From 0bbfed321a9b79c990eab771b8333658eb4cea46 Mon Sep 17 00:00:00 2001
From: ht <hikmet@texmart.com>
Date: Tue, 15 Sep 2026 15:24:19 +0300
Subject: [PATCH] fix: fingerprint the deployed entry asset

---
 docs/quality/deployment-runbook.md |  4 ++--
 package.json                       |  1 +
 scripts/asset-fingerprint.mjs      | 10 ++++++++++
 3 files changed, 13 insertions(+), 2 deletions(-)
 create mode 100644 scripts/asset-fingerprint.mjs

diff --git a/docs/quality/deployment-runbook.md b/docs/quality/deployment-runbook.md
index 4e3e266..2cd020d 100644
--- a/docs/quality/deployment-runbook.md
+++ b/docs/quality/deployment-runbook.md
@@ -39,11 +39,11 @@ Hedef commit ve yerel frontend asset hash’i verilerek salt okunur canlı kabul
 
 ```sh
 IHALEIST_EXPECTED_RELEASE="$(git rev-parse HEAD)" \
-IHALEIST_EXPECTED_ASSET_SHA256="$(sha256sum dist/assets/index-*.js | awk '{print $1}')" \
+IHALEIST_EXPECTED_ASSET_SHA256="$(npm run -s qa:asset-hash)" \
 npm run qa:live -- https://ihaleist.com
 ```
 
-macOS üzerinde `sha256sum` yerine `shasum -a 256` kullanılabilir. Probe `/api/version` release değerini, ana sayfadaki gerçek asset’i ve container içinden bildirilen asset hash’ini birlikte karşılaştırır.
+`qa:asset-hash`, `dist/index.html` içindeki giriş scriptini okuyarak yalnız gerçekten yüklenen ana JavaScript asset’inin hash’ini üretir. Probe `/api/version` release değerini, ana sayfadaki gerçek asset’i ve container içinden bildirilen asset hash’ini birlikte karşılaştırır.
 
 ## Kademeli yayın
 
diff --git a/package.json b/package.json
index 4d1a52e..a155c4e 100644
--- a/package.json
+++ b/package.json
@@ -7,6 +7,7 @@
     "dev": "vite",
     "build": "vite build",
     "qa:browser": "node tests/browser-acceptance.mjs",
+    "qa:asset-hash": "node scripts/asset-fingerprint.mjs",
     "qa:live": "node tests/live-runtime-probe.mjs",
     "preview": "vite preview",
     "server": "node server/index.js",
diff --git a/scripts/asset-fingerprint.mjs b/scripts/asset-fingerprint.mjs
new file mode 100644
index 0000000..066a0aa
--- /dev/null
+++ b/scripts/asset-fingerprint.mjs
@@ -0,0 +1,10 @@
+import path from 'node:path';
+import { frontendAssetInfo } from '../server/release-info.mjs';
+
+const asset = frontendAssetInfo([path.resolve(process.cwd(), 'dist')]);
+if (!asset) {
+  console.error('dist/index.html içinde yüklenen frontend JavaScript asset’i bulunamadı. Önce npm run build çalıştırın.');
+  process.exit(1);
+}
+
+process.stdout.write(`${asset.sha256}\n`);