refactor(utils): consolidate hash, sleep, and base64 helpers onto canonical utils

[kojiwakayama]

Summary

First PR in the code-reduction refactor campaign: three low-level concerns were each implemented many times across src/; this routes every call site to one canonical implementation in #veryfront/utils with no behavior changes.

Net: −140 lines (41 files, +137/−277), 2634 unit tests pass, full lint/typecheck/fmt gates green.

Consolidations

Concern	Before	After
SHA-256 → hex	13 local crypto.subtle.digest blocks across oauth, discovery, server, agent, workflow, release-assets, eval, rendering, build, channels	computeHash / new computeHashBytes; src/release-assets/hash.ts deleted
sleep/delay	12 local sleep/delay defs + inline new Promise(setTimeout) in workflow, agent, sandbox, eval, routing, server	new canonical abort-aware sleep(ms, signal?) (src/utils/sleep.ts, impl lifted from workflow/dag)
base64/base64url	robust encodeBase64 local to security/http/auth.ts; 9 ad-hoc btoa/Buffer encoders in workflow, knowledge, proxy, transforms, metrics, server, html	encodeBase64 moved into utils/base64url.ts; all base64url helpers now exported from the #veryfront/utils barrel (they previously weren't — which is why modules reimplemented them)

Notes for review

• utils/base64url.ts stays dependency-free because it ships in client bundles (rendering/rsc imports it; the client esbuild alias for #veryfront/errors doesn't carry createError). The unreachable no-btoa/no-Buffer fallback now throws a plain Error instead of a registry error.
• bridge-modules.handler.ts ETag keeps its exact old value: first 16 digest bytes ≡ first 32 hex chars of computeHash.
• Intentionally skipped (semantics differ, documented): security-handler.ts CSP nonce (padded base64 of raw bytes), ssr-cache-manager.ts (size-thresholded hash fallback), channels/control-plane.ts (base64url digest, already partly canonical), workflow-executor.ts:829 (cancellable timeout, not a pure sleep).

Verification

• deno task verify:quick (manifests, fmt, full lint suite, typecheck): exit 0
• deno task test:unit: 2634 passed / 0 failed
• Pre-push hook (fmt + full test suite): passed

[Copilot]

Pull request overview

Consolidates repeated low-level helpers (SHA-256 hashing, sleep/delay, and base64/base64url encoding) into canonical implementations under #veryfront/utils, updating call sites across workflow, server, build, proxy, oauth, eval, and rendering to reduce duplication while keeping behavior consistent.

Changes:

• Replaced scattered crypto.subtle.digest SHA-256 helpers with computeHash / computeHashBytes.
• Replaced inline setTimeout-based delays with canonical sleep(ms, signal?).
• Centralized base64/base64url encoding with encodeBase64, base64urlEncode, and base64urlEncodeBytes, updating call sites accordingly.

Verification (as reported in PR description):

• deno task verify:quick: exit 0
• deno task test:unit: 2634 passed / 0 failed
• Pre-push hook: passed

Reviewed changes

Copilot reviewed 40 out of 41 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/workflow/worker/workflow-worker.ts	Uses canonical sleep and removes local sleep helper.
src/workflow/executor/workflow-executor.ts	Replaces inline polling delay with canonical sleep.
src/workflow/executor/dag/utils.ts	Removes local abort-aware sleep helper (moved to utils).
src/workflow/executor/dag/loop-node-strategy.ts	Switches DAG sleep import to #veryfront/utils.
src/workflow/executor/dag/composite-node-execution.ts	Switches DAG sleep import to #veryfront/utils.
src/workflow/claude-code/workspace-sync.ts	Replaces local SHA-256 checksum with computeHash.
src/workflow/blob/gcs-storage.ts	Replaces ad-hoc base64url helpers with canonical base64url utils.
src/utils/sleep.ts	Adds canonical abort-aware sleep(ms, signal?).
src/utils/index.ts	Re-exports new canonical hashing, base64/base64url, and sleep utilities.
src/utils/hash-utils.ts	Adds computeHashBytes and refactors hex encoding into shared helper.
src/utils/base64url.ts	Adds canonical base64/base64url encoding helpers.
src/transforms/mdx/compiler/import-rewriter.ts	Uses canonical base64urlEncode for browser FS path encoding.
src/studio/bridge/bridge-bundle.generated.ts	Regenerates studio bridge bundle after underlying utility consolidation.
src/server/services/rsc/orchestrators/stream-handler.ts	Removes local sleep helper in favor of canonical sleep.
src/server/services/rsc/endpoints/rsc-bundles.generated.ts	Regenerates RSC client bundles to use canonical base64 encoding logic.
src/server/project-env/fetcher.ts	Uses canonical encodeBase64 for basic auth header generation.
src/server/handlers/studio/bridge-modules.handler.ts	Uses computeHash to generate ETag consistently.
src/security/http/auth.ts	Removes local base64 implementation and uses canonical encodeBase64.
src/sandbox/lazy-sandbox.ts	Replaces polling delays with canonical sleep.
src/routing/api/module-loader/esbuild-plugin.ts	Replaces retry delay helper with canonical sleep.
src/rendering/orchestrator/module-loader/cache.ts	Replaces custom hashing with computeHash.
src/release-assets/index.ts	Stops exporting deleted release-asset-specific SHA helpers.
src/release-assets/hash.ts	Deletes duplicated SHA-256 helper module.
src/release-assets/build-executor.ts	Replaces release asset hashing with computeHashBytes.
src/proxy/server-resolver.ts	Uses canonical encodeBase64 for basic auth header generation.
src/proxy/routing-invalidation-redis.ts	Uses canonical base64urlEncodeBytes for signature encoding.
src/oauth/providers/base.ts	Uses canonical base64urlEncodeBytes for PKCE code challenge.
src/metrics/index.ts	Uses canonical encodeBase64 for internal metrics basic auth.
src/knowledge/index.ts	Uses canonical base64urlEncodeBytes for cursor encoding.
src/html/styles-builder/plugin-loader.ts	Uses canonical encodeBase64 for data URL module imports.
src/eval/report.ts	Replaces local SHA-256 hex helper with computeHash.
src/eval/provenance.ts	Replaces local string/bytes SHA-256 helpers with computeHash / computeHashBytes.
src/eval/agent-service/live-evals/api-client.ts	Uses canonical sleep via a wait helper.
src/eval/agent-service/durable-run-canaries/runner.ts	Removes local sleep helper in favor of canonical sleep.
src/discovery/transpiler.ts	Replaces local SHA-256 helper with computeHash for cache keys and dep verification.
src/build/vendor-cache.ts	Replaces local SHA-256 helper with computeHash for vendor cache keys.
src/build/production-build/local-release-assets.ts	Uses computeHashBytes for local release asset manifest signatures.
src/build/bundler/code-splitter/manifest-builder.ts	Uses computeHashBytes for chunk hashing.
src/agent/service/registration.ts	Uses computeHash for stable service keys.
src/agent/service/detached-run-tracker.ts	Removes local sleep helper in favor of canonical sleep.
src/agent/input/human-input.ts	Uses canonical sleep and removes local delay helper.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a4d6484d3d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[Copilot]

Pull request overview

Copilot reviewed 40 out of 41 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

src/utils/base64url.ts:42

• base64urlEncodeBytes calls btoa(binary) directly, which throws a ReferenceError in runtimes where btoa is not defined (for example, Node). Since encodeBase64 already supports a Buffer fallback, mirror that behavior here (and use globalThis.btoa for consistency).

[kojiwakayama]

Follow-ups on the post-merge review comments:

• UTF-8 corruption in plugin-loader data: URLs (Codex, P2) — confirmed as a real behavior change introduced here: the old local helper always UTF-8-encoded plugin source, while encodeBase64's btoa-first path emits Latin-1 bytes for chars in [0x80–0xFF]. Fixed in refactor(utils): canonical subscriber-set observable plus exact-dupe cleanups #3047 via a new encodeBase64Bytes + explicit TextEncoder at the call site.
• Bare btoa in base64urlEncodeBytes (Copilot) — also fixed in refactor(utils): canonical subscriber-set observable plus exact-dupe cleanups #3047; it now shares the fallback-safe path (btoa → Buffer → clear error).
• Restore sha256Hex/sha256HexBytes re-exports from veryfront/release-assets (Codex, P2) — declining: the project is pre-release with an explicit no-backward-compatibility stance, and every consumer was migrated in this PR (verified by typecheck + full suite). Keeping alias re-exports would preserve exactly the duplication this campaign removes.