPath = join(dir, "deno.lock");
-  try {
-    mkdirSync(dir, { recursive: true });
-  } catch {
-    // If we can't create the scratch dir, fall back to no managed lock
-    // rather than crash the launcher.
-    return null;
-  }
-
-  // `1TUBE_REFRESH_LOCK=1` forces a clean rebuild by dropping the managed
-  // lock; Deno then re-derives it from the current deps on this boot.
-  if (truthy(process.env.ONETUBE_REFRESH_LOCK ?? process.env["1TUBE_REFRESH_LOCK"])) {
-    try {
-      rmSync(lockPath, { force: true });
-    } catch {
-      // Best-effort.
-    }
-  }
-  return lockPath;
-}
-
-/**
- * Loose truthiness for env-var flags: "1", "true", "yes", "on" (any case).
- *
- * @param {string | undefined} v
- * @returns {boolean}
- */
-function truthy(v) {
-  return v !== undefined && /^(1|true|yes|on)$/i.test(v.trim());
-}
-
 /**
  * Split a flag string into argv tokens, honoring single/double quotes so
- * values with spaces (`--env-file="my env.env"`) survive. Good enough for
- * a dev-time convenience var — not a full shell parser.
+ * values with spaces (`--env-file="my env.env"`) survive. Good enough for a
+ * dev-time convenience var — not a full shell parser.
  *
  * @param {string} s
  * @returns {string[]}
@@ -238,14 +111,13 @@ function tokenizeArgs(s) {
 
 /**
  * Locate an executable on PATH (honoring PATHEXT on Windows). Returns an
- * absolute path, or null when the name can't be resolved — in which case
- * the caller hands the bare name to spawn and lets the OS/shell try.
+ * absolute path, or null when the name can't be resolved — in which case the
+ * caller hands the bare name to spawn and lets the OS/shell try.
  *
  * @param {string} bin
  * @returns {string | null}
  */
 function resolveExecutable(bin) {
-  // An explicit path (absolute or containing a separator) is used as-is.
   if (isAbsolute(bin) || bin.includes("/") || bin.includes("\\")) {
     return existsSync(bin) ? bin : null;
   }
@@ -264,9 +136,9 @@ function resolveExecutable(bin) {
 }
 
 /**
- * Quote a single argument for cmd.exe. Leaves simple tokens untouched to
- * avoid over-quoting; wraps anything with whitespace or shell
- * metacharacters in double quotes, doubling any embedded quotes.
+ * Quote a single argument for cmd.exe. Leaves simple tokens untouched to avoid
+ * over-quoting; wraps anything with whitespace or shell metacharacters in
+ * double quotes, doubling any embedded quotes.
  *
  * @param {string} arg
  * @returns {string}

package/src/backends/deno/worker-entry-colocated.ts

@@ -5,18 +5,18 @@
  * bootstrap hosts EVERY function in a single isolate. The point is
  * dependency sharing: a 100-function project where most functions import
  * the same heavy npm graph (`ai`, `@supabase/supabase-js`, `@google/genai`,
- * `zod`, �) pays to compile + evaluate that graph exactly once here,
+ * `zod`, ?) pays to compile + evaluate that graph exactly once here,
  * instead of once per function across 100 isolates. On a real project that
  * collapses warm-boot from ~per-function-sum/cores down to roughly the
  * one-time cost of the union graph (measured ~6s vs ~18s).
  *
  * Trade-off: functions share globals and a crash takes the whole isolate
- * down. That's why this mode is dev-only � production keeps isolate-per-
+ * down. That's why this mode is dev-only ? production keeps isolate-per-
  * function (or workerd) for real isolation.
  *
  * Lifecycle:
  *
- *   host ? init      : { functions: [{name, entryUrl, manifest}], � }
+ *   host ? init      : { functions: [{name, entryUrl, manifest}], ? }
  *                      Imported SERIALLY so each function's top-level
  *                      `serve()` registration can be attributed to the
  *                      right name (parallel imports would interleave the
@@ -26,7 +26,7 @@
  *                      Streams `fn_ready` / `fn_error` per function, then
  *                      `all_done`.
  *
- *   host ? dispatch  : { id, name, � } ? look up the captured handler by
+ *   host ? dispatch  : { id, name, ? } ? look up the captured handler by
  *                      name and run it (per-request AsyncLocalStorage so
  *                      concurrent invocations attribute console output).
  *
@@ -42,7 +42,11 @@
 /// <reference lib="deno.worker" />
 
 import { AsyncLocalStorage } from "node:async_hooks";
-import type { FunctionManifest } from "../../manifest.ts";
+import {
+  type FunctionManifest,
+  mergeServeRateLimit,
+  type RateLimitBy,
+} from "../../manifest.ts";
 import type { AuthContext } from "../../registry.ts";
 
 interface FnSpec {
@@ -96,7 +100,12 @@ type Handler = (
 interface RegistryStub {
   register(
     handler: Handler,
-    opts: { public: boolean; timeoutMs?: number },
+    opts: {
+      public: boolean;
+      timeoutMs?: number;
+      rpm?: number;
+      rateLimitBy?: RateLimitBy;
+    },
   ): void;
 }
 
@@ -104,6 +113,8 @@ interface CapturedHandler {
   handler: Handler;
   isPublic: boolean;
   timeoutMs?: number;
+  rpm?: number;
+  rateLimitBy?: RateLimitBy;
   manifest: FunctionManifest;
 }
 
@@ -159,7 +170,7 @@ function installConsoleCapture(): void {
       try {
         let message = args.map(formatConsoleArg).join(" ");
         if (message.length > MAX_CONSOLE_MESSAGE) {
-          message = message.slice(0, MAX_CONSOLE_MESSAGE) + "�";
+          message = message.slice(0, MAX_CONSOLE_MESSAGE) + "?";
         }
         postMessage({
           type: "console",
@@ -184,7 +195,7 @@ function installConsoleCapture(): void {
 
 const stub: RegistryStub = {
   register(handler, opts) {
-    if (!importing) return; // serve() called outside an import window � ignore
+    if (!importing) return; // serve() called outside an import window ? ignore
     if (importing.captured) {
       console.warn(
         `[1tube] "${importing.name}" called serve() twice; using the last handler`,
@@ -194,6 +205,8 @@ const stub: RegistryStub = {
       handler,
       isPublic: opts.public,
       timeoutMs: opts.timeoutMs,
+      rpm: opts.rpm,
+      rateLimitBy: opts.rateLimitBy,
       manifest: { runtime: "deno" } as unknown as FunctionManifest,
     };
   },
@@ -282,7 +295,14 @@ async function loadFunction(
     });
     return;
   }
-  captured.manifest = fn.manifest;
+  // Fold any `serve({ rateLimit })` override into the manifest reported to the
+  // gateway so its rate-limiter (which reads `manifestFor()`) honours
+  // code-declared limits ? this isolate, not the gateway, ran the module.
+  const reportedManifest = mergeServeRateLimit(fn.manifest, {
+    rpm: captured.rpm,
+    rateLimitBy: captured.rateLimitBy,
+  });
+  captured.manifest = reportedManifest;
   handlers.set(fn.name, captured);
   postMessage({
     type: "fn_ready",
@@ -290,7 +310,7 @@ async function loadFunction(
     ms: performance.now() - t0,
     isPublic: captured.isPublic,
     timeoutMs: captured.timeoutMs,
-    manifest: fn.manifest,
+    manifest: reportedManifest,
   });
 }
 

package/src/backends/deno/worker-entry.ts

@@ -27,7 +27,11 @@
 /// <reference lib="deno.worker" />
 
 import { AsyncLocalStorage } from "node:async_hooks";
-import type { FunctionManifest } from "../../manifest.ts";
+import {
+  type FunctionManifest,
+  mergeServeRateLimit,
+  type RateLimitBy,
+} from "../../manifest.ts";
 import type { AuthContext } from "../../registry.ts";
 
 interface InitMessage {
@@ -70,7 +74,12 @@ type Handler = (
 interface RegistryStub {
   register(
     handler: Handler,
-    opts: { public: boolean; timeoutMs?: number },
+    opts: {
+      public: boolean;
+      timeoutMs?: number;
+      rpm?: number;
+      rateLimitBy?: RateLimitBy;
+    },
   ): void;
 }
 
@@ -78,6 +87,8 @@ interface CapturedHandler {
   handler: Handler;
   isPublic: boolean;
   timeoutMs?: number;
+  rpm?: number;
+  rateLimitBy?: RateLimitBy;
 }
 
 let captured: CapturedHandler | null = null;
@@ -202,6 +213,8 @@ const stub: RegistryStub = {
       handler,
       isPublic: opts.public,
       timeoutMs: opts.timeoutMs,
+      rpm: opts.rpm,
+      rateLimitBy: opts.rateLimitBy,
     };
   },
 };
@@ -322,12 +335,22 @@ self.onmessage = (ev: MessageEvent<HostMessage>) => {
         });
         return;
       }
+      // Fold any `serve({ rateLimit })` override into the manifest we report
+      // so the gateway's rate-limiter (which reads `manifestFor()`) honours
+      // code-declared limits — the function module runs in this Worker, not in
+      // the gateway process, so this `ready` handshake is the only channel.
+      const reportedManifest = manifest
+        ? mergeServeRateLimit(manifest, {
+          rpm: captured.rpm,
+          rateLimitBy: captured.rateLimitBy,
+        })
+        : manifest;
       postMessage({
         type: "ready",
         name: functionName,
         isPublic: captured.isPublic,
         timeoutMs: captured.timeoutMs,
-        manifest,
+        manifest: reportedManifest,
       });
     })();
     return;