From 252b03cc1fce3f4e7386cf6c9c5d4024d635f3ef Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Sun, 1 Nov 2026 18:21:56 -0800 Subject: [PATCH 01/11] chore(quest): claim quest/m1/prune-deps.md Quest-Claim: 3fe26016321a49bb From 4502f065c56ac3b67d418f5e16bac9db3c463187 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Sun, 1 Nov 2026 18:31:20 -0800 Subject: [PATCH 02/11] chore(js): remove rimraf from package builds Use the shell removal command supported by Bun instead of starting a package for each build. Co-Authored-By: GPT-6.1 Sol --- bun.lock | 20 -------------------- js/auth/package.json | 3 +-- js/clock/package.json | 3 +-- js/e2ee/package.json | 3 +-- js/hang/package.json | 3 +-- js/json/package.json | 3 +-- js/loc/package.json | 3 +-- js/moq-boy/package.json | 3 +-- js/msf/package.json | 3 +-- js/net/package.json | 3 +-- js/p2p/package.json | 3 +-- js/pattern/package.json | 3 +-- js/publish/package.json | 3 +-- js/qmux/package.json | 3 +-- js/room/package.json | 3 +-- js/sign/package.json | 3 +-- js/signals/package.json | 3 +-- js/ui/package.json | 3 +-- js/video/package.json | 3 +-- js/watch/package.json | 3 +-- 20 files changed, 19 insertions(+), 58 deletions(-) diff --git a/bun.lock b/bun.lock index 436ff2f339d..955cb7d11c8 100644 --- a/bun.lock +++ b/bun.lock @@ -150,7 +150,6 @@ "devDependencies": { "@types/bun": "^1.4.4", "@types/node": "^26.6.4", - "rimraf": "^6.1.3", "typescript": "7.0.2", }, }, @@ -159,7 +158,6 @@ "version": "0.1.0", "devDependencies": { "@types/bun": "^1.4.4", - "rimraf": "^6.1.3", "typescript": "7.0.2", }, }, @@ -172,7 +170,6 @@ "devDependencies": { "@moq/clock": "workspace:^", "@types/bun": "^1.4.4", - "rimraf": "^6.1.3", "typescript": "7.0.2", }, }, @@ -193,7 +190,6 @@ "devDependencies": { "@types/bun": "^1.4.4", "@typescript/lib-dom": "npm:@types/web@^0.0.358", - "rimraf": "^6.1.3", "typescript": "7.0.2", }, }, @@ -208,7 +204,6 @@ "@moq/clock": "workspace:^", "@types/bun": "^1.4.4", "fast-check": "^4.10.2", - "rimraf": "^6.1.3", "typescript": "7.0.2", }, "peerDependencies": { @@ -236,7 +231,6 @@ }, "devDependencies": { "@types/bun": "^1.4.4", - "rimraf": "^6.1.3", "typescript": "7.0.2", }, }, @@ -255,7 +249,6 @@ "devDependencies": { "@types/bun": "^1.4.4", "esbuild": "^0.28.2", - "rimraf": "^6.1.3", "solid-js": "^1.9.17", "typescript": "7.0.2", "vite": "^8.3.5", @@ -272,7 +265,6 @@ "zod": "^4.6.7", }, "devDependencies": { - "rimraf": "^6.1.3", "typescript": "7.0.2", }, }, @@ -294,7 +286,6 @@ "@types/node": "^26.6.4", "@typescript/lib-dom": "npm:@types/web@^0.0.358", "fast-check": "^4.10.2", - "rimraf": "^6.1.3", "typescript": "7.0.2", }, "peerDependencies": { @@ -311,7 +302,6 @@ "devDependencies": { "@types/bun": "^1.4.4", "@typescript/lib-dom": "npm:@types/web@^0.0.358", - "rimraf": "^6.1.3", "typescript": "7.0.2", }, }, @@ -320,7 +310,6 @@ "version": "0.2.1", "devDependencies": { "@types/bun": "^1.4.4", - "rimraf": "^6.1.3", "typescript": "7.0.2", }, }, @@ -341,7 +330,6 @@ "@types/audioworklet": "^0.0.100", "@types/bun": "^1.4.4", "@typescript/lib-dom": "npm:@types/web@^0.0.358", - "rimraf": "^6.1.3", "rolldown": "^1.2.15", "typescript": "7.0.2", "vite": "^8.3.5", @@ -356,7 +344,6 @@ "devDependencies": { "@types/bun": "^1.4.4", "@typescript/lib-dom": "npm:@types/web@^0.0.358", - "rimraf": "^6.1.3", "typescript": "7.0.2", }, }, @@ -376,7 +363,6 @@ "@types/audioworklet": "^0.0.100", "@types/bun": "^1.4.4", "@typescript/lib-dom": "npm:@types/web@^0.0.358", - "rimraf": "^6.1.3", "typescript": "7.0.2", "vite": "^8.3.5", }, @@ -390,7 +376,6 @@ "devDependencies": { "@moq/clock": "workspace:^", "@types/bun": "^1.4.4", - "rimraf": "^6.1.3", "typescript": "7.0.2", }, }, @@ -408,7 +393,6 @@ "fast-check": "^4.10.2", "react": "^19.3.1", "react-dom": "^19.3.1", - "rimraf": "^6.1.3", "solid-js": "^1.9.17", "typescript": "7.0.2", }, @@ -432,7 +416,6 @@ "devDependencies": { "@types/bun": "^1.4.4", "@typescript/lib-dom": "npm:@types/web@^0.0.358", - "rimraf": "^6.1.3", "typescript": "7.0.2", "vite": "^8.3.5", }, @@ -447,7 +430,6 @@ "@moq/clock": "workspace:^", "@types/bun": "^1.4.4", "@typescript/lib-dom": "npm:@types/web@^0.0.358", - "rimraf": "^6.1.3", "typescript": "7.0.2", }, }, @@ -469,7 +451,6 @@ "@types/audioworklet": "^0.0.100", "@types/bun": "^1.4.4", "@typescript/lib-dom": "npm:@types/web@^0.0.358", - "rimraf": "^6.1.3", "rolldown": "^1.2.15", "typescript": "7.0.2", "vite": "^8.3.5", @@ -1900,7 +1881,6 @@ "rfdc": ["rfdc@1.4.1", "", {}, "sha512-q1b3N5QkRUWUl7iyylaaj3kOpIT0N2i9MqIEQXP73GVsN9cw3fdx8X63cEmWhJGi2PPCF23Ijp7ktmd39rawIA=="], - "rimraf": ["rimraf@6.1.3", "", { "dependencies": { "glob": "^13.0.3", "package-json-from-dist": "^1.0.1" }, "bin": { "rimraf": "dist/esm/bin.mjs" } }, "sha512-LKg+Cr2ZF61fkcaK1UdkH2yEBBKnYjTyWzTJT6KNPcSPaiT7HSdhtMXQuN5wkTX0Xu72KQ1l8S42rlmexS2hSA=="], "rolldown": ["rolldown@1.2.15", "", { "dependencies": { "@oxc-project/types": "=0.155.0", "@rolldown/pluginutils": "^1.0.0" }, "optionalDependencies": { "@rolldown/binding-android-arm-eabi": "1.2.15", "@rolldown/binding-android-arm64": "1.2.15", "@rolldown/binding-darwin-arm64": "1.2.15", "@rolldown/binding-darwin-x64": "1.2.15", "@rolldown/binding-freebsd-x64": "1.2.15", "@rolldown/binding-linux-arm-gnueabihf": "1.2.15", "@rolldown/binding-linux-arm64-gnu": "1.2.15", "@rolldown/binding-linux-arm64-musl": "1.2.15", "@rolldown/binding-linux-ppc64-gnu": "1.2.15", "@rolldown/binding-linux-s390x-gnu": "1.2.15", "@rolldown/binding-linux-x64-gnu": "1.2.15", "@rolldown/binding-linux-x64-musl": "1.2.15", "@rolldown/binding-openharmony-arm64": "1.2.15", "@rolldown/binding-win32-arm64-msvc": "1.2.15", "@rolldown/binding-win32-x64-msvc": "1.2.15" }, "bin": { "rolldown": "./bin/cli.mjs" } }, "sha512-6odND+fel5zVw3I4Yc2e69gvguDnX0CAAGiNDZSq4ik5WUcaLrkD2GLuog0XcODbor31hZ5ayEMgVDno+KPV5g=="], diff --git a/js/auth/package.json b/js/auth/package.json index e024747aac7..152cd1ecc43 100644 --- a/js/auth/package.json +++ b/js/auth/package.json @@ -17,7 +17,7 @@ "moq-auth": "./src/cli.ts" }, "scripts": { - "build": "rimraf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", + "build": "rm -rf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", "check": "tsc --noEmit && tsc -b examples/tsconfig.json", "test": "bun test --only-failures", "release": "bun ../common/release.ts" @@ -33,7 +33,6 @@ "devDependencies": { "@types/bun": "^1.4.4", "@types/node": "^26.6.4", - "rimraf": "^6.1.3", "typescript": "7.0.2" } } diff --git a/js/clock/package.json b/js/clock/package.json index fe5a2c7c540..263b07f7aac 100644 --- a/js/clock/package.json +++ b/js/clock/package.json @@ -14,14 +14,13 @@ ".": "./src/index.ts" }, "scripts": { - "build": "rimraf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", + "build": "rm -rf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", "check": "tsc --noEmit", "test": "bun test --only-failures", "release": "bun ../common/release.ts" }, "devDependencies": { "@types/bun": "^1.4.4", - "rimraf": "^6.1.3", "typescript": "7.0.2" } } diff --git a/js/e2ee/package.json b/js/e2ee/package.json index 74741728493..44e01ed09c4 100644 --- a/js/e2ee/package.json +++ b/js/e2ee/package.json @@ -15,7 +15,7 @@ ".": "./src/index.ts" }, "scripts": { - "build": "rimraf dist && tsc -b tsconfig.build.json && bun ../common/package.ts && tsc --project test-dts/tsconfig.json", + "build": "rm -rf dist && tsc -b tsconfig.build.json && bun ../common/package.ts && tsc --project test-dts/tsconfig.json", "check": "tsc --noEmit && tsc --noEmit --project bench/tsconfig.json", "test": "bun test --only-failures" }, @@ -25,7 +25,6 @@ "devDependencies": { "@moq/clock": "workspace:^", "@types/bun": "^1.4.4", - "rimraf": "^6.1.3", "typescript": "7.0.2" } } diff --git a/js/hang/package.json b/js/hang/package.json index 1a0f714d2c8..d80890fc9b6 100644 --- a/js/hang/package.json +++ b/js/hang/package.json @@ -18,7 +18,7 @@ "./util": "./src/util/index.ts" }, "scripts": { - "build": "rimraf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", + "build": "rm -rf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", "check": "tsc --noEmit", "test": "bun test --only-failures", "release": "bun ../common/release.ts" @@ -37,7 +37,6 @@ "devDependencies": { "@types/bun": "^1.4.4", "@typescript/lib-dom": "npm:@types/web@^0.0.358", - "rimraf": "^6.1.3", "typescript": "7.0.2" } } diff --git a/js/json/package.json b/js/json/package.json index bc27fae32c5..a175ae6ed0c 100644 --- a/js/json/package.json +++ b/js/json/package.json @@ -14,7 +14,7 @@ ".": "./src/index.ts" }, "scripts": { - "build": "rimraf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", + "build": "rm -rf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", "check": "tsc --noEmit", "test": "bun test --only-failures", "release": "bun ../common/release.ts" @@ -31,7 +31,6 @@ "@moq/clock": "workspace:^", "@types/bun": "^1.4.4", "fast-check": "^4.10.2", - "rimraf": "^6.1.3", "typescript": "7.0.2" } } diff --git a/js/loc/package.json b/js/loc/package.json index 96bcebe0b94..76683c51f34 100644 --- a/js/loc/package.json +++ b/js/loc/package.json @@ -14,7 +14,7 @@ }, "sideEffects": false, "scripts": { - "build": "rimraf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", + "build": "rm -rf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", "check": "tsc --noEmit && bun test", "release": "bun ../common/release.ts" }, @@ -24,7 +24,6 @@ }, "devDependencies": { "@types/bun": "^1.4.4", - "rimraf": "^6.1.3", "typescript": "7.0.2" } } diff --git a/js/moq-boy/package.json b/js/moq-boy/package.json index a2db5ad6562..0ad9eaa1324 100644 --- a/js/moq-boy/package.json +++ b/js/moq-boy/package.json @@ -18,7 +18,7 @@ "./src/element.tsx" ], "scripts": { - "build": "rimraf dist && vite build && tsc -p tsconfig.build.json && bun ../common/package.ts", + "build": "rm -rf dist && vite build && tsc -p tsconfig.build.json && bun ../common/package.ts", "check": "tsc --noEmit", "test": "bun test --only-failures", "release": "bun ../common/release.ts" @@ -36,7 +36,6 @@ "devDependencies": { "@types/bun": "^1.4.4", "esbuild": "^0.28.2", - "rimraf": "^6.1.3", "solid-js": "^1.9.17", "typescript": "7.0.2", "vite": "^8.3.5", diff --git a/js/msf/package.json b/js/msf/package.json index 56b7fb01269..90b9ad50d21 100644 --- a/js/msf/package.json +++ b/js/msf/package.json @@ -14,7 +14,7 @@ }, "sideEffects": false, "scripts": { - "build": "rimraf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", + "build": "rm -rf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", "check": "tsc --noEmit", "test": "bun test --only-failures", "release": "bun ../common/release.ts" @@ -26,7 +26,6 @@ "zod": "^4.6.7" }, "devDependencies": { - "rimraf": "^6.1.3", "typescript": "7.0.2" } } diff --git a/js/net/package.json b/js/net/package.json index 6591ca9c347..e0f1997f2e1 100644 --- a/js/net/package.json +++ b/js/net/package.json @@ -15,7 +15,7 @@ "./zod": "./src/zod.ts" }, "scripts": { - "build": "rimraf dist && tsc -b tsconfig.build.json && bun ../common/package.ts && tsc --project test-dts/tsconfig.json", + "build": "rm -rf dist && tsc -b tsconfig.build.json && bun ../common/package.ts && tsc --project test-dts/tsconfig.json", "check": "tsc --noEmit && tsc -b examples/tsconfig.json && tsc --noEmit --project bench/tsconfig.json", "test": "bun test --only-failures", "release": "bun ../common/release.ts" @@ -39,7 +39,6 @@ "@types/node": "^26.6.4", "@typescript/lib-dom": "npm:@types/web@^0.0.358", "fast-check": "^4.10.2", - "rimraf": "^6.1.3", "typescript": "7.0.2" } } diff --git a/js/p2p/package.json b/js/p2p/package.json index bf1d9410e3b..f3e47c513f6 100644 --- a/js/p2p/package.json +++ b/js/p2p/package.json @@ -14,7 +14,7 @@ ".": "./src/index.ts" }, "scripts": { - "build": "rimraf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", + "build": "rm -rf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", "check": "tsc --noEmit && tsc --noEmit --project bench/tsconfig.json", "test": "bun test --only-failures" }, @@ -24,7 +24,6 @@ "devDependencies": { "@types/bun": "^1.4.4", "@typescript/lib-dom": "npm:@types/web@^0.0.358", - "rimraf": "^6.1.3", "typescript": "7.0.2" }, "private": true diff --git a/js/pattern/package.json b/js/pattern/package.json index 0dbd1fe42e0..6dde31ad6c7 100644 --- a/js/pattern/package.json +++ b/js/pattern/package.json @@ -14,14 +14,13 @@ ".": "./src/index.ts" }, "scripts": { - "build": "rimraf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", + "build": "rm -rf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", "check": "tsc --noEmit", "test": "bun test --only-failures", "release": "bun ../common/release.ts" }, "devDependencies": { "@types/bun": "^1.4.4", - "rimraf": "^6.1.3", "typescript": "7.0.2" } } diff --git a/js/publish/package.json b/js/publish/package.json index a51357a19fe..62517863d0b 100644 --- a/js/publish/package.json +++ b/js/publish/package.json @@ -23,7 +23,7 @@ "./src/support/element.ts" ], "scripts": { - "build": "rimraf dist && vite build && tsc -p tsconfig.build.json && bun ../common/package.ts && tsc --project test-dts/tsconfig.json", + "build": "rm -rf dist && vite build && tsc -p tsconfig.build.json && bun ../common/package.ts && tsc --project test-dts/tsconfig.json", "check": "tsc --noEmit", "test": "bun test --pass-with-no-tests", "release": "bun ../common/release.ts" @@ -42,7 +42,6 @@ "@types/audioworklet": "^0.0.100", "@types/bun": "^1.4.4", "@typescript/lib-dom": "npm:@types/web@^0.0.358", - "rimraf": "^6.1.3", "rolldown": "^1.2.15", "typescript": "7.0.2", "vite": "^8.3.5" diff --git a/js/qmux/package.json b/js/qmux/package.json index 17b85f1b006..8ee6ab962cc 100644 --- a/js/qmux/package.json +++ b/js/qmux/package.json @@ -14,7 +14,7 @@ ".": "./src/index.ts" }, "scripts": { - "build": "rimraf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", + "build": "rm -rf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", "check": "tsc --noEmit", "test": "bun test --only-failures", "release": "bun ../common/release.ts" @@ -25,7 +25,6 @@ "devDependencies": { "@types/bun": "^1.4.4", "@typescript/lib-dom": "npm:@types/web@^0.0.358", - "rimraf": "^6.1.3", "typescript": "7.0.2" }, "keywords": [ diff --git a/js/room/package.json b/js/room/package.json index 7139168f430..c55851390e6 100644 --- a/js/room/package.json +++ b/js/room/package.json @@ -14,7 +14,7 @@ ".": "./src/index.ts" }, "scripts": { - "build": "rimraf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", + "build": "rm -rf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", "check": "tsc --noEmit", "test": "bun test --only-failures", "release": "bun ../common/release.ts" @@ -32,7 +32,6 @@ "@types/audioworklet": "^0.0.100", "@types/bun": "^1.4.4", "@typescript/lib-dom": "npm:@types/web@^0.0.358", - "rimraf": "^6.1.3", "typescript": "7.0.2", "vite": "^8.3.5" } diff --git a/js/sign/package.json b/js/sign/package.json index e2203a71745..4fa00d26eff 100644 --- a/js/sign/package.json +++ b/js/sign/package.json @@ -15,7 +15,7 @@ ".": "./src/index.ts" }, "scripts": { - "build": "rimraf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", + "build": "rm -rf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", "check": "tsc --noEmit", "test": "bun test --only-failures" }, @@ -25,7 +25,6 @@ "devDependencies": { "@moq/clock": "workspace:^", "@types/bun": "^1.4.4", - "rimraf": "^6.1.3", "typescript": "7.0.2" } } diff --git a/js/signals/package.json b/js/signals/package.json index a39687d39bf..328acafd1e3 100644 --- a/js/signals/package.json +++ b/js/signals/package.json @@ -17,7 +17,7 @@ "./dom": "./src/dom.ts" }, "scripts": { - "build": "rimraf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", + "build": "rm -rf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", "check": "tsc --noEmit", "test": "bun test --only-failures", "release": "bun ../common/release.ts" @@ -30,7 +30,6 @@ "fast-check": "^4.10.2", "react": "^19.3.1", "react-dom": "^19.3.1", - "rimraf": "^6.1.3", "solid-js": "^1.9.17", "typescript": "7.0.2" }, diff --git a/js/ui/package.json b/js/ui/package.json index 88efbb2f333..d35d6aa14b2 100644 --- a/js/ui/package.json +++ b/js/ui/package.json @@ -16,7 +16,7 @@ }, "sideEffects": false, "scripts": { - "build": "rimraf dist && vite build && tsc -p tsconfig.build.json && bun ../common/package.ts", + "build": "rm -rf dist && vite build && tsc -p tsconfig.build.json && bun ../common/package.ts", "check": "tsc --noEmit", "test": "bun test --pass-with-no-tests", "release": "bun ../common/release.ts" @@ -27,7 +27,6 @@ "devDependencies": { "@types/bun": "^1.4.4", "@typescript/lib-dom": "npm:@types/web@^0.0.358", - "rimraf": "^6.1.3", "typescript": "7.0.2", "vite": "^8.3.5" } diff --git a/js/video/package.json b/js/video/package.json index 70a0f1efa3b..218f573cd70 100644 --- a/js/video/package.json +++ b/js/video/package.json @@ -14,7 +14,7 @@ ".": "./src/index.ts" }, "scripts": { - "build": "rimraf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", + "build": "rm -rf dist && tsc -b tsconfig.build.json && bun ../common/package.ts", "check": "tsc --noEmit", "test": "bun test --only-failures", "release": "bun ../common/release.ts" @@ -26,7 +26,6 @@ "@moq/clock": "workspace:^", "@types/bun": "^1.4.4", "@typescript/lib-dom": "npm:@types/web@^0.0.358", - "rimraf": "^6.1.3", "typescript": "7.0.2" } } diff --git a/js/watch/package.json b/js/watch/package.json index cf2cb784fd9..a95cd0290c2 100644 --- a/js/watch/package.json +++ b/js/watch/package.json @@ -23,7 +23,7 @@ "./src/support/element.ts" ], "scripts": { - "build": "rimraf dist && vite build && tsc -p tsconfig.build.json && bun ../common/package.ts && tsc --project test-dts/tsconfig.json", + "build": "rm -rf dist && vite build && tsc -p tsconfig.build.json && bun ../common/package.ts && tsc --project test-dts/tsconfig.json", "check": "tsc --noEmit", "test": "bun test --only-failures", "release": "bun ../common/release.ts" @@ -43,7 +43,6 @@ "@types/audioworklet": "^0.0.100", "@types/bun": "^1.4.4", "@typescript/lib-dom": "npm:@types/web@^0.0.358", - "rimraf": "^6.1.3", "rolldown": "^1.2.15", "typescript": "7.0.2", "vite": "^8.3.5" From cab82fafe03c2e17bab916f86e533f7f40805a42 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Sun, 1 Nov 2026 18:31:21 -0800 Subject: [PATCH 03/11] refactor(hang): parse AV1 codec fields without regex Reuse codec_number and fixed byte patterns for the fixed codec grammar. Keep malformed optional groups refused and benchmark the parser in the nightly catalog target. Co-Authored-By: GPT-6.1 Sol --- Cargo.lock | 1 - rs/hang/Cargo.toml | 1 - rs/hang/src/catalog/video/av1.rs | 91 +++++++++++++++++++------------- rs/moq-mux/benches/catalog.rs | 17 +++++- 4 files changed, 71 insertions(+), 39 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 226a8403257..bdb111e4502 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3669,7 +3669,6 @@ dependencies = [ "moq-mux", "moq-net", "moq-tokio", - "regex", "serde", "serde_json", "serde_with", diff --git a/rs/hang/Cargo.toml b/rs/hang/Cargo.toml index 3370a7768dc..e098be54321 100644 --- a/rs/hang/Cargo.toml +++ b/rs/hang/Cargo.toml @@ -18,7 +18,6 @@ hex = { workspace = true } kio = { workspace = true, features = ["runtime"] } moq-json = { workspace = true } moq-net = { workspace = true } -regex = "1" serde = { workspace = true } serde_json = { workspace = true } serde_with = { workspace = true, features = ["base64"] } diff --git a/rs/hang/src/catalog/video/av1.rs b/rs/hang/src/catalog/video/av1.rs index 8f030e485ea..3c4f11db12f 100644 --- a/rs/hang/src/catalog/video/av1.rs +++ b/rs/hang/src/catalog/video/av1.rs @@ -79,54 +79,54 @@ impl std::fmt::Display for AV1 { } } -static AV1_REGEX: std::sync::LazyLock = std::sync::LazyLock::new(|| { - regex::Regex::new( - &r" - ^av01 - \.(?[0-2]) - \.(?[0-9]{2})(?[MH]) - \.(?[0-9]{2}) - (? - \.(?[01]) - \.(?[01])(?[01])(?[0-3]) - \.(?[0-9]{2}) - \.(?[0-9]{2}) - \.(?[0-9]{2}) - \.(?[01]) - )? - $" - .replace(['\n', ' ', '\t'], ""), - ) - .unwrap() -}); - impl std::str::FromStr for AV1 { type Err = Error; fn from_str(s: &str) -> Result { - let captures = AV1_REGEX.captures(s).ok_or(Error::InvalidCodec)?; + fn number(field: Option<&str>, width: usize, max: u8) -> Result { + let field = field.filter(|field| field.len() == width).ok_or(Error::InvalidCodec)?; + let value = crate::catalog::codec_number(field, 10)?; + if value > max { + return Err(Error::InvalidCodec); + } + Ok(value) + } + let mut fields = s.strip_prefix("av01.").ok_or(Error::InvalidCodec)?.split('.'); + let profile = number(fields.next(), 1, 2)?; + let [tens @ b'0'..=b'9', ones @ b'0'..=b'9', tier @ (b'M' | b'H')] = + fields.next().ok_or(Error::InvalidCodec)?.as_bytes() + else { + return Err(Error::InvalidCodec); + }; let mut av1 = AV1 { - profile: u8::from_str(&captures["profile"])?, - level: u8::from_str(&captures["level"])?, - tier: captures["tier"].chars().next().unwrap(), - bitdepth: u8::from_str(&captures["bitdepth"])?, + profile, + level: (tens - b'0') * 10 + (ones - b'0'), + tier: char::from(*tier), + bitdepth: number(fields.next(), 2, 99)?, ..Default::default() }; - if captures.name("extra").is_none() { + let Some(mono) = fields.next() else { return Ok(av1); + }; + av1.mono_chrome = number(Some(mono), 1, 1)? == 1; + let [x @ b'0'..=b'1', y @ b'0'..=b'1', position @ b'0'..=b'3'] = + fields.next().ok_or(Error::InvalidCodec)?.as_bytes() + else { + return Err(Error::InvalidCodec); + }; + av1.chroma_subsampling_x = *x == b'1'; + av1.chroma_subsampling_y = *y == b'1'; + av1.chroma_sample_position = position - b'0'; + av1.color_primaries = number(fields.next(), 2, 99)?; + av1.transfer_characteristics = number(fields.next(), 2, 99)?; + av1.matrix_coefficients = number(fields.next(), 2, 99)?; + av1.full_range = number(fields.next(), 1, 1)? == 1; + if fields.next().is_some() { + return Err(Error::InvalidCodec); } - av1.mono_chrome = &captures["mono"] == "1"; - av1.chroma_subsampling_x = &captures["chroma_subsampling_x"] == "1"; - av1.chroma_subsampling_y = &captures["chroma_subsampling_y"] == "1"; - av1.chroma_sample_position = u8::from_str(&captures["chroma_sample_position"])?; - av1.color_primaries = u8::from_str(&captures["color"])?; - av1.transfer_characteristics = u8::from_str(&captures["transfer"])?; - av1.matrix_coefficients = u8::from_str(&captures["matrix"])?; - av1.full_range = &captures["full"] == "1"; - Ok(av1) } } @@ -226,6 +226,25 @@ mod test { } } + #[test] + fn field_boundaries() { + for encoded in [ + "av01.0.04M.08.", + "av01.0.04M.08.0.110", + "av01.0.04M.08.0.110.01.01.01.0.extra", + "av01.0.04M.08.2.110.01.01.01.0", + "av01.0.04M.08.0.210.01.01.01.0", + "av01.0.04M.08.0.114.01.01.01.0", + "av01.0.04M.08.0.110.01.01.01.2", + "av01.0.04M.+8", + "av01.0.04M.٠٨", + "av01.0.04M.08\n", + "av01.0.04M.08.0.110.1.01.01.0", + ] { + assert!(AV1::from_str(encoded).is_err(), "{encoded:?}"); + } + } + #[test] fn test_av1_invalid_profile() { for profile in 3..=9 { diff --git a/rs/moq-mux/benches/catalog.rs b/rs/moq-mux/benches/catalog.rs index 279c1d51f5f..eed1dc99221 100644 --- a/rs/moq-mux/benches/catalog.rs +++ b/rs/moq-mux/benches/catalog.rs @@ -273,10 +273,25 @@ fn bench_write_order(c: &mut Criterion) { group.finish(); } +fn bench_av1_codec(c: &mut Criterion) { + let mut group = c.benchmark_group("catalog_av1_codec"); + for (name, codec) in [ + ("short", "av01.0.01M.08"), + ("full", "av01.0.04M.10.0.112.09.16.09.0"), + ("partial", "av01.0.04M.08.0.110"), + ] { + group.bench_function(name, |b| { + b.iter(|| black_box(black_box(codec).parse::())) + }); + } + group.finish(); +} + criterion_group!( benches, bench_estimate_fanout, bench_unresolved_teardown, - bench_write_order + bench_write_order, + bench_av1_codec ); criterion_main!(benches); From 264ad77dfef6d9986521754b5e193326659b9c70 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Sun, 1 Nov 2026 18:35:47 -0800 Subject: [PATCH 04/11] refactor(js): use zod mini without its wrapper package Import zod/mini directly and retain zod in every runtime and peer dependency list. Refresh type entrypoint reports against the built packages. Co-Authored-By: GPT-6.1 Sol --- bun.lock | 8 ----- js/auth/api/index.api.md | 40 ++++++++++----------- js/auth/package.json | 1 - js/auth/src/algorithm.ts | 2 +- js/auth/src/claims.ts | 2 +- js/auth/src/contract.ts | 2 +- js/auth/src/key.ts | 2 +- js/auth/src/set.ts | 2 +- js/hang/api/catalog.api.md | 40 ++++++++++----------- js/hang/api/index.api.md | 20 +++++------ js/hang/package.json | 1 - js/hang/src/catalog/audio.ts | 2 +- js/hang/src/catalog/clock.ts | 2 +- js/hang/src/catalog/container.ts | 2 +- js/hang/src/catalog/contribution.ts | 2 +- js/hang/src/catalog/echo.ts | 2 +- js/hang/src/catalog/hex.ts | 2 +- js/hang/src/catalog/hls.ts | 2 +- js/hang/src/catalog/integers.ts | 2 +- js/hang/src/catalog/path.ts | 2 +- js/hang/src/catalog/root.test.ts | 2 +- js/hang/src/catalog/root.ts | 2 +- js/hang/src/catalog/stats.ts | 2 +- js/hang/src/catalog/track.ts | 2 +- js/hang/src/catalog/video.ts | 2 +- js/hang/src/echo.ts | 2 +- js/hang/src/hls.ts | 2 +- js/hang/src/snapshot.ts | 2 +- js/hang/src/stats.test.ts | 2 +- js/hang/src/stats.ts | 2 +- js/json/api/index.api.md | 2 +- js/json/package.json | 1 - js/json/src/snapshot/encoder.ts | 2 +- js/json/src/stream/codec.test.ts | 2 +- js/json/src/stream/encoder.ts | 2 +- js/json/src/stream/stream.test.ts | 2 +- js/moq-boy/api/index.api.md | 14 ++++---- js/moq-boy/package.json | 1 - js/moq-boy/src/schemas.ts | 2 +- js/msf/api/index.api.md | 22 ++++++------ js/msf/package.json | 1 - js/msf/src/catalog.ts | 2 +- js/net/api/index.api.md | 4 +-- js/net/api/zod.api.md | 2 +- js/net/package.json | 1 - js/net/src/zod.test.ts | 2 +- js/net/src/zod.ts | 2 +- test/interop/clients/js-native/package.json | 1 - 48 files changed, 104 insertions(+), 119 deletions(-) diff --git a/bun.lock b/bun.lock index 955cb7d11c8..2d7a628f00c 100644 --- a/bun.lock +++ b/bun.lock @@ -142,7 +142,6 @@ "dependencies": { "@moq/clock": "workspace:^", "@moq/pattern": "workspace:^", - "@zod/mini": "^4.6.7", "commander": "^15.0.0", "jose": "^6.2.13", "zod": "^4.6.7", @@ -184,7 +183,6 @@ "@moq/loc": "workspace:^", "@moq/net": "workspace:^", "@moq/signals": "workspace:^", - "@zod/mini": "^4.6.7", "zod": "^4.6.7", }, "devDependencies": { @@ -207,7 +205,6 @@ "typescript": "7.0.2", }, "peerDependencies": { - "@zod/mini": "^4.5.0", "zod": "^4.5.0", }, }, @@ -243,7 +240,6 @@ "@moq/net": "workspace:^", "@moq/signals": "workspace:^", "@moq/watch": "workspace:^", - "@zod/mini": "^4.6.7", "zod": "^4.6.7", }, "devDependencies": { @@ -261,7 +257,6 @@ "dependencies": { "@moq/json": "workspace:^", "@moq/net": "workspace:^", - "@zod/mini": "^4.6.7", "zod": "^4.6.7", }, "devDependencies": { @@ -289,7 +284,6 @@ "typescript": "7.0.2", }, "peerDependencies": { - "@zod/mini": "^4.5.0", "zod": "^4.5.0", }, }, @@ -504,7 +498,6 @@ "@moq/json": "workspace:*", "@moq/net": "workspace:*", "@moq/web-transport": "^0.1.6", - "@zod/mini": "^4.6.7", "zod": "^4.6.7", }, "devDependencies": { @@ -1257,7 +1250,6 @@ "@xtuc/long": ["@xtuc/long@4.2.2", "", {}, "sha512-NuHqBY1PB/D8xU6s/thBgOAiAP7HOYDQ32+BFZILJ8ivkUkAHQnWfn6WhL79Owj1qmUnoN/YPhktdIoucipkAQ=="], - "@zod/mini": ["@zod/mini@4.6.7", "", { "peerDependencies": { "zod": "^4.6.0" } }, "sha512-oLORzy4OERpr+gaITCsrCK9uDWd9lOCLG00fRZEJidVITLS5SQtifmzP6fBSFH9YxkXFoT6/o4bRZDq2tTHrog=="], "abbrev": ["abbrev@2.0.0", "", {}, "sha512-6/mh1E2u2YgEsCHdY0Yx5oW+61gZU+1vXaoiHHrpKeuRNNgFvS+/jrwHiQhB5apAf5oB7UB7E19ol2R2LKH8hQ=="], diff --git a/js/auth/api/index.api.md b/js/auth/api/index.api.md index d8321776b27..5b851ba9ea4 100644 --- a/js/auth/api/index.api.md +++ b/js/auth/api/index.api.md @@ -3,26 +3,26 @@ ```ts import { $strict } from "zod/v4/core"; import { $strip } from "zod/v4/core"; -import { ZodMiniArray } from "@zod/mini"; -import { ZodMiniBoolean } from "@zod/mini"; -import { ZodMiniCatch } from "@zod/mini"; -import { ZodMiniDefault } from "@zod/mini"; -import { ZodMiniDiscriminatedUnion } from "@zod/mini"; -import { ZodMiniEnum } from "@zod/mini"; -import { ZodMiniInt } from "@zod/mini"; -import { ZodMiniLiteral } from "@zod/mini"; -import { ZodMiniNever } from "@zod/mini"; -import { ZodMiniNumber } from "@zod/mini"; -import { ZodMiniObject } from "@zod/mini"; -import { ZodMiniOptional } from "@zod/mini"; -import { ZodMiniPipe } from "@zod/mini"; -import { ZodMiniRecord } from "@zod/mini"; -import { ZodMiniString } from "@zod/mini"; -import { ZodMiniTransform } from "@zod/mini"; -import { ZodMiniUnion } from "@zod/mini"; -import { ZodMiniUnknown } from "@zod/mini"; -import { infer } from "@zod/mini"; -import { output } from "@zod/mini"; +import { ZodMiniArray } from "zod/mini"; +import { ZodMiniBoolean } from "zod/mini"; +import { ZodMiniCatch } from "zod/mini"; +import { ZodMiniDefault } from "zod/mini"; +import { ZodMiniDiscriminatedUnion } from "zod/mini"; +import { ZodMiniEnum } from "zod/mini"; +import { ZodMiniInt } from "zod/mini"; +import { ZodMiniLiteral } from "zod/mini"; +import { ZodMiniNever } from "zod/mini"; +import { ZodMiniNumber } from "zod/mini"; +import { ZodMiniObject } from "zod/mini"; +import { ZodMiniOptional } from "zod/mini"; +import { ZodMiniPipe } from "zod/mini"; +import { ZodMiniRecord } from "zod/mini"; +import { ZodMiniString } from "zod/mini"; +import { ZodMiniTransform } from "zod/mini"; +import { ZodMiniUnion } from "zod/mini"; +import { ZodMiniUnknown } from "zod/mini"; +import { infer } from "zod/mini"; +import { output } from "zod/mini"; export type Algorithm = infer; diff --git a/js/auth/package.json b/js/auth/package.json index 152cd1ecc43..41b1b740193 100644 --- a/js/auth/package.json +++ b/js/auth/package.json @@ -25,7 +25,6 @@ "dependencies": { "@moq/clock": "workspace:^", "@moq/pattern": "workspace:^", - "@zod/mini": "^4.6.7", "commander": "^15.0.0", "jose": "^6.2.13", "zod": "^4.6.7" diff --git a/js/auth/src/algorithm.ts b/js/auth/src/algorithm.ts index 1e0197dcde5..acaa9a6ee24 100644 --- a/js/auth/src/algorithm.ts +++ b/js/auth/src/algorithm.ts @@ -1,4 +1,4 @@ -import * as z from "@zod/mini"; +import * as z from "zod/mini"; /** * Supported JWT algorithms. diff --git a/js/auth/src/claims.ts b/js/auth/src/claims.ts index c83fed0894b..b6790bc6c96 100644 --- a/js/auth/src/claims.ts +++ b/js/auth/src/claims.ts @@ -5,7 +5,7 @@ */ import { Pattern, Patterns } from "@moq/pattern"; -import * as z from "@zod/mini"; +import * as z from "zod/mini"; import * as Path from "./path.ts"; import { decodeGrants } from "./wire.ts"; diff --git a/js/auth/src/contract.ts b/js/auth/src/contract.ts index 93d4693566d..094008777af 100644 --- a/js/auth/src/contract.ts +++ b/js/auth/src/contract.ts @@ -8,7 +8,7 @@ */ import { Pattern } from "@moq/pattern"; -import * as z from "@zod/mini"; +import * as z from "zod/mini"; import { PatternListSchema } from "./claims.ts"; const PathSchema = z.string().check( diff --git a/js/auth/src/key.ts b/js/auth/src/key.ts index 502b56aeb0a..deadd821fa2 100644 --- a/js/auth/src/key.ts +++ b/js/auth/src/key.ts @@ -1,6 +1,6 @@ import { wall } from "@moq/clock"; -import * as z from "@zod/mini"; import * as jose from "jose"; +import * as z from "zod/mini"; import { type Algorithm, AlgorithmSchema } from "./algorithm.ts"; import { type Claims, ClaimsSchema, ScopeSchema, scopeAllows } from "./claims.ts"; import * as Path from "./path.ts"; diff --git a/js/auth/src/set.ts b/js/auth/src/set.ts index 7472f135dc5..28db468f723 100644 --- a/js/auth/src/set.ts +++ b/js/auth/src/set.ts @@ -7,8 +7,8 @@ * @module */ -import * as z from "@zod/mini"; import * as jose from "jose"; +import * as z from "zod/mini"; import type { Claims, ClaimsSchema } from "./claims.ts"; import { Key, KeySchema, type PublicKey } from "./key.ts"; diff --git a/js/hang/api/catalog.api.md b/js/hang/api/catalog.api.md index a6d7c980d78..f317c09a5cf 100644 --- a/js/hang/api/catalog.api.md +++ b/js/hang/api/catalog.api.md @@ -3,29 +3,29 @@ ```ts import { $ZodBranded } from "zod/v4/core"; import { $ZodTypeInternals } from "zod/v4/core"; -import { $brand } from "@zod/mini"; +import { $brand } from "zod/mini"; import { $loose } from "zod/v4/core"; import { $strip } from "zod/v4/core"; import { Net } from "@moq/hang"; -import { ZodMiniBase64 } from "@zod/mini"; -import { ZodMiniBoolean } from "@zod/mini"; -import { ZodMiniCatch } from "@zod/mini"; -import { ZodMiniCustom } from "@zod/mini"; -import { ZodMiniDefault } from "@zod/mini"; -import { ZodMiniDiscriminatedUnion } from "@zod/mini"; -import { ZodMiniEnum } from "@zod/mini"; -import { ZodMiniInt32 } from "@zod/mini"; -import { ZodMiniLiteral } from "@zod/mini"; -import { ZodMiniNumber } from "@zod/mini"; -import { ZodMiniObject } from "@zod/mini"; -import { ZodMiniOptional } from "@zod/mini"; -import { ZodMiniPipe } from "@zod/mini"; -import { ZodMiniRecord } from "@zod/mini"; -import { ZodMiniString } from "@zod/mini"; -import { ZodMiniTransform } from "@zod/mini"; -import { ZodMiniType } from "@zod/mini"; -import { ZodMiniUnion } from "@zod/mini"; -import { infer } from "@zod/mini"; +import { ZodMiniBase64 } from "zod/mini"; +import { ZodMiniBoolean } from "zod/mini"; +import { ZodMiniCatch } from "zod/mini"; +import { ZodMiniCustom } from "zod/mini"; +import { ZodMiniDefault } from "zod/mini"; +import { ZodMiniDiscriminatedUnion } from "zod/mini"; +import { ZodMiniEnum } from "zod/mini"; +import { ZodMiniInt32 } from "zod/mini"; +import { ZodMiniLiteral } from "zod/mini"; +import { ZodMiniNumber } from "zod/mini"; +import { ZodMiniObject } from "zod/mini"; +import { ZodMiniOptional } from "zod/mini"; +import { ZodMiniPipe } from "zod/mini"; +import { ZodMiniRecord } from "zod/mini"; +import { ZodMiniString } from "zod/mini"; +import { ZodMiniTransform } from "zod/mini"; +import { ZodMiniType } from "zod/mini"; +import { ZodMiniUnion } from "zod/mini"; +import { infer } from "zod/mini"; export namespace Audio { export type Audio = infer; diff --git a/js/hang/api/index.api.md b/js/hang/api/index.api.md index 4b26a93bb4b..32f3d7fa294 100644 --- a/js/hang/api/index.api.md +++ b/js/hang/api/index.api.md @@ -2,20 +2,20 @@ ```ts import { $ZodBranded } from "zod/v4/core"; -import { $brand } from "@zod/mini"; +import { $brand } from "zod/mini"; import { $loose } from "zod/v4/core"; import { $strip } from "zod/v4/core"; import { Micro } from "@moq/clock"; import { Window } from "@moq/json"; -import { ZodMiniNullable } from "@zod/mini"; -import { ZodMiniNumber } from "@zod/mini"; -import { ZodMiniObject } from "@zod/mini"; -import { ZodMiniOptional } from "@zod/mini"; -import { ZodMiniPipe } from "@zod/mini"; -import { ZodMiniRecord } from "@zod/mini"; -import { ZodMiniString } from "@zod/mini"; -import { ZodMiniTransform } from "@zod/mini"; -import { infer } from "@zod/mini"; +import { ZodMiniNullable } from "zod/mini"; +import { ZodMiniNumber } from "zod/mini"; +import { ZodMiniObject } from "zod/mini"; +import { ZodMiniOptional } from "zod/mini"; +import { ZodMiniPipe } from "zod/mini"; +import { ZodMiniRecord } from "zod/mini"; +import { ZodMiniString } from "zod/mini"; +import { ZodMiniTransform } from "zod/mini"; +import { infer } from "zod/mini"; export * as Catalog from "@moq/hang/catalog"; diff --git a/js/hang/package.json b/js/hang/package.json index d80890fc9b6..35dcae19e10 100644 --- a/js/hang/package.json +++ b/js/hang/package.json @@ -31,7 +31,6 @@ "@moq/loc": "workspace:^", "@moq/net": "workspace:^", "@moq/signals": "workspace:^", - "@zod/mini": "^4.6.7", "zod": "^4.6.7" }, "devDependencies": { diff --git a/js/hang/src/catalog/audio.ts b/js/hang/src/catalog/audio.ts index 6e65c05e9d3..a7386648482 100644 --- a/js/hang/src/catalog/audio.ts +++ b/js/hang/src/catalog/audio.ts @@ -1,4 +1,4 @@ -import * as z from "@zod/mini"; +import * as z from "zod/mini"; import { compareName, compareNumber } from "./compare"; import { ContainerSchema } from "./container"; import { hexSchema } from "./hex"; diff --git a/js/hang/src/catalog/clock.ts b/js/hang/src/catalog/clock.ts index a3d4d970732..0fc4e0f5121 100644 --- a/js/hang/src/catalog/clock.ts +++ b/js/hang/src/catalog/clock.ts @@ -1,4 +1,4 @@ -import * as z from "@zod/mini"; +import * as z from "zod/mini"; import { u53Schema } from "./integers"; /** The moq epoch (2020-01-01T00:00:00Z) in Unix-epoch milliseconds. */ diff --git a/js/hang/src/catalog/container.ts b/js/hang/src/catalog/container.ts index 4cae753a08d..be55f54ddf6 100644 --- a/js/hang/src/catalog/container.ts +++ b/js/hang/src/catalog/container.ts @@ -1,4 +1,4 @@ -import * as z from "@zod/mini"; +import * as z from "zod/mini"; /** The container kinds this build knows how to decode. */ const KNOWN_KINDS = ["legacy", "cmaf", "loc"]; diff --git a/js/hang/src/catalog/contribution.ts b/js/hang/src/catalog/contribution.ts index 2670e494c13..5da4a14518f 100644 --- a/js/hang/src/catalog/contribution.ts +++ b/js/hang/src/catalog/contribution.ts @@ -1,4 +1,4 @@ -import * as z from "@zod/mini"; +import * as z from "zod/mini"; import { EpochSchema, RelativeBroadcastSchema } from "./path"; /** diff --git a/js/hang/src/catalog/echo.ts b/js/hang/src/catalog/echo.ts index ebe05c39032..6d9680e8d8d 100644 --- a/js/hang/src/catalog/echo.ts +++ b/js/hang/src/catalog/echo.ts @@ -1,4 +1,4 @@ -import * as z from "@zod/mini"; +import * as z from "zod/mini"; import { RelativeBroadcastSchema } from "./path"; /** The relative prefix under which viewers may publish feedback. */ diff --git a/js/hang/src/catalog/hex.ts b/js/hang/src/catalog/hex.ts index c427f174cc1..a61485e1a45 100644 --- a/js/hang/src/catalog/hex.ts +++ b/js/hang/src/catalog/hex.ts @@ -1,4 +1,4 @@ -import * as z from "@zod/mini"; +import * as z from "zod/mini"; /** * A hex-encoded byte string, the catalog's encoding for WebCodecs `Uint8Array` fields. diff --git a/js/hang/src/catalog/hls.ts b/js/hang/src/catalog/hls.ts index 678a5361f96..35b348adefc 100644 --- a/js/hang/src/catalog/hls.ts +++ b/js/hang/src/catalog/hls.ts @@ -1,4 +1,4 @@ -import * as z from "@zod/mini"; +import * as z from "zod/mini"; import { u53Schema } from "./integers"; /** diff --git a/js/hang/src/catalog/integers.ts b/js/hang/src/catalog/integers.ts index e85d87cc5f0..c46bc3560a8 100644 --- a/js/hang/src/catalog/integers.ts +++ b/js/hang/src/catalog/integers.ts @@ -1,4 +1,4 @@ -import * as z from "@zod/mini"; +import * as z from "zod/mini"; /** * Branded type for 8-bit unsigned integers (0-255) diff --git a/js/hang/src/catalog/path.ts b/js/hang/src/catalog/path.ts index e812d057ab9..8690d2b30eb 100644 --- a/js/hang/src/catalog/path.ts +++ b/js/hang/src/catalog/path.ts @@ -1,5 +1,5 @@ import { Epoch, Path } from "@moq/net"; -import * as z from "@zod/mini"; +import * as z from "zod/mini"; function isRelative(text: string): boolean { try { diff --git a/js/hang/src/catalog/root.test.ts b/js/hang/src/catalog/root.test.ts index 68a690b5d0c..91cf5b543e3 100644 --- a/js/hang/src/catalog/root.test.ts +++ b/js/hang/src/catalog/root.test.ts @@ -1,5 +1,5 @@ import { expect, test } from "bun:test"; -import * as z from "@zod/mini"; +import * as z from "zod/mini"; import { u53 } from "./integers.ts"; import type { ReferenceEpoch, RelativeBroadcast } from "./path.ts"; import { checkRenditions, DuplicateRendition, encode, RootSchema, UnsupportedVersion, VERSION } from "./root.ts"; diff --git a/js/hang/src/catalog/root.ts b/js/hang/src/catalog/root.ts index 91ed950d076..d1a241fda82 100644 --- a/js/hang/src/catalog/root.ts +++ b/js/hang/src/catalog/root.ts @@ -1,7 +1,7 @@ import * as Json from "@moq/json"; import type * as Moq from "@moq/net"; import { Path, Track } from "@moq/net"; -import * as z from "@zod/mini"; +import * as z from "zod/mini"; import { AudioSchema } from "./audio"; import { BinarySchema } from "./binary"; import { ClockSchema } from "./clock"; diff --git a/js/hang/src/catalog/stats.ts b/js/hang/src/catalog/stats.ts index 65098d6d2c9..4eff48b1eb7 100644 --- a/js/hang/src/catalog/stats.ts +++ b/js/hang/src/catalog/stats.ts @@ -1,4 +1,4 @@ -import * as z from "@zod/mini"; +import * as z from "zod/mini"; /** The publisher's optional media snapshot track in this broadcast. */ export const StatsSchema = z.object({ diff --git a/js/hang/src/catalog/track.ts b/js/hang/src/catalog/track.ts index 9ed921208d8..db3625d3329 100644 --- a/js/hang/src/catalog/track.ts +++ b/js/hang/src/catalog/track.ts @@ -1,4 +1,4 @@ -import * as z from "@zod/mini"; +import * as z from "zod/mini"; /** Schema for a catalog track reference, identified by name. */ export const TrackSchema = z.object({ diff --git a/js/hang/src/catalog/video.ts b/js/hang/src/catalog/video.ts index 748bc2cfe98..f5907c7545e 100644 --- a/js/hang/src/catalog/video.ts +++ b/js/hang/src/catalog/video.ts @@ -1,4 +1,4 @@ -import * as z from "@zod/mini"; +import * as z from "zod/mini"; import { compareName, compareNumber } from "./compare"; import { ContainerSchema } from "./container"; import { hexSchema } from "./hex"; diff --git a/js/hang/src/echo.ts b/js/hang/src/echo.ts index fb22f7f5cae..8ee300bbf95 100644 --- a/js/hang/src/echo.ts +++ b/js/hang/src/echo.ts @@ -5,7 +5,7 @@ */ import type { Path } from "@moq/net"; -import * as z from "@zod/mini"; +import * as z from "zod/mini"; import { u53Schema } from "./catalog/integers"; import { measurementSchema } from "./snapshot"; import { TransportSchema } from "./stats"; diff --git a/js/hang/src/hls.ts b/js/hang/src/hls.ts index 4a3cc106d47..668cdb72d85 100644 --- a/js/hang/src/hls.ts +++ b/js/hang/src/hls.ts @@ -16,7 +16,7 @@ import type { Micro } from "@moq/clock"; import * as Json from "@moq/json"; import type * as Moq from "@moq/net"; -import * as z from "@zod/mini"; +import * as z from "zod/mini"; import type * as Catalog from "./catalog"; import { u53Schema } from "./catalog"; diff --git a/js/hang/src/snapshot.ts b/js/hang/src/snapshot.ts index 9508136b797..4c98d56c603 100644 --- a/js/hang/src/snapshot.ts +++ b/js/hang/src/snapshot.ts @@ -1,4 +1,4 @@ -import * as z from "@zod/mini"; +import * as z from "zod/mini"; import { u53Schema } from "./catalog/integers"; /** An optional measurement, with JSON null decoded as unavailable like Rust Option. */ diff --git a/js/hang/src/stats.test.ts b/js/hang/src/stats.test.ts index 05efe31ebf6..3fafa88cedd 100644 --- a/js/hang/src/stats.test.ts +++ b/js/hang/src/stats.test.ts @@ -1,6 +1,6 @@ import { expect, test } from "bun:test"; import { Path } from "@moq/net"; -import * as z from "@zod/mini"; +import * as z from "zod/mini"; import * as Echo from "./echo"; import * as Stats from "./stats"; diff --git a/js/hang/src/stats.ts b/js/hang/src/stats.ts index fefc20add26..43d9b054790 100644 --- a/js/hang/src/stats.ts +++ b/js/hang/src/stats.ts @@ -3,7 +3,7 @@ * Missing counters mean zero; parsing preserves omission. * @module */ -import * as z from "@zod/mini"; +import * as z from "zod/mini"; import { u53Schema } from "./catalog/integers"; import { measurementSchema } from "./snapshot"; /** Transport gauges and cumulative loss counters known to the observer. */ diff --git a/js/json/api/index.api.md b/js/json/api/index.api.md index 6933f7664f9..b1c1714e8f7 100644 --- a/js/json/api/index.api.md +++ b/js/json/api/index.api.md @@ -4,7 +4,7 @@ import { Time } from "@moq/net"; import { Timed } from "@moq/net"; import { Track } from "@moq/net"; -import { ZodMiniType } from "@zod/mini"; +import { ZodMiniType } from "zod/mini"; export interface Diff { forcedSnapshot: boolean; diff --git a/js/json/package.json b/js/json/package.json index a175ae6ed0c..1a27c1a37d9 100644 --- a/js/json/package.json +++ b/js/json/package.json @@ -24,7 +24,6 @@ "@moq/signals": "workspace:^" }, "peerDependencies": { - "@zod/mini": "^4.5.0", "zod": "^4.5.0" }, "devDependencies": { diff --git a/js/json/src/snapshot/encoder.ts b/js/json/src/snapshot/encoder.ts index 01ecfdcad4f..c4abd6837dc 100644 --- a/js/json/src/snapshot/encoder.ts +++ b/js/json/src/snapshot/encoder.ts @@ -1,5 +1,5 @@ import { Error as NetError } from "@moq/net"; -import type * as z from "@zod/mini"; +import type * as z from "zod/mini"; import { deepEqual, diff } from "../diff.ts"; import { MAX_FRAME_BYTES, TAIL_BYTES, tailCharge } from "../limits.ts"; diff --git a/js/json/src/stream/codec.test.ts b/js/json/src/stream/codec.test.ts index ad849a5df32..58d85b715cd 100644 --- a/js/json/src/stream/codec.test.ts +++ b/js/json/src/stream/codec.test.ts @@ -1,6 +1,6 @@ import { expect, spyOn, test } from "bun:test"; import { Group, Track } from "@moq/net"; -import * as z from "@zod/mini"; +import * as z from "zod/mini"; import { Decoder } from "./decoder.ts"; import { Encoder } from "./encoder.ts"; import { Producer } from "./producer.ts"; diff --git a/js/json/src/stream/encoder.ts b/js/json/src/stream/encoder.ts index 70e9f03d372..c28a1c5d3e0 100644 --- a/js/json/src/stream/encoder.ts +++ b/js/json/src/stream/encoder.ts @@ -1,5 +1,5 @@ import { Error as NetError } from "@moq/net"; -import type * as z from "@zod/mini"; +import type * as z from "zod/mini"; import { MAX_FRAME_BYTES } from "../limits.ts"; /** Options for an {@link Encoder}. */ diff --git a/js/json/src/stream/stream.test.ts b/js/json/src/stream/stream.test.ts index bed2bbc4a7d..413939cdc98 100644 --- a/js/json/src/stream/stream.test.ts +++ b/js/json/src/stream/stream.test.ts @@ -1,7 +1,7 @@ import { expect, spyOn, test } from "bun:test"; import { Milli } from "@moq/clock"; import { StreamCode, Time, Track } from "@moq/net"; -import * as z from "@zod/mini"; +import * as z from "zod/mini"; import { Consumer, Producer, Rolled } from "./index.ts"; type Rec = { n: number }; diff --git a/js/moq-boy/api/index.api.md b/js/moq-boy/api/index.api.md index 3768f1b08bc..aba0951369c 100644 --- a/js/moq-boy/api/index.api.md +++ b/js/moq-boy/api/index.api.md @@ -2,13 +2,13 @@ ```ts import { $strip } from "zod/v4/core"; -import { ZodMiniArray } from "@zod/mini"; -import { ZodMiniNumber } from "@zod/mini"; -import { ZodMiniObject } from "@zod/mini"; -import { ZodMiniOptional } from "@zod/mini"; -import { ZodMiniRecord } from "@zod/mini"; -import { ZodMiniString } from "@zod/mini"; -import { infer } from "@zod/mini"; +import { ZodMiniArray } from "zod/mini"; +import { ZodMiniNumber } from "zod/mini"; +import { ZodMiniObject } from "zod/mini"; +import { ZodMiniOptional } from "zod/mini"; +import { ZodMiniRecord } from "zod/mini"; +import { ZodMiniString } from "zod/mini"; +import { infer } from "zod/mini"; export class Game { constructor(config: GameConfig); diff --git a/js/moq-boy/package.json b/js/moq-boy/package.json index 0ad9eaa1324..807a9fe0add 100644 --- a/js/moq-boy/package.json +++ b/js/moq-boy/package.json @@ -29,7 +29,6 @@ "@moq/net": "workspace:^", "@moq/watch": "workspace:^", "@moq/signals": "workspace:^", - "@zod/mini": "^4.6.7", "zod": "^4.6.7" }, "//devDependencies": "These are only needed for local development with workspace packages. They are NOT needed when using the published npm packages.", diff --git a/js/moq-boy/src/schemas.ts b/js/moq-boy/src/schemas.ts index 315f2d62f8c..cc8e5e3aab3 100644 --- a/js/moq-boy/src/schemas.ts +++ b/js/moq-boy/src/schemas.ts @@ -1,4 +1,4 @@ -import { z } from "@zod/mini"; +import { z } from "zod/mini"; /** Server-reported encoding/emulation performance stats. */ export const GameStatsSchema = z.object({ diff --git a/js/msf/api/index.api.md b/js/msf/api/index.api.md index 979099414c5..21db3a9c199 100644 --- a/js/msf/api/index.api.md +++ b/js/msf/api/index.api.md @@ -2,17 +2,17 @@ ```ts import { $strip } from "zod/v4/core"; -import { ZodMiniArray } from "@zod/mini"; -import { ZodMiniBoolean } from "@zod/mini"; -import { ZodMiniEnum } from "@zod/mini"; -import { ZodMiniNumber } from "@zod/mini"; -import { ZodMiniObject } from "@zod/mini"; -import { ZodMiniOptional } from "@zod/mini"; -import { ZodMiniRecord } from "@zod/mini"; -import { ZodMiniString } from "@zod/mini"; -import { ZodMiniUnion } from "@zod/mini"; -import { ZodMiniUnknown } from "@zod/mini"; -import { infer } from "@zod/mini"; +import { ZodMiniArray } from "zod/mini"; +import { ZodMiniBoolean } from "zod/mini"; +import { ZodMiniEnum } from "zod/mini"; +import { ZodMiniNumber } from "zod/mini"; +import { ZodMiniObject } from "zod/mini"; +import { ZodMiniOptional } from "zod/mini"; +import { ZodMiniRecord } from "zod/mini"; +import { ZodMiniString } from "zod/mini"; +import { ZodMiniUnion } from "zod/mini"; +import { ZodMiniUnknown } from "zod/mini"; +import { infer } from "zod/mini"; export type Catalog = infer; diff --git a/js/msf/package.json b/js/msf/package.json index 90b9ad50d21..23fdee0a0c4 100644 --- a/js/msf/package.json +++ b/js/msf/package.json @@ -22,7 +22,6 @@ "dependencies": { "@moq/json": "workspace:^", "@moq/net": "workspace:^", - "@zod/mini": "^4.6.7", "zod": "^4.6.7" }, "devDependencies": { diff --git a/js/msf/src/catalog.ts b/js/msf/src/catalog.ts index fd52228d804..78438c20a79 100644 --- a/js/msf/src/catalog.ts +++ b/js/msf/src/catalog.ts @@ -1,6 +1,6 @@ import * as Json from "@moq/json"; import type * as Moq from "@moq/net"; -import * as z from "@zod/mini"; +import * as z from "zod/mini"; /** Zod schema for a track's wire packaging. Accepts known values or any future string. */ export const PackagingSchema = z.union([ diff --git a/js/net/api/index.api.md b/js/net/api/index.api.md index 5794f3acbe0..1382aba49bb 100644 --- a/js/net/api/index.api.md +++ b/js/net/api/index.api.md @@ -4,8 +4,8 @@ import { $ZodBranded } from "zod/v4/core"; import { Instant } from "@moq/clock"; import { Milli } from "@moq/clock"; -import { ZodMiniBigInt } from "@zod/mini"; -import { infer } from "@zod/mini"; +import { ZodMiniBigInt } from "zod/mini"; +import { infer } from "zod/mini"; export namespace Announce { export interface Announce { diff --git a/js/net/api/zod.api.md b/js/net/api/zod.api.md index c2b233b7b0b..a3663b54759 100644 --- a/js/net/api/zod.api.md +++ b/js/net/api/zod.api.md @@ -3,7 +3,7 @@ ```ts import { Group } from "@moq/net"; import { Track } from "@moq/net"; -import { ZodMiniType } from "@zod/mini"; +import { ZodMiniType } from "zod/mini"; export function read(source: Track.Ordered | Group.Consumer, schema: ZodMiniType): Promise; ``` diff --git a/js/net/package.json b/js/net/package.json index e0f1997f2e1..ba803125e0d 100644 --- a/js/net/package.json +++ b/js/net/package.json @@ -31,7 +31,6 @@ "uuid": "^14.0.3" }, "peerDependencies": { - "@zod/mini": "^4.5.0", "zod": "^4.5.0" }, "devDependencies": { diff --git a/js/net/src/zod.test.ts b/js/net/src/zod.test.ts index a5492d71b50..239bee44445 100644 --- a/js/net/src/zod.test.ts +++ b/js/net/src/zod.test.ts @@ -1,5 +1,5 @@ import { expect, test } from "bun:test"; -import * as z from "@zod/mini"; +import * as z from "zod/mini"; import { Producer } from "./group.ts"; import { textFrame } from "./mock.ts"; import * as Zod from "./zod.ts"; diff --git a/js/net/src/zod.ts b/js/net/src/zod.ts index 754d98fdcc9..2e0d547659e 100644 --- a/js/net/src/zod.ts +++ b/js/net/src/zod.ts @@ -4,7 +4,7 @@ * @module */ -import type * as z from "@zod/mini"; +import type * as z from "zod/mini"; import type * as group from "./group.ts"; import type * as track from "./track.ts"; diff --git a/test/interop/clients/js-native/package.json b/test/interop/clients/js-native/package.json index 1b5d3e9be57..c8de8de70f6 100644 --- a/test/interop/clients/js-native/package.json +++ b/test/interop/clients/js-native/package.json @@ -11,7 +11,6 @@ "@moq/json": "workspace:*", "@moq/net": "workspace:*", "@moq/web-transport": "^0.1.6", - "@zod/mini": "^4.6.7", "zod": "^4.6.7" }, "devDependencies": { From f4cf17d57d3728bec3143b97598047966c5231d0 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Sun, 1 Nov 2026 18:35:47 -0800 Subject: [PATCH 05/11] chore(net): remove the unused async-mutex dependency Co-Authored-By: GPT-6.1 Sol --- bun.lock | 2 -- js/net/package.json | 1 - 2 files changed, 3 deletions(-) diff --git a/bun.lock b/bun.lock index 2d7a628f00c..332223069fe 100644 --- a/bun.lock +++ b/bun.lock @@ -271,7 +271,6 @@ "@moq/pattern": "workspace:^", "@moq/qmux": "workspace:^", "@moq/signals": "workspace:*", - "async-mutex": "^0.5.0", "pako": "^3.0.2", "sorted-btree": "^2.1.0", "uuid": "^14.0.3", @@ -1269,7 +1268,6 @@ "argparse": ["argparse@2.0.1", "", {}, "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q=="], - "async-mutex": ["async-mutex@0.5.0", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-1A94B18jkJ3DYq284ohPxoXbfTA5HsQ7/Mf4DEhcyLx3Bz27Rh59iScbB6EPiP+B+joue6YCxcMXSbFC1tZKwA=="], "babel-plugin-jsx-dom-expressions": ["babel-plugin-jsx-dom-expressions@0.40.7", "", { "dependencies": { "@babel/helper-module-imports": "7.18.6", "@babel/plugin-syntax-jsx": "^7.18.6", "@babel/types": "^7.20.7", "html-entities": "2.3.3", "parse5": "^7.1.2" }, "peerDependencies": { "@babel/core": "^7.20.12" } }, "sha512-/O6JWUmjv03OI9lL2ry9bUjpD5S3PclM55RRJEyCdcFZ5W2SEA/59d+l2hNsk3gI6kiWRdRPdOtqZmsQzFN1pQ=="], diff --git a/js/net/package.json b/js/net/package.json index ba803125e0d..dd9e4c1146f 100644 --- a/js/net/package.json +++ b/js/net/package.json @@ -25,7 +25,6 @@ "@moq/pattern": "workspace:^", "@moq/qmux": "workspace:^", "@moq/signals": "workspace:*", - "async-mutex": "^0.5.0", "pako": "^3.0.2", "sorted-btree": "^2.1.0", "uuid": "^14.0.3" From 1288664e68edeb9db7c6e3232a9aae5f96128b91 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Sun, 1 Nov 2026 18:37:11 -0800 Subject: [PATCH 06/11] docs(quest): refresh dependency removal costs and keep decisions Finish the off-cycle removal quest without changing the recurring audit schedule. Record baseline limitations and concrete reasons for retaining the previous shortlist. Co-Authored-By: GPT-6.1 Sol --- quest/m1/README.md | 1 - quest/m1/prune-deps.md | 35 ----------------------------------- 2 files changed, 36 deletions(-) delete mode 100644 quest/m1/prune-deps.md diff --git a/quest/m1/README.md b/quest/m1/README.md index 978ec2bf2a2..9bbfbdca548 100644 --- a/quest/m1/README.md +++ b/quest/m1/README.md @@ -137,7 +137,6 @@ per-frame CPU growth since #5926. - [Vendored code has every upstream fix it needs](/quest/m1/vendor-sync/README.md) - quinn, libv4l-rs, nvidia-video-codec-sdk, rust-media-libs, cros-codecs, and UniFFI generator fixes are ported or planned, once per release cycle - [Security audit findings](/quest/m1/security-audit/README.md) - fix the verified relay, importer, moq-c, browser, and CI findings of the 2026-10-27 external security audit - [Delete the tests that don't earn their cost](/quest/m1/prune-tests.md) - an off-cycle test cost sweep deletes tests whose cost outweighs their signal and makes the rest cheaper -- [Remove the dependencies that don't earn their weight](/quest/m1/prune-deps.md) - Rust, JS, and vendored dependencies that are trivial, duplicated, or serve features not worth keeping are removed - [Remove what dominates build time](/quest/m1/prune-build-time.md) - the crates, features, and code that cost the most build time are removed or made cheaper - [Delete the CI jobs that don't earn their cost](/quest/m1/prune-ci.md) - workflows and jobs that don't earn their runner time are deleted, and the rest made cheaper - [Cluster routing](/quest/m1/cluster-routing/README.md) - prove shared routing contracts, implement per-origin routes, and connect outbound local clusters diff --git a/quest/m1/prune-deps.md b/quest/m1/prune-deps.md deleted file mode 100644 index 44951dc2d0d..00000000000 --- a/quest/m1/prune-deps.md +++ /dev/null @@ -1,35 +0,0 @@ -# [M] Remove the dependencies that don't earn their weight - -## Goal - -Every Rust, JS, and vendored dependency earns its weight. One whose use is -trivial, that another dependency already covers, or that serves a feature -not worth keeping is removed. The tree carries the fewest dependencies that -do the job. - -## Plan - -This is a one-off, off-cycle run of the [dependency audit](/quest/m2/audit-deps.md), -focused on removal rather than upgrades, ahead of the cut. The recurring -audit keeps its schedule, and this quest creates no successor. Its PR -rewrites that audit's baselines and its "Kept on purpose" and "Hand-rolled -code" lists with what this run learned. - -Decided 2026-11-01 (maintainer): - -- Prefer fewer dependencies. Vendored code costs upkeep too: see the - [vendor-sync epic](/quest/m1/vendor-sync/README.md). A crate or package - stays only for nontrivial non-core functionality it covers better than our - own code would. Count its compile time and transitive tree in its cost. -- Default to removing. Remove inline in this quest's PR, one commit per - dependency or group. The PR body lists each removal with its cost and what - replaced it. Dropping a public API or a user-facing feature (a protocol, a - codec backend, a binary) is a proposal with a recommendation, filed as a - follow-up through `/quest-plan`. - -Re-judge the m2 audit's "Kept on purpose" list under the fewer-dependencies -preference rather than carrying it forward. Look for crates pulled in for one -helper, two crates doing the same job (error derives, hex, base64, backoff, -CLI or config parsing), dev-dependencies a test could live without, and -optional features that enable more than they're used for. `cargo tree -e -features`, `cargo shear`, and `bun why` help find them. From a7a8f1042f28c8a0d89a87ac1abe3e2af2c6563f Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Sun, 1 Nov 2026 18:37:25 -0800 Subject: [PATCH 07/11] docs(quest): record measured dependency costs and retention reasons Co-Authored-By: GPT-6.1 Sol --- quest/m1/prune-build-time.md | 2 +- quest/m2/audit-deps.md | 184 +++++++++++++++++++++++------------ 2 files changed, 124 insertions(+), 62 deletions(-) diff --git a/quest/m1/prune-build-time.md b/quest/m1/prune-build-time.md index 68113dad61f..a6606831ea0 100644 --- a/quest/m1/prune-build-time.md +++ b/quest/m1/prune-build-time.md @@ -23,7 +23,7 @@ Decided 2026-11-01 (maintainer): is a follow-up through `/quest-plan`. Dependencies belong to -[Remove the dependencies that don't earn their weight](/quest/m1/prune-deps.md). +[the dependency audit](/quest/m2/audit-deps.md). This quest covers our own crates and code: monomorphization (`cargo llvm-lines`), proc macros, build scripts, and crates or features that every build compiles but few users need. Start from the m2 audit's baselines and diff --git a/quest/m2/audit-deps.md b/quest/m2/audit-deps.md index 05203a80c1b..25a90d82075 100644 --- a/quest/m2/audit-deps.md +++ b/quest/m2/audit-deps.md @@ -71,16 +71,14 @@ manual step on 2026-10-28 after that evidence; a machine-readable ledger with a failing scheduled job was judged not worth it while the fork is current. -Open at the end of the m1 run: +Open after the 2026-11-01 removal run: -- vt100 0.17 and 0.18 (moq-cli dev-dependency) were still inside the - cooldown (published 2026-10-18 and 19). -- web-transport-iroh 0.8.4 takes kio 0.6, removing the kio 0.5 duplicate. - It shipped the day of the run, so Dependabot's cargo group should land it; - confirm. +- The lock still carries vt100 0.17 and web-transport-iroh 0.8.3. + Re-check their costs and the Iroh backend's consumer before upgrading; + [moq-dev/moq#7345](https://github.com/moq-dev/moq/pull/7345) proposes dropping + that backend. Dependency upgrades alone were not this off-cycle run's goal. - `test/smoke/flake.lock` lands through the Smoke toolchain update workflow, - which bumps the npm `playwright` pin with it; Dependabot auto-merge refuses - a lock-only smoke PR. Confirm those coupled PRs land. + which bumps the npm `playwright` pin with it; confirm the coupled PRs land. - http-cache-reqwest stays on its 1.0 prerelease (alpha.9) until 1.0 ships. Advisories waiting on upstream: @@ -100,65 +98,129 @@ Advisories waiting on upstream: - paste (RUSTSEC-2024-0436) remains through tikv-jemalloc-ctl and iroh's netlink-packet-core 0.8. tikv-jemallocator's unreleased main drops it. -### Baselines (2026-10-20, m1 run) - -Count registry packages only: moq-auth and moq-pattern deliberately depend on -their own published versions for compatibility tests, and the uniffi fork is -a git source. - -Cargo.lock: 1,081 packages, 91 registry names with several versions (109 -extra). Root bun.lock: 660 non-workspace package names, 72 with several -versions (81 extra), counted per name in its `packages` table; the Worker -locks have none. Most duplicates are ecosystem transitions owned upstream: - -- RustCrypto's previous generation (digest 0.10, sha2 0.10, hmac 0.12, der - 0.7, pkcs8 0.10): rsa, stun-types, http-auth, srt-protocol, jsonwebtoken. -- retina (moq-rtsp) holds h264-reader 0.8 and its bitstream-io 2, - rfc6381-codec 0.2, mp4ra-rust, and mpeg4-audio-const chain, plus socket2 0.5 - and rand 0.8. -- srt-tokio / srt-protocol 0.4.4, unpushed since 2024-05, hold derive_more - 0.99, hmac 0.12, rand 0.8, and socket2 0.5. - [SRT on the shared socket](/quest/m2/one-port/srt-demux.md) drops srt-tokio. -- rustls-acme holds rcgen 0.13, pem 3, and async-web-client (thiserror 1, - webpki-roots 0.26). winit 0.30 holds rustix 0.38, x11rb 0.13, and objc2 0.5 - until 0.31 leaves beta. -- gstreamer 0.25 moved to system-deps 9; libspa (PipeWire) still holds 7. -- Our own crates: web-transport-iroh 0.8.3 holds kio 0.5 (see above), - moq-vaapi holds bindgen 0.70, libloading 0.8, and thiserror 1, and mp4-atom - holds thiserror 1. -- Bun has no dedupe, so same-major duplicates (`@babel/types`, - `@vue/shared`, `minimatch`, `picomatch`, `yaml`) persist until a parent - re-resolves. A transitive-only security bump means editing the lock entry - (version and integrity) and verifying with `bun install --frozen-lockfile`. +### Baselines (2026-11-01 removal run) + +Cargo.lock contains 1,115 registry package versions, 98 registry names with +several versions (117 extra), unchanged by this run. Count from the lock, +including optional/platform dependencies, rather than the default-feature +`cargo metadata` graph (974 registry packages). Exclude workspace and git +packages. Root bun.lock goes from 729 to 726 non-workspace names, with 80 +names at several versions (91 extra), counting distinct resolved versions +per name. This is a new snapshot, not a like-for-like attribution of growth +since 2026-10-20. + +Removed inline, with no dependency upgrades: + +- `rimraf` from all 19 JS package build scripts: use `rm -rf dist`, supported + by Bun's cross-platform shell. The installed package was 261,819 bytes; + a warm 30-run nested-output deletion measured median 24.33 ms through its + Bun CLI versus 2.41 ms through `bun exec rm -rf` on this host. Its glob + stack remains needed by other tools or the existing override resolution; + no transitive-package saving is claimed. Preserve those lock entries: + regeneration rehoists unrelated packages and drops existing safe pins. +- `@zod/mini` from five runtime and two peer declarations: its JS and type + entrypoints only re-export `zod/mini`. Use that existing dependency + directly, keeping every package's `zod` declaration. The wrapper costs + 5,615 installed bytes and no exclusive transitive packages. Validate the + built declarations as isolated package consumers, not only workspace + source imports. +- `async-mutex` from `@moq/net`: no source, test, emitted type or script + imports it. Delete the unused runtime declaration; `tslib` remains shared + with build tooling. Its installed package was 63,046 bytes; no replacement + or exclusive-transitive saving. +- `hang`'s `regex` dependency: fixed AV1 fields use the existing + `codec_number` helper and byte patterns, retaining the grammar. Its + normal/build closure drops from 183 to 179 packages in the workspace's + default-feature graph: regex, regex-automata, regex-syntax, aho-corasick. + They remain in Cargo.lock for other consumers. A fresh uncached Nix + Rust 1.98.1 dev build with line-table debug info measured 3.12 s summed + compiler-unit time and 23,447,622 bytes of rlibs for those four crates; + that is standalone cost, not a measured workspace wall-time saving. + 19,598 original/replacement parser comparisons agreed. The existing + nightly `moq-mux --bench catalog` target now includes short/full/partial + AV1 parsing. Paired optimized scratch measurements (five million parses + per case) were 113/248/45 ns before and 14/53/22 ns after; no timing gate. + +`cargo shear` found no unused dependency; its unlinked-file warnings are +compile-fail fixtures and feature-gated source, not permission to delete +coverage. Test deletion and optimization belong to +[the concurrent test audit](https://github.com/moq-dev/moq/pull/7600). + +The root Bun audit still reports the pre-existing glob cancellation and +minimatch amplification advisories through nested tool dependencies, despite +the root overrides. The frozen before and after locks reproduce both; +re-check override coverage in the next scheduled run. Do not call that audit +clean. Full `just ci` is limited here by mbx E2BIG on workspace `cargo doc` +([moq-dev/moq#7594](https://github.com/moq-dev/moq/pull/7594)) and the runner +image's denied user namespace. Neither was bypassed for validation. ### Kept on purpose -- tracing-android: `tracing-logcat` would add rustix 0.38. -- humantime-serde, hex, send_wrapper, byteorder: unreleased for years but - complete, with no advisory. -- assert_matches, cpu-time, stats_alloc: moq-quic stays close to quinn. -- unsafe-libopus: the [Opus backend](/quest/m2/audio-opus-backend.md) quest - owns the comparison. -- moq-gst declares `rust-version = "1.92"` for gstreamer 0.25, above the - 1.91 workspace floor, the same way moq-relay and moq-cli carry their own. +Re-judged for behavior and replacement cost, not age or upstream similarity. +The small-crate times below are compiler-unit times from the same fresh +standalone build, not incremental workspace savings. + +- `tracing-android`: the Android logcat sink is used by the shipped FFI + runtime. Replacing it means owning logging/FFI safety; another tracing + adapter only trades dependencies. Host builds do not compile it. +- `humantime-serde`: duration and optional-duration Serde semantics are used + across CLI configuration, scenes and impairment presets. `serde` and + `humantime` are already consumers' dependencies; the adapter itself cost + 0.05 s. A manual adapter would duplicate those behaviors. +- `hex`: encoding, strict decoding and decode-to-slice are used across + catalog fields, TLS fingerprints, persisted secrets and vectors. No + transitives; 0.10 s. A second encoding library or hand-written validation + would add maintenance; its error type is also part of existing APIs. +- `send_wrapper`: enforces thread ownership of io_uring's non-Send session, + streams and groups when adapting to moq-net's Send transport bounds. + Removing it means owning unsafe Send/Sync and off-thread drop behavior. + No transitives; 0.03 s. +- `byteorder`: RTMP's vendored chunk/message/AMF codec uses fallible Read/Write + helpers, including 24-bit integers and exact short-read behavior, across + many modules. Replacing the I/O adaptation is larger than replacing an + in-memory endian conversion. No transitives; 0.10 s. +- `assert_matches`: QUIC tests use guarded patterns and value extraction; + `matches!` cannot replace those call sites. No transitives; 0.03 s. +- `cpu-time` and `stats_alloc`: benchmarks consume thread CPU and allocation + counts respectively. Wall time cannot replace CPU time, and a custom + allocator would recreate stats_alloc's instrumentation. Their own units + cost 0.05/0.03 s; cpu-time also needs libc/platform bindings. +- `unsafe-libopus`: a nontrivial codec with active moq-audio consumers, + not a helper. The [Opus backend](/quest/m2/audio-opus-backend.md) comparison + still owns whether a different backend is better; deleting Opus is a + user-facing feature decision. +- The QUIC/UDP, RTMP, V4L2, NVIDIA, VA-API, UniFFI and LibAV forks all have + current transport, gateway, device, binding or codec consumers. Their + removal would drop behavior or recreate nontrivial platform code; + upstream porting stays with [vendor-sync](/quest/m1/vendor-sync/README.md). + OpenH264 and device integrations remain opt-in where already gated. +- Error/primitive derives remain shared infrastructure: `thiserror` is the + workspace convention; `derive_more` handles existing enum conversions, + displays and custom Debug output; `num_enum` handles protocol enum + mappings. No competing derive crate was added. +- JS keeps Zod validation, pako's interoperable compression, sorted-btree's + ordered range operations, and UUIDv7 generation. A local replacement + would own nontrivial parsing, compression, balancing or monotonicity. ### Hand-rolled code -Planned: [H.264 parsing](/quest/m2/h264-reader.md); moq-mux's avcC and -hvcC records go through mp4-atom, and relay metrics now render through -prometheus-client. Reviewed and kept, -each small or cold: about eleven `(d * 2).min(max)` backoff loops (moq-tokio -already has a `Backoff` that moq-relay's cluster loop could reuse), per-byte -hex formatting in moq-auth and moq-hls, the STUN token bucket, the JS -deep-equal pair, and duplicated WebVTT stamps and `jwt=` lookups. -`js/publish` and `js/watch` carry byte-identical UI helpers (`graph.ts` and -near copies), which is duplication rather than a dependency question. -The m1 run came a day after m0's and did not re-review it; check code -added since. -- When TypeScript 7.1 is stable, delete `TransportStats` in - `js/net/src/connection/stats.ts` and type `getStats()` as the DOM's - `WebTransportConnectionStats` (from - [moq-dev/moq#6625](https://github.com/moq-dev/moq/pull/6625)). +Added: the fixed AV1 codec grammar now lives beside the other fixed codec +parsers. Keep it small and preserve malformed-field refusal; the benchmark +and shared catalog parity corpus exercise the consumer. + +Planned: [H.264 parsing](/quest/m2/h264-reader.md); moq-mux's avcC and hvcC +records go through mp4-atom, and relay metrics through prometheus-client. +Re-checked and kept small or cold: capped doubling backoff loops (moq-tokio +already has a `Backoff`), per-byte hex formatting, the STUN token bucket, +JS deep equality, WebVTT stamps and `jwt=` lookups. Adding a library would +cost more than these local operations. `js/publish` and `js/watch` UI helper +copies remain a source duplication question, not a reason for another +package. Source/generics/generated-code build cost belongs to the concurrent +build-time audit. + +When TypeScript 7.1 is stable, re-check whether the DOM includes +`WebTransportConnectionStats` before deleting the local `TransportStats` in +`js/net/src/connection/stats.ts`. ## Required From d2a6877eb1fad0c9aead3b71aa67799eeb4d79ad Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Sun, 1 Nov 2026 18:41:21 -0800 Subject: [PATCH 08/11] docs(quest): retain dependency deduplication and compiler-floor guidance Co-Authored-By: GPT-6.1 Sol --- quest/m2/audit-deps.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/quest/m2/audit-deps.md b/quest/m2/audit-deps.md index 25a90d82075..4448d6b26ed 100644 --- a/quest/m2/audit-deps.md +++ b/quest/m2/audit-deps.md @@ -109,6 +109,20 @@ names at several versions (91 extra), counting distinct resolved versions per name. This is a new snapshot, not a like-for-like attribution of growth since 2026-10-20. +Most duplicates still come from upstream ecosystem transitions: RustCrypto's +older generation through rsa/jsonwebtoken/STUN/SRT; retina's h264-reader 0.8 +and bitstream-io 2; srt-tokio's older rand/socket2/derive_more; rustls-acme's +rcgen 0.13 and web client; winit's older platform stack; and libspa's +system-deps 7 beside GStreamer's 9. moq-vaapi still holds bindgen 0.70, +libloading 0.8 and thiserror 1; mp4-atom also holds thiserror 1. Do not treat +all 117 extras as locally removable without checking those consumers. + +Bun's same-major duplicates can persist until a parent re-resolves. For a +transitive-only security bump, edit the lock entry's version and integrity +and verify with `bun install --frozen-lockfile`, preserving unaffected +resolutions. Re-check the current package-manager capabilities before +attempting broader deduplication. + Removed inline, with no dependency upgrades: - `rimraf` from all 19 JS package build scripts: use `rm -rf dist`, supported @@ -189,6 +203,8 @@ standalone build, not incremental workspace savings. not a helper. The [Opus backend](/quest/m2/audio-opus-backend.md) comparison still owns whether a different backend is better; deleting Opus is a user-facing feature decision. +- `moq-gst` keeps its Rust 1.92 floor for GStreamer 0.25, above the + workspace's 1.91 library floor. Do not normalize that manifest to 1.91. - The QUIC/UDP, RTMP, V4L2, NVIDIA, VA-API, UniFFI and LibAV forks all have current transport, gateway, device, binding or codec consumers. Their removal would drop behavior or recreate nontrivial platform code; From d43d463683c71ea38914c761ff84f311728bdd5c Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Sun, 1 Nov 2026 20:53:27 -0800 Subject: [PATCH 09/11] docs(quest): qualify the Bun audit scope and lock-edit procedure Co-Authored-By: Claude Opus 5.5 --- quest/m2/audit-deps.md | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/quest/m2/audit-deps.md b/quest/m2/audit-deps.md index 4448d6b26ed..ad94fbf1c8f 100644 --- a/quest/m2/audit-deps.md +++ b/quest/m2/audit-deps.md @@ -94,7 +94,9 @@ Advisories waiting on upstream: (removing braces), postcss-selector-parser 6 to 7.1.7, and Vite 5 to 6.4.5 (also removing vulnerable esbuild). Remove each override when its parent, remark-cli/unified-args, `@tailwindcss/typography`, or VitePress, declares - a safe dependency range. The root and Worker lockfiles audit clean. + a safe dependency range. The Worker and other standalone lockfiles audit + clean; the root lockfile does not (see the glob and minimatch advisories + below). - paste (RUSTSEC-2024-0436) remains through tikv-jemalloc-ctl and iroh's netlink-packet-core 0.8. tikv-jemallocator's unreleased main drops it. @@ -118,9 +120,11 @@ libloading 0.8 and thiserror 1; mp4-atom also holds thiserror 1. Do not treat all 117 extras as locally removable without checking those consumers. Bun's same-major duplicates can persist until a parent re-resolves. For a -transitive-only security bump, edit the lock entry's version and integrity -and verify with `bun install --frozen-lockfile`, preserving unaffected -resolutions. Re-check the current package-manager capabilities before +transitive-only security bump, edit the lock entry's version, integrity and +`dependencies` object to match the new release's published manifest, then +verify with `bun install --frozen-lockfile`, preserving unaffected +resolutions. If the new release adds dependencies the lock lacks, use a +version-scoped root override, as above, instead of a hand edit. Re-check the current package-manager capabilities before attempting broader deduplication. Removed inline, with no dependency upgrades: From cd2b0e08b59fdb2e8ef78073d339fce9f0890580 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Sun, 1 Nov 2026 21:18:44 -0800 Subject: [PATCH 10/11] refactor(room): use zod mini without its wrapper package Main added @moq/room's metadata schema on @zod/mini after this branch removed the wrapper; import zod/mini directly like the other packages. Co-Authored-By: Claude Opus 5.5 --- bun.lock | 1 - js/room/package.json | 1 - js/room/src/metadata.ts | 2 +- 3 files changed, 1 insertion(+), 3 deletions(-) diff --git a/bun.lock b/bun.lock index 6d21a592d2e..e50af868fde 100644 --- a/bun.lock +++ b/bun.lock @@ -351,7 +351,6 @@ "@moq/publish": "workspace:^", "@moq/signals": "workspace:^", "@moq/watch": "workspace:^", - "@zod/mini": "^4.6.7", "zod": "^4.6.7", }, "devDependencies": { diff --git a/js/room/package.json b/js/room/package.json index 127cd8380bb..1363f311667 100644 --- a/js/room/package.json +++ b/js/room/package.json @@ -27,7 +27,6 @@ "@moq/publish": "workspace:^", "@moq/signals": "workspace:^", "@moq/watch": "workspace:^", - "@zod/mini": "^4.6.7", "zod": "^4.6.7" }, "devDependencies": { diff --git a/js/room/src/metadata.ts b/js/room/src/metadata.ts index 9f450420753..9ad2a3a4c42 100644 --- a/js/room/src/metadata.ts +++ b/js/room/src/metadata.ts @@ -18,7 +18,7 @@ import * as Moq from "@moq/net"; import type * as Publish from "@moq/publish"; import { Effect, type Getter, type Readonlys, readonlys, Signal } from "@moq/signals"; import type * as Watch from "@moq/watch"; -import * as z from "@zod/mini"; +import * as z from "zod/mini"; /** Delivery priority for hang metadata tracks: below the catalog, above audio. */ export const PRIORITY = 90; From 98f9ac77d754b6b0fa3e7c95bf0eac297f73079e Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Sun, 1 Nov 2026 21:29:33 -0800 Subject: [PATCH 11/11] docs(quest): count @moq/room among the zod mini consumers Co-Authored-By: Claude Opus 5.5 --- quest/m2/audit-deps.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/quest/m2/audit-deps.md b/quest/m2/audit-deps.md index ad94fbf1c8f..54b0529b1c3 100644 --- a/quest/m2/audit-deps.md +++ b/quest/m2/audit-deps.md @@ -136,7 +136,7 @@ Removed inline, with no dependency upgrades: stack remains needed by other tools or the existing override resolution; no transitive-package saving is claimed. Preserve those lock entries: regeneration rehoists unrelated packages and drops existing safe pins. -- `@zod/mini` from five runtime and two peer declarations: its JS and type +- `@zod/mini` from six runtime and two peer declarations: its JS and type entrypoints only re-export `zod/mini`. Use that existing dependency directly, keeping every package's `zod` declaration. The wrapper costs 5,615 installed bytes and no exclusive transitive packages. Validate the