1tube 0.1.48 → 0.1.50

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "1tube",
-  "version": "0.1.48",
+  "version": "0.1.50",
   "private": false,
   "description": "Self-hosted Supabase Edge Functions gateway for Deno, plus an ESLint plugin for consumers",
   "license": "MIT",

package/src/backends/env-hot-reloader.ts

@@ -0,0 +1,170 @@
+/**
+ * Watches `--env-file` / `.env` paths and hot-applies secret changes.
+ *
+ * Deno only loads `--env-file` once at process start. With `--hmr`, a
+ * save to `.env` must:
+ *   1. Re-parse the file(s) into `Deno.env`
+ *   2. Respawn function workers / workerd so top-level env captures
+ *      and workerd `fromEnvironment` bindings see the new values
+ *
+ * The functions-dir HMR loop never sees these paths (they live at the
+ * project root), so this watcher runs alongside it.
+ */
+
+import {
+  applyEnvFiles,
+  type EnvApplyDiff,
+  type EnvSource,
+  envFileWatchDirs,
+  isEnvFileEvent,
+} from "../env-file.ts";
+import type { FsEventStream } from "./deno/hot-reloader.ts";
+
+export interface EnvHotReloaderOptions {
+  /** Absolute paths of env files to watch (order = precedence). */
+  envFiles: readonly string[];
+  /** Called after a real env diff is applied. Should reload workers. */
+  onChanged: (diff: EnvApplyDiff) => void | Promise<void>;
+  debounceMs?: number;
+  leadingMs?: number;
+  /** Test seam: inject a fake watcher. */
+  watch?: (dirs: readonly string[]) => FsEventStream;
+  setTimer?: (cb: () => void, ms: number) => number;
+  clearTimer?: (id: number) => void;
+  log?: (line: string) => void;
+  /** Test seam: alternate env target (defaults to Deno.env). */
+  env?: EnvSource;
+  /** Test seam: override apply. */
+  apply?: (files: readonly string[], env: EnvSource) => EnvApplyDiff;
+}
+
+export interface EnvHotReloader {
+  start(): Promise<void>;
+  stop(): Promise<void>;
+}
+
+export function createEnvHotReloader(
+  opts: EnvHotReloaderOptions,
+): EnvHotReloader {
+  const log = opts.log ?? ((line) => console.log(line));
+  const envFiles = [...opts.envFiles];
+  const env = opts.env ?? Deno.env;
+  const apply = opts.apply ?? applyEnvFiles;
+  const setTimer = opts.setTimer ??
+    ((cb, ms) => setTimeout(cb, ms) as unknown as number);
+  const clearTimer = opts.clearTimer ?? ((id) => clearTimeout(id));
+  const debounceMs = opts.debounceMs ?? 200;
+  const leadingMs = opts.leadingMs !== undefined && opts.leadingMs > 0
+    ? opts.leadingMs
+    : 40;
+
+  const watcherFactory = opts.watch ??
+    ((dirs: readonly string[]) =>
+      Deno.watchFs([...dirs], { recursive: false }) as unknown as FsEventStream);
+
+  let stream: FsEventStream | null = null;
+  let stopped = false;
+  let consumeLoop: Promise<void> | null = null;
+  let timerId: number | null = null;
+  let flushing = false;
+  let pending = false;
+
+  const flush = async () => {
+    timerId = null;
+    if (flushing) return;
+    if (!pending) return;
+    pending = false;
+    flushing = true;
+    try {
+      const diff = apply(envFiles, env);
+      if (!diff.changed) return;
+      const parts: string[] = [];
+      if (diff.updated.length > 0) {
+        parts.push(`updated=${diff.updated.join(",")}`);
+      }
+      if (diff.added.length > 0) parts.push(`added=${diff.added.join(",")}`);
+      if (diff.removed.length > 0) {
+        parts.push(`removed=${diff.removed.join(",")}`);
+      }
+      log(
+        `[1tube] HMR env file changed (${parts.join("; ") || "secrets"}) � reloading functions`,
+      );
+      await opts.onChanged(diff);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      log(`[1tube] HMR env reload FAILED: ${msg}`);
+    } finally {
+      flushing = false;
+      if (pending) {
+        timerId = setTimer(flush, debounceMs);
+      }
+    }
+  };
+
+  const schedule = () => {
+    pending = true;
+    if (flushing) return;
+    if (timerId !== null) {
+      // Leading-edge: first event of a quiet period already armed �
+      // don't keep pushing the flush out.
+      return;
+    }
+    timerId = setTimer(flush, leadingMs);
+  };
+
+  return {
+    start() {
+      if (stream || envFiles.length === 0) return Promise.resolve();
+      const dirs = envFileWatchDirs(envFiles).filter((d) => {
+        try {
+          return Deno.statSync(d).isDirectory;
+        } catch {
+          return false;
+        }
+      });
+      if (dirs.length === 0) return Promise.resolve();
+
+      // Seed ownership from the current files so a subsequent delete of
+      // a key from `.env` can be removed from Deno.env on the next save.
+      apply(envFiles, env);
+
+      stream = watcherFactory(dirs);
+      log(
+        `[1tube] HMR watching env: ${envFiles.join(", ")}`,
+      );
+      consumeLoop = (async () => {
+        try {
+          for await (const event of stream!) {
+            if (stopped) break;
+            if (event.paths.length === 0) continue;
+            if (!isEnvFileEvent(event.paths, envFiles)) continue;
+            schedule();
+          }
+        } catch (err) {
+          if (!stopped) log(`[1tube] HMR env watcher disabled: ${err}`);
+        }
+      })();
+      return Promise.resolve();
+    },
+    async stop() {
+      if (stopped) return;
+      stopped = true;
+      if (timerId !== null) {
+        clearTimer(timerId);
+        timerId = null;
+      }
+      try {
+        stream?.close();
+      } catch { /* */ }
+      stream = null;
+      if (consumeLoop) {
+        let timeoutId: number | undefined;
+        const bound = new Promise<void>((resolve) => {
+          timeoutId = setTimeout(resolve, 250) as unknown as number;
+        });
+        await Promise.race([consumeLoop, bound]);
+        if (timeoutId !== undefined) clearTimeout(timeoutId);
+      }
+    },
+  };
+}

package/src/env-file.ts

@@ -0,0 +1,254 @@
+/**
+ * Dotenv parse + apply helpers for HMR secret reloads.
+ *
+ * Deno's `--env-file` only loads once at process start. When `--hmr` is
+ * on we re-read the same files on change, push values into `Deno.env`,
+ * and ask the hot-reloader to respawn workers / workerd so top-level
+ * `const KEY = Deno.env.get(...)` captures pick up the new secrets.
+ */
+
+import { basename, dirname, isAbsolute, resolve } from "node:path";
+
+export type EnvSource = {
+  get(key: string): string | undefined;
+  set(key: string, value: string): void;
+  delete(key: string): void;
+};
+
+export interface EnvApplyDiff {
+  /** Absolute paths that were successfully read. */
+  files: string[];
+  added: string[];
+  updated: string[];
+  removed: string[];
+  /** True when at least one key was added, updated, or removed. */
+  changed: boolean;
+}
+
+/** Keys currently owned by watched env files (union across all files). */
+const ownedKeys = new Set<string>();
+
+/** Test seam: reset owned-key tracking between tests. */
+export function resetEnvFileOwnership(): void {
+  ownedKeys.clear();
+}
+
+/**
+ * Parse a dotenv-format document into an ordered map.
+ *
+ * Mirrors Deno's `--env-file` rules closely enough for HMR:
+ *   - `#` comments and blank lines are ignored
+ *   - optional `export ` prefix
+ *   - first occurrence of a key wins within a file
+ *   - unquoted / single-quoted / double-quoted values
+ *   - `\n` / `\r` / `\t` / `\\` / `\"` escapes inside double quotes
+ */
+export function parseEnvFile(content: string): Map<string, string> {
+  const out = new Map<string, string>();
+  const lines = content.split(/\r?\n/);
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const body = line.startsWith("export ")
+      ? line.slice("export ".length).trim()
+      : line;
+    const eq = body.indexOf("=");
+    if (eq <= 0) continue;
+    const key = body.slice(0, eq).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) continue;
+    if (out.has(key)) continue; // first wins
+    let value = body.slice(eq + 1).trim();
+    if (
+      (value.startsWith('"') && value.endsWith('"') && value.length >= 2) ||
+      (value.startsWith("'") && value.endsWith("'") && value.length >= 2)
+    ) {
+      const quote = value[0];
+      value = value.slice(1, -1);
+      if (quote === '"') {
+        value = value
+          .replace(/\\n/g, "\n")
+          .replace(/\\r/g, "\r")
+          .replace(/\\t/g, "\t")
+          .replace(/\\"/g, '"')
+          .replace(/\\\\/g, "\\");
+      }
+    } else {
+      // Unquoted: strip inline comments (`KEY=val # comment`).
+      const hash = value.indexOf(" #");
+      if (hash !== -1) value = value.slice(0, hash).trimEnd();
+    }
+    out.set(key, value);
+  }
+  return out;
+}
+
+/**
+ * Resolve which env files HMR should watch.
+ *
+ * Priority:
+ *   1. Explicit list (tests / future CLI)
+ *   2. `1TUBE_ENV_FILES` (comma-separated) � set by the launcher when
+ *      the operator passes `--env-file=�`
+ *   3. Convention: `.env`, `.env.local`, `.env.development` under cwd
+ *      when those files already exist
+ */
+export function resolveWatchedEnvFiles(opts: {
+  cwd?: string;
+  explicit?: readonly string[];
+  envFilesEnv?: string | null;
+} = {}): string[] {
+  const cwd = opts.cwd ?? Deno.cwd();
+  const collected: string[] = [];
+  if (opts.explicit) {
+    for (const p of opts.explicit) collected.push(p);
+  }
+  const fromEnv = opts.envFilesEnv === null
+    ? ""
+    : (opts.envFilesEnv ?? Deno.env.get("1TUBE_ENV_FILES") ?? "");
+  for (const part of fromEnv.split(",")) {
+    const t = part.trim();
+    if (t) collected.push(t);
+  }
+  if (collected.length === 0) {
+    for (const name of [".env", ".env.local", ".env.development"]) {
+      const candidate = resolve(cwd, name);
+      try {
+        if (Deno.statSync(candidate).isFile) collected.push(candidate);
+      } catch {
+        // absent � skip
+      }
+    }
+  }
+  const seen = new Set<string>();
+  const out: string[] = [];
+  for (const p of collected) {
+    const abs = isAbsolute(p) ? resolve(p) : resolve(cwd, p);
+    if (seen.has(abs)) continue;
+    seen.add(abs);
+    out.push(abs);
+  }
+  return out;
+}
+
+/**
+ * Re-read `files` (in order; later files override earlier) and sync
+ * into `env`. Keys that disappeared from every watched file since the
+ * last apply are deleted so secret rotations/removals take effect.
+ */
+export function applyEnvFiles(
+  files: readonly string[],
+  env: EnvSource = Deno.env,
+): EnvApplyDiff {
+  const merged = new Map<string, string>();
+  const readFiles: string[] = [];
+  for (const file of files) {
+    let text: string;
+    try {
+      text = Deno.readTextFileSync(file);
+    } catch {
+      // Missing mid-edit (atomic save) � skip this file for now; the
+      // next fs event will retry. Don't wipe owned keys on a transient
+      // read failure.
+      continue;
+    }
+    readFiles.push(file);
+    const parsed = parseEnvFile(text);
+    // Later files win (matches Deno's last `--env-file` precedence).
+    for (const [k, v] of parsed) merged.set(k, v);
+  }
+
+  // If every file failed to read, leave state alone � likely a
+  // transient atomic-rename race.
+  if (files.length > 0 && readFiles.length === 0) {
+    return {
+      files: [],
+      added: [],
+      updated: [],
+      removed: [],
+      changed: false,
+    };
+  }
+
+  const added: string[] = [];
+  const updated: string[] = [];
+  const removed: string[] = [];
+
+  for (const [key, value] of merged) {
+    const prev = env.get(key);
+    if (prev === undefined) {
+      env.set(key, value);
+      added.push(key);
+    } else if (prev !== value) {
+      env.set(key, value);
+      updated.push(key);
+    }
+  }
+
+  for (const key of ownedKeys) {
+    if (!merged.has(key)) {
+      env.delete(key);
+      removed.push(key);
+    }
+  }
+
+  ownedKeys.clear();
+  for (const key of merged.keys()) ownedKeys.add(key);
+
+  added.sort();
+  updated.sort();
+  removed.sort();
+  return {
+    files: readFiles,
+    added,
+    updated,
+    removed,
+    changed: added.length + updated.length + removed.length > 0,
+  };
+}
+
+/** Parent directories to feed `Deno.watchFs` (atomic renames land here). */
+export function envFileWatchDirs(files: readonly string[]): string[] {
+  const dirs = new Set<string>();
+  for (const f of files) {
+    dirs.add(dirname(f));
+  }
+  return [...dirs];
+}
+
+/** True when an fs event path is (or renames onto) one of our env files. */
+export function isEnvFileEvent(
+  eventPaths: readonly string[],
+  envFiles: readonly string[],
+): boolean {
+  if (envFiles.length === 0) return false;
+  const targets = new Set(envFiles.map((p) => resolve(p)));
+  const byDir = new Map<string, Set<string>>();
+  for (const t of targets) {
+    const dir = dirname(t);
+    const name = basename(t);
+    let set = byDir.get(dir);
+    if (!set) {
+      set = new Set();
+      byDir.set(dir, set);
+    }
+    set.add(name);
+  }
+  for (const raw of eventPaths) {
+    const p = resolve(raw);
+    if (targets.has(p)) return true;
+    // Atomic save: event may report the temp sibling or just the dir.
+    const dir = dirname(p);
+    const names = byDir.get(dir);
+    if (!names) continue;
+    if (names.has(basename(p))) return true;
+    // Directory-level events (Windows) � treat as "maybe our file".
+    try {
+      if (Deno.statSync(p).isDirectory && byDir.has(p)) return true;
+    } catch {
+      // deleted path � if its basename matched we'd already returned;
+      // a missing temp file still warrants a re-read of that dir's targets.
+      if (byDir.has(dir)) return true;
+    }
+  }
+  return false;
+}

package/src/launch.ts

@@ -468,6 +468,14 @@ async function runServe(args: ServeArgs): Promise<never> {
   // Child env additions (merged onto the inherited environment).
   const childEnv: Record<string, string> = {};
   if (lockAbs) childEnv.ONETUBE_LOCK = lockAbs;
+  // Tell the gateway which `--env-file` paths to HMR-watch. Deno itself
+  // only loads them once at process start; the gateway re-applies on
+  // change so secret edits land without a full restart.
+  if (args.envFiles.length > 0) {
+    childEnv["1TUBE_ENV_FILES"] = args.envFiles
+      .map((p) => resolveToAbs(p))
+      .join(",");
+  }
   // Deno 2.9's 24h minimum-dependency-age default makes freshly published
   // pins fail to resolve; it must be set before the gateway's Deno starts.
   if (

package/src/server.ts

@@ -74,6 +74,11 @@ import {
   createRewriteCache,
   type RewriteCache,
 } from "./backends/deno/source-rewriter.ts";
+import {
+  createEnvHotReloader,
+  type EnvHotReloader,
+} from "./backends/env-hot-reloader.ts";
+import { resolveWatchedEnvFiles } from "./env-file.ts";
 import { createBootProgress, createScanProgress } from "./boot-progress.ts";
 import {
   createWorkerdWatchdog,
@@ -1227,6 +1232,7 @@ let workerdWatchdog: WorkerdWatchdog | null = null;
 const workerdNames = new Set<string>();
 let denoWorkerHost: DenoWorkerHost | null = null;
 let denoHotReloader: DenoHotReloader | null = null;
+let envHotReloader: EnvHotReloader | null = null;
 let denoSharedRuntimeRef: DenoSharedRuntime | null = null;
 let denoRewriteCacheRef: RewriteCache | null = null;
 
@@ -1705,6 +1711,46 @@ if (opts.backend === "workerd") {
   }
 }
 
+// Env-file HMR: Deno's `--env-file` only loads at process start, and
+// the functions-dir watcher never sees project-root `.env` saves.
+// Watch the same files the launcher forwarded (via 1TUBE_ENV_FILES)
+// or the conventional `.env*` in cwd, re-apply into Deno.env, and
+// respawn every function so secret rotations land immediately.
+if (opts.hmr && !opts.prebuiltDir) {
+  const envFiles = resolveWatchedEnvFiles();
+  if (envFiles.length > 0) {
+    envHotReloader = createEnvHotReloader({
+      envFiles,
+      onChanged: async () => {
+        if (workerdBackend) {
+          const result = await workerdBackend.reload("all");
+          console.log(
+            `[1tube] HMR env reload ok in ${result.durationMs.toFixed(0)}ms ` +
+              `(gen=${result.generation}; rebundled=all)`,
+          );
+          return;
+        }
+        if (denoWorkerHost) {
+          const summary = await denoWorkerHost.reload(
+            "all",
+            "env file changed",
+          );
+          console.log(
+            `[1tube] HMR env reload ok in ${summary.durationMs.toFixed(0)}ms` +
+              (summary.reloaded.length > 0
+                ? ` (reloaded=${summary.reloaded.join(",")})`
+                : ""),
+          );
+          for (const e of summary.errors) {
+            console.log(`[1tube] HMR ${e.name}: ${e.error}`);
+          }
+        }
+      },
+    });
+    await envHotReloader.start();
+  }
+}
+
 // ---------------------------------------------------------------------------
 // HTTP Server
 // ---------------------------------------------------------------------------
@@ -2480,6 +2526,11 @@ async function shutdown(reason: string) {
       console.warn("[1tube] deno hot reloader stop() error:", err);
     });
   }
+  if (envHotReloader) {
+    envHotReloader.stop().catch((err) => {
+      console.warn("[1tube] env hot reloader stop() error:", err);
+    });
+  }
 
   // Phase 1: stop accepting NEW connections. Already-accepted
   // requests keep running against the still-live workerd. This is