@sproutboat/runtime 0.13.4 → 0.14.0

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @sproutboat/runtime
 
+## 0.14.0
+
+### Minor Changes
+
+- 4dd16b7: `fetch()` reaches any public address and never a private or reserved one (baronunread/sproutboat#174). The `outbound` allowlist is gone.
+  
+  - Both backends, the broker and the standalone client, check the address they resolved, not the hostname, so DNS rebinding can't get past the check. The broker connects to the vetted address and verifies TLS against the name.
+  - Blocked: loopback, RFC 1918, link-local and cloud metadata, CGNAT, benchmarking, documentation, multicast and reserved ranges, IPv6 ULA and link-local, and the IPv4 address inside IPv4-mapped, NAT64 and 6to4 addresses.
+  - An operator can let addresses through with `SB_EGRESS_ALLOW` (`*` or exact addresses) in the broker's or the binary's environment. Handler code can't.
+  - `@sproutboat/runtime`: `URL.hostname` and `URL.port` handle IPv6 literals (`[::1]:9` used to give hostname `[`). Every sprout gets `fetch()`, with no binding needed. `validateHttpSyncSource` no longer takes an `outboundAllowed` argument, and `Bindings` loses `outbound`.
+  - `@sproutboat/wire`: `Bindings` loses `outbound`.
+  - `@sproutboat/config`: `outbound` is accepted but ignored, with a warning in the new `warnings` field of a successful parse (`OUTBOUND_IGNORED`). It will be refused in a later minor release.
+
+## 0.13.5
+
+### Patch Changes
+
+- 5dba469: Binary data survives KV and outbound `fetch()` bodies (baronunread/sproutboat#233, and the request half of #232).
+  - **KV:** `put()` of an `ArrayBuffer` or any typed array stores its bytes, flagged binary, instead of `String(view)` (`"0,1,2,..."`). `get(key, type | { type })` supports `"text"`, `"json"` and `"arrayBuffer"` as in Workers: a binary value read as text decodes as UTF-8, and a text value read as `arrayBuffer` is its UTF-8 encoding. `"stream"` throws a clear error. Existing stores gain the `binary` column on first use.
+  - **`fetch()` and service-binding request bodies:** an `ArrayBuffer` or view is sent as its exact bytes in both transports, instead of `"0,1,2,..."`. The standalone HTTP client also stopped truncating bodies at the first NUL byte.
+
 ## 0.13.4
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.13.4",
+  "version": "0.14.0",
   "license": "MIT",
   "type": "module",
   "repository": {
@@ -11,6 +11,7 @@
   "main": "./src/index.ts",
   "types": "./src/index.ts",
   "scripts": {
-    "test": "bun test ./"
+    "test": "bun test ./",
+    "gen:egress": "bun src/gen-egress.ts"
   }
 }

package/src/egress.test.ts

@@ -0,0 +1,155 @@
+import { expect, test } from "bun:test";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  blockedRange,
+  egressAllowList,
+  egressRefusal,
+  parseAddress,
+  spliceEgressTable,
+} from "./egress";
+import { validateHttpSyncSource } from "./source";
+import { wrapNativeFetchHandler } from "./wrap";
+
+const BLOCKED = [
+  "0.0.0.0",
+  "10.1.2.3",
+  "100.64.0.1",
+  "100.127.255.255",
+  "127.0.0.1",
+  "127.255.255.254",
+  "169.254.169.254",
+  "172.16.0.1",
+  "172.31.255.255",
+  "192.0.0.8",
+  "192.0.2.1",
+  "192.168.1.1",
+  "198.18.0.1",
+  "198.19.255.255",
+  "224.0.0.1",
+  "255.255.255.255",
+  "::",
+  "::1",
+  "::ffff:127.0.0.1",
+  "64:ff9b::7f00:1",
+  "64:ff9b::a00:1",
+  "64:ff9b:1::1",
+  "2002:7f00:1::1",
+  "2001:db8::1",
+  "fc00::1",
+  "fd12::1",
+  "fe80::1",
+  "ff02::1",
+];
+const PUBLIC = [
+  "1.1.1.1",
+  "8.8.8.8",
+  "100.128.0.1",
+  "172.15.255.255",
+  "172.32.0.1",
+  "198.20.0.1",
+  "::ffff:8.8.8.8",
+  "64:ff9b::808:808",
+  "2002:808:808::1",
+  "2001:4860:4860::8888",
+  "2606:4700::1111",
+];
+const ALLOW = "8.8.4.4, 10.9.9.9";
+
+test("private and reserved addresses are blocked, public ones are not", () => {
+  for (const address of BLOCKED)
+    expect([address, blockedRange(address)]).not.toEqual([address, null]);
+  for (const address of PUBLIC) expect([address, blockedRange(address)]).toEqual([address, null]);
+  expect(blockedRange("::ffff:127.0.0.1")).toBe("127.0.0.0/8");
+  expect(blockedRange("64:ff9b::a00:1")).toBe("10.0.0.0/8");
+});
+
+test("the operator allow list lets an exact address or everything through", () => {
+  expect(egressRefusal("db", "10.9.9.9", egressAllowList(ALLOW))).toBeNull();
+  expect(egressRefusal("db", "10.9.9.8", egressAllowList(ALLOW))).toContain(
+    "SB_EGRESS_ALLOW=10.9.9.8",
+  );
+  expect(egressRefusal("db", "127.0.0.1", ["*"])).toBeNull();
+  expect(egressRefusal("x", "169.254.169.254", [])).toBe(
+    "fetch() refused: x resolves to 169.254.169.254, a private or reserved address (169.254.0.0/16). An operator can allow it with SB_EGRESS_ALLOW=169.254.169.254",
+  );
+});
+
+test("parseAddress rejects what is not an address", () => {
+  for (const bad of [
+    "",
+    "1.2.3",
+    "256.1.1.1",
+    "example.com",
+    "1::2::3",
+    "1:2:3:4:5:6:7:8:9",
+    "12345::",
+  ])
+    expect([bad, parseAddress(bad)]).toEqual([bad, null]);
+});
+
+const transportFile = new URL("./transport-embedded.js", import.meta.url);
+
+test("the C table in transport-embedded.js is generated from this one (bun run gen:egress)", () => {
+  const source = readFileSync(transportFile, "utf8");
+  expect(spliceEgressTable(source)).toBe(source);
+});
+
+test("the C check gives the same answer and message as the TS one", () => {
+  const source = readFileSync(transportFile, "utf8");
+  const block = source.slice(source.indexOf("// EGRESS:BEGIN"), source.indexOf("// EGRESS:END"));
+  const dir = mkdtempSync(join(tmpdir(), "sb-egress-"));
+  try {
+    writeFileSync(
+      join(dir, "check.c"),
+      `#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+${block}
+int main(int argc, char** argv) {
+  for (int i = 1; i < argc; i++) {
+    struct sockaddr_storage ss;
+    memset(&ss, 0, sizeof(ss));
+    struct sockaddr_in* v4 = (struct sockaddr_in*)&ss;
+    struct sockaddr_in6* v6 = (struct sockaddr_in6*)&ss;
+    if (inet_pton(AF_INET, argv[i], &v4->sin_addr) == 1) v4->sin_family = AF_INET;
+    else if (inet_pton(AF_INET6, argv[i], &v6->sin6_addr) == 1) v6->sin6_family = AF_INET6;
+    else { printf("unparsed\\n"); continue; }
+    char msg[512];
+    printf("%s\\n", sb_egress_refused("h", (struct sockaddr*)&ss, msg, sizeof(msg)) ? msg : "ok");
+  }
+  return 0;
+}
+`,
+    );
+    const cc = Bun.spawnSync([
+      "cc",
+      "-Wall",
+      "-Werror",
+      "-o",
+      join(dir, "check"),
+      join(dir, "check.c"),
+    ]);
+    expect(cc.stderr.toString()).toBe("");
+    const addresses = [...BLOCKED, ...PUBLIC, "10.9.9.9"];
+    const run = Bun.spawnSync([join(dir, "check"), ...addresses], {
+      env: { ...process.env, SB_EGRESS_ALLOW: ALLOW },
+    });
+    const fromC = run.stdout.toString().trimEnd().split("\n");
+    const fromTs = addresses.map((a) => egressRefusal("h", a, egressAllowList(ALLOW)) ?? "ok");
+    expect(fromC).toEqual(fromTs);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("#174: fetch() needs no config, so every sprout gets it", () => {
+  const handler = `export default { async fetch() { return await fetch("https://api.example.com/"); } };`;
+  expect(validateHttpSyncSource(handler)).toEqual({ ok: true });
+  const prelude = readFileSync(new URL("./native-fetch-prelude.js", import.meta.url), "utf8");
+  expect(wrapNativeFetchHandler(handler, prelude)).toContain("__sbInstallFetch();");
+});

package/src/egress.ts

@@ -0,0 +1,156 @@
+/**
+ * baronunread/sproutboat#174 — `fetch()` never reaches a private or reserved
+ * address. A sprout is a real OS process, so without this it could reach the
+ * operator's loopback services, their private network, or a cloud metadata
+ * endpoint, none of which a Worker can touch.
+ *
+ * Both backends check the address they are about to connect to, never the
+ * hostname: the broker (`@sproutboat/wire`) here in TS, the standalone client
+ * in C (`transport-embedded.js`). This table is the one source of truth; the C
+ * copy is generated from it (`bun run gen:egress`) and a test fails if the two
+ * drift, while another runs the C check against this one on the same vectors.
+ *
+ * The override belongs to the operator, not the handler: `SB_EGRESS_ALLOW` in
+ * the broker's or the binary's environment, either `*` or a comma-separated
+ * list of exact addresses.
+ * ponytail: exact addresses only, add CIDR entries if an operator needs a subnet.
+ */
+
+/** Blocked ranges. IPv4-mapped (`::ffff:0:0/96`), NAT64 (`64:ff9b::/96`) and
+ *  6to4 (`2002::/16`) addresses are checked by the IPv4 address they embed. */
+export const BLOCKED_RANGES = [
+  "0.0.0.0/8",
+  "10.0.0.0/8",
+  "100.64.0.0/10",
+  "127.0.0.0/8",
+  "169.254.0.0/16",
+  "172.16.0.0/12",
+  "192.0.0.0/24",
+  "192.0.2.0/24",
+  "192.168.0.0/16",
+  "198.18.0.0/15",
+  "198.51.100.0/24",
+  "203.0.113.0/24",
+  "224.0.0.0/4",
+  "240.0.0.0/4",
+  "::/96",
+  "64:ff9b:1::/48",
+  "100::/64",
+  "2001:db8::/32",
+  "fc00::/7",
+  "fe80::/10",
+  "fec0::/10",
+  "ff00::/8",
+] as const;
+
+/** Parse an IPv4 or IPv6 literal to its bytes; `null` when it is neither. */
+export function parseAddress(text: string): Uint8Array | null {
+  const v4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(text);
+  if (v4) {
+    const bytes = v4.slice(1).map(Number);
+    return bytes.every((b) => b <= 255) ? Uint8Array.from(bytes) : null;
+  }
+  if (!text.includes(":")) return null;
+  let tail: number[] = [];
+  let body = text;
+  const dotted = /^(.*:)(\d{1,3}(?:\.\d{1,3}){3})$/.exec(text);
+  if (dotted) {
+    const embedded = parseAddress(dotted[2]);
+    if (!embedded) return null;
+    body = `${dotted[1]}0:0`;
+    tail = [...embedded];
+  }
+  const halves = body.split("::");
+  if (halves.length > 2) return null;
+  const groups = (part: string) => (part === "" ? [] : part.split(":"));
+  const head = groups(halves[0]);
+  const rest = halves.length === 2 ? groups(halves[1]) : [];
+  const missing = 8 - head.length - rest.length;
+  if (halves.length === 2 ? missing < 1 : missing !== 0) return null;
+  const all = [...head, ...Array<string>(missing).fill("0"), ...rest];
+  const out = new Uint8Array(16);
+  for (let i = 0; i < 8; i++) {
+    if (!/^[0-9a-fA-F]{1,4}$/.test(all[i])) return null;
+    const n = parseInt(all[i], 16);
+    out[i * 2] = n >> 8;
+    out[i * 2 + 1] = n & 255;
+  }
+  if (tail.length) out.set(tail, 12);
+  return out;
+}
+
+type Range = { cidr: string; bytes: Uint8Array; bits: number };
+const RANGES: Range[] = BLOCKED_RANGES.map((cidr) => {
+  const [addr, bits] = cidr.split("/");
+  return { cidr, bytes: parseAddress(addr)!, bits: Number(bits) };
+});
+
+function inRange(bytes: Uint8Array, range: Range): boolean {
+  if (bytes.length !== range.bytes.length) return false;
+  const whole = range.bits >> 3;
+  for (let i = 0; i < whole; i++) if (bytes[i] !== range.bytes[i]) return false;
+  const rem = range.bits & 7;
+  if (rem === 0) return true;
+  const mask = (0xff << (8 - rem)) & 0xff;
+  return (bytes[whole] & mask) === (range.bytes[whole] & mask);
+}
+
+/** The IPv4 address an IPv6 one carries, for the mapped, NAT64 and 6to4 forms. */
+function embeddedV4(bytes: Uint8Array): Uint8Array | null {
+  if (bytes.length !== 16) return null;
+  const prefix = (p: number[]) => p.every((b, i) => bytes[i] === b);
+  if (prefix([0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff])) return bytes.slice(12);
+  if (prefix([0, 0x64, 0xff, 0x9b, 0, 0, 0, 0, 0, 0, 0, 0])) return bytes.slice(12);
+  if (prefix([0x20, 0x02])) return bytes.slice(2, 6);
+  return null;
+}
+
+/** The blocked range `address` falls in, or `null` when it may be reached. */
+export function blockedRange(address: string): string | null {
+  const parsed = parseAddress(address);
+  if (!parsed) return "unparseable address";
+  const bytes = embeddedV4(parsed) ?? parsed;
+  return RANGES.find((range) => inRange(bytes, range))?.cidr ?? null;
+}
+
+/** `SB_EGRESS_ALLOW` split into entries. */
+export function egressAllowList(raw: string | undefined): string[] {
+  return (raw ?? "")
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean);
+}
+
+/** Why `fetch()` may not connect to `address`, or `null` when it may. The
+ *  message is identical in the C client; keep the two in step. */
+export function egressRefusal(
+  host: string,
+  address: string,
+  allow: readonly string[],
+): string | null {
+  if (allow.includes("*") || allow.includes(address)) return null;
+  const range = blockedRange(address);
+  if (range === null) return null;
+  return `fetch() refused: ${host} resolves to ${address}, a private or reserved address (${range}). An operator can allow it with SB_EGRESS_ALLOW=${address}`;
+}
+
+/** The C range table spliced into transport-embedded.js, inside
+ *  sb_egress_blocked: Porffor's header split mangles a file-scope array. */
+export function egressRangesC(): string {
+  const rows = RANGES.map(({ cidr, bytes, bits }) => {
+    const padded = [...bytes, ...Array<number>(16 - bytes.length).fill(0)];
+    return `    { ${bytes.length}, ${bits}, { ${padded.join(", ")} }, "${cidr}" },`;
+  });
+  return ["  static const sb_egress_range sb_egress_ranges[] = {", ...rows, "  };"].join("\n");
+}
+
+const TABLE_BEGIN = /( *\/\/ EGRESS-TABLE:BEGIN[^\n]*\n)[\s\S]*?( *\/\/ EGRESS-TABLE:END)/;
+
+/** `source` with the generated table between its EGRESS-TABLE markers replaced. */
+export function spliceEgressTable(source: string): string {
+  if (!TABLE_BEGIN.test(source)) throw new Error("EGRESS-TABLE markers not found");
+  return source.replace(
+    TABLE_BEGIN,
+    (_, begin: string, end: string) => `${begin}${egressRangesC()}\n${end}`,
+  );
+}

package/src/gen-egress.ts

@@ -0,0 +1,6 @@
+// Regenerates the C range table in transport-embedded.js from egress.ts (#174).
+import { readFileSync, writeFileSync } from "node:fs";
+import { spliceEgressTable } from "./egress";
+
+const path = new URL("./transport-embedded.js", import.meta.url);
+writeFileSync(path, spliceEgressTable(readFileSync(path, "utf8")));

package/src/index.ts

@@ -8,3 +8,4 @@
 // src/native-fetch-prelude.js.
 export * from "./wrap";
 export * from "./source";
+export * from "./egress";

package/src/native-fetch-prelude.js

@@ -411,14 +411,18 @@ __sbDefineURLAccessor("host", function () {
   const i = this.origin.indexOf("://");
   return i === -1 ? "" : this.origin.slice(i + 3);
 });
+// The port colon is the one after an IPv6 literal's closing bracket: `[::1]:9`.
+function __sbPortColon(host) {
+  return host.indexOf(":", host.charAt(0) === "[" ? host.indexOf("]") : 0);
+}
 __sbDefineURLAccessor("hostname", function () {
   const h = this.host;
-  const c = h.indexOf(":");
+  const c = __sbPortColon(h);
   return c === -1 ? h : h.slice(0, c);
 });
 __sbDefineURLAccessor("port", function () {
   const h = this.host;
-  const c = h.indexOf(":");
+  const c = __sbPortColon(h);
   return c === -1 ? "" : h.slice(c + 1);
 });
 __sbDefineURLAccessor("hash", function () {
@@ -646,6 +650,18 @@ function __sbFromUtf8(bytes) {
 // on every asset request regardless of whether anything used it -- this was
 // a real, shipped performance regression on sproutboat.com, caught after
 // the fact by unexpectedly slow page loads.
+// #232 — a fetch() request body for the wire: text as-is, and an ArrayBuffer or
+// any view as its bytes (one char per byte) flagged bodyBinary, instead of
+// String(view), which sent "0,1,2,...".
+function __sbRequestBody(body) {
+  if (body == null) return { body: null };
+  if (!__sbIsStr(body) && body.byteLength !== undefined) {
+    const bytes = body.buffer !== undefined ? new Uint8Array(body.buffer, body.byteOffset, body.byteLength) : body;
+    return { body: __sbToBytes(bytes), bodyBinary: true };
+  }
+  return { body: String(body) };
+}
+
 function __sbRawBodyResponse(body, init) {
   const resp = new Response(body == null ? "" : body, init);
   if (body != null) {
@@ -1364,12 +1380,27 @@ globalThis.__sbInstallBindings = function (target, bindings) {
   for (let i = 0; i < (bindings.kv || []).length; i++) {
     const ns = bindings.kv[i];
     target[ns] = {
-      get(key) {
+      // #233 — Workers' get(key, type | { type }): "text" (default), "json",
+      // "arrayBuffer". A value put as bytes is stored one char per byte and
+      // flagged, so text decodes it as UTF-8 and arrayBuffer returns it
+      // exactly; a text value read as arrayBuffer is its UTF-8 encoding.
+      get(key, typeOrOptions) {
         const r = __sbRpc("kv.get", { ns, key: String(key) });
-        return r.found ? r.value : null;
+        if (!r.found) return null;
+        const type = typeOrOptions == null ? "text" : __sbIsStr(typeOrOptions) ? typeOrOptions : typeOrOptions.type || "text";
+        if (type === "arrayBuffer") return __sbBufFrom(r.binary ? r.value : __sbToBytes(r.value));
+        if (type === "stream") throw new TypeError('KV get type "stream" is not supported (no ReadableStream); use "arrayBuffer"');
+        const text = r.binary ? __sbFromUtf8(r.value) : r.value;
+        return type === "json" ? JSON.parse(text) : text;
       },
       put(key, value, options) {
-        const msg = { ns, key: String(key), value: String(value) };
+        const msg = { ns, key: String(key), value: "" };
+        if (value != null && !__sbIsStr(value) && value.byteLength !== undefined) {
+          // ArrayBuffer or any ArrayBufferView: its bytes, not String(view) ("0,1,2,...").
+          const bytes = value.buffer !== undefined ? new Uint8Array(value.buffer, value.byteOffset, value.byteLength) : value;
+          msg.value = __sbToBytes(bytes);
+          msg.binary = true;
+        } else msg.value = String(value);
         if (options && options.expirationTtl != null) msg.expirationTtl = Number(options.expirationTtl);
         else if (options && options.expiration != null) msg.expiration = Number(options.expiration);
         __sbRpc("kv.put", msg);
@@ -1578,7 +1609,7 @@ globalThis.__sbInstallBindings = function (target, bindings) {
 
   // #48 — worker-to-worker. Same wire shape as outbound fetch, but the broker
   // resolves the target itself and forwards it internally, so this is not
-  // egress and is not subject to the outbound allowlist.
+  // egress and is not subject to the private-address block.
   for (let i = 0; i < (bindings.services || []).length; i++) {
     const binding = bindings.services[i].binding;
     target[binding] = {
@@ -1595,7 +1626,7 @@ globalThis.__sbInstallBindings = function (target, bindings) {
           url,
           method: opts.method || "GET",
           headers,
-          body: opts.body == null ? null : String(opts.body),
+          ...__sbRequestBody(opts.body),
         });
         const respHeaders = new Headers();
         for (let j = 0; j < (r.headers || []).length; j++) respHeaders.set(r.headers[j][0], r.headers[j][1]);
@@ -1608,30 +1639,35 @@ globalThis.__sbInstallBindings = function (target, bindings) {
     };
   }
 
-  if ((bindings.outbound || []).length > 0) {
-    globalThis.fetch = function (input, init) {
-      const url = __sbIsStr(input) ? input : String(input.url);
-      const opts = init || {};
-      const headers = [];
-      if (opts.headers) {
-        if (__sbIsFn(opts.headers.forEach)) opts.headers.forEach((v, k) => headers.push([k, v]));
-        else for (const k in opts.headers) headers.push([k, opts.headers[k]]);
-      }
-      const r = globalThis.__sbFetchUpstream("fetch", {
-        url,
-        method: opts.method || "GET",
-        headers,
-        body: opts.body == null ? null : String(opts.body),
-      });
-      const respHeaders = new Headers();
-      for (let j = 0; j < (r.headers || []).length; j++) respHeaders.set(r.headers[j][0], r.headers[j][1]);
-      // #176: bytes from an outbound HTTP response, not a string this handler
-      // built -- must not be re-encoded if the handler proxies it straight
-      // through (see the assets binding for the same reasoning).
-      if (r.body != null) respHeaders.set("x-sb-raw-body", "1");
-      return __sbRawBodyResponse(r.body, { status: r.status || 502, headers: respHeaders });
-    };
-  }
+};
+
+// fetch() reaches any public address; the transport refuses private and
+// reserved ones at connect (baronunread/sproutboat#174). No config, like a
+// Worker's fetch. Installed by the generated module (wrap.ts), not here: the
+// prelude must not replace fetch just by being evaluated.
+globalThis.__sbInstallFetch = function () {
+  globalThis.fetch = function (input, init) {
+    const url = __sbIsStr(input) ? input : String(input.url);
+    const opts = init || {};
+    const headers = [];
+    if (opts.headers) {
+      if (__sbIsFn(opts.headers.forEach)) opts.headers.forEach((v, k) => headers.push([k, v]));
+      else for (const k in opts.headers) headers.push([k, opts.headers[k]]);
+    }
+    const r = globalThis.__sbFetchUpstream("fetch", {
+      url,
+      method: opts.method || "GET",
+      headers,
+      ...__sbRequestBody(opts.body),
+    });
+    const respHeaders = new Headers();
+    for (let j = 0; j < (r.headers || []).length; j++) respHeaders.set(r.headers[j][0], r.headers[j][1]);
+    // #176: bytes from an outbound HTTP response, not a string this handler
+    // built -- must not be re-encoded if the handler proxies it straight
+    // through (see the assets binding for the same reasoning).
+    if (r.body != null) respHeaders.set("x-sb-raw-body", "1");
+    return __sbRawBodyResponse(r.body, { status: r.status || 502, headers: respHeaders });
+  };
 };
 
 // ---------------------------------------------------------------------------

package/src/source.ts

@@ -35,12 +35,7 @@ const alwaysForbidden: Array<[RegExp, string]> = [
   ],
 ];
 
-const fetchWithoutAllowlist: [RegExp, string] = [
-  /(?:\breturn\s+|\bawait\s+|=\s*)fetch\s*\(/,
-  "outbound networking needs an `outbound` host allowlist in sproutboat.jsonc",
-];
-
-export function validateHttpSyncSource(source: string, outboundAllowed = false): SourceValidation {
+export function validateHttpSyncSource(source: string): SourceValidation {
   const errors: string[] = [];
   // The default export must be an object literal with a `fetch` method. A module
   // may also declare Durable Object classes / helpers before it, so this is not
@@ -52,6 +47,5 @@ export function validateHttpSyncSource(source: string, outboundAllowed = false):
     errors.push("handler must default-export an object with fetch(request)");
   }
   for (const [pattern, message] of alwaysForbidden) if (pattern.test(source)) errors.push(message);
-  if (!outboundAllowed && fetchWithoutAllowlist[0].test(source)) errors.push(fetchWithoutAllowlist[1]);
   return errors.length ? { ok: false, errors } : { ok: true };
 }

package/src/transport-embedded.js

@@ -21,6 +21,8 @@ Porffor.c`
 #include <sys/stat.h>
 #include <sys/socket.h>
 #include <netdb.h>
+#include <arpa/inet.h>
+#include <string.h>
 #include <strings.h>
 #include <sys/time.h>
 #include <bearssl.h>
@@ -1006,7 +1008,7 @@ static char* sb_sql_backup(const char* src_path, const char* dest_path) {
 // response parser: the only thing that differs is how bytes move.
 
 // #56 — an outbound response is held whole in memory, and its size is chosen by
-// the remote host, not by us. Without a cap one allowlisted upstream can drive a
+// the remote host, not by us. Without a cap one upstream can drive a
 // sprout out of memory: a 100 MB body measured at 321 MB resident. 32 MiB by
 // default, raisable for a deployment that knowingly fetches something bigger.
 static size_t sb_fetch_max(void) {
@@ -1019,16 +1021,122 @@ static size_t sb_fetch_max(void) {
   return cached;
 }
 
-static int sb_tcp_connect(const char* host, int port) {
+// EGRESS:BEGIN
+// baronunread/sproutboat#174: fetch() never connects to a private or reserved
+// address. The resolved address is checked, never the hostname, so DNS
+// rebinding has nothing to race. Same table, algorithm and message as
+// @sproutboat/runtime's src/egress.ts; egress.test.ts compiles this block and
+// holds the two to the same answers.
+
+typedef struct { int len; int bits; unsigned char addr[16]; const char* cidr; } sb_egress_range;
+static const char* sb_egress_blocked(const unsigned char* a, int len) {
+  // EGRESS-TABLE:BEGIN generated by "bun run gen:egress" from src/egress.ts, do not edit
+  static const sb_egress_range sb_egress_ranges[] = {
+    { 4, 8, { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "0.0.0.0/8" },
+    { 4, 8, { 10, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "10.0.0.0/8" },
+    { 4, 10, { 100, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "100.64.0.0/10" },
+    { 4, 8, { 127, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "127.0.0.0/8" },
+    { 4, 16, { 169, 254, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "169.254.0.0/16" },
+    { 4, 12, { 172, 16, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "172.16.0.0/12" },
+    { 4, 24, { 192, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "192.0.0.0/24" },
+    { 4, 24, { 192, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "192.0.2.0/24" },
+    { 4, 16, { 192, 168, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "192.168.0.0/16" },
+    { 4, 15, { 198, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "198.18.0.0/15" },
+    { 4, 24, { 198, 51, 100, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "198.51.100.0/24" },
+    { 4, 24, { 203, 0, 113, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "203.0.113.0/24" },
+    { 4, 4, { 224, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "224.0.0.0/4" },
+    { 4, 4, { 240, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "240.0.0.0/4" },
+    { 16, 96, { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "::/96" },
+    { 16, 48, { 0, 100, 255, 155, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "64:ff9b:1::/48" },
+    { 16, 64, { 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "100::/64" },
+    { 16, 32, { 32, 1, 13, 184, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "2001:db8::/32" },
+    { 16, 7, { 252, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "fc00::/7" },
+    { 16, 10, { 254, 128, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "fe80::/10" },
+    { 16, 10, { 254, 192, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "fec0::/10" },
+    { 16, 8, { 255, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "ff00::/8" },
+  };
+  // EGRESS-TABLE:END
+  static const unsigned char mapped[12] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff };
+  static const unsigned char nat64[12] = { 0, 0x64, 0xff, 0x9b, 0, 0, 0, 0, 0, 0, 0, 0 };
+  if (len == 16 && (memcmp(a, mapped, 12) == 0 || memcmp(a, nat64, 12) == 0)) { a += 12; len = 4; }
+  else if (len == 16 && a[0] == 0x20 && a[1] == 0x02) { a += 2; len = 4; }
+  for (size_t i = 0; i < sizeof(sb_egress_ranges) / sizeof(sb_egress_ranges[0]); i++) {
+    if (sb_egress_ranges[i].len != len) continue;
+    int bits = sb_egress_ranges[i].bits, whole = bits >> 3, rem = bits & 7;
+    if (memcmp(a, sb_egress_ranges[i].addr, (size_t)whole) != 0) continue;
+    if (rem) {
+      unsigned char m = (unsigned char)(0xff << (8 - rem));
+      if ((a[whole] & m) != (sb_egress_ranges[i].addr[whole] & m)) continue;
+    }
+    return sb_egress_ranges[i].cidr;
+  }
+  return 0;
+}
+
+// SB_EGRESS_ALLOW: "*" or a comma-separated list of exact addresses.
+static int sb_egress_allowed(const char* ip) {
+  const char* p = getenv("SB_EGRESS_ALLOW");
+  if (!p) return 0;
+  size_t n = strlen(ip);
+  while (*p) {
+    while (*p == ' ' || *p == ',') p++;
+    const char* start = p;
+    while (*p && *p != ',') p++;
+    const char* end = p;
+    while (end > start && end[-1] == ' ') end--;
+    size_t len = (size_t)(end - start);
+    if ((len == 1 && *start == '*') || (len == n && len > 0 && memcmp(start, ip, n) == 0)) return 1;
+  }
+  return 0;
+}
+
+// 1 and the refusal in msg when fetch() may not connect to sa.
+static int sb_egress_refused(const char* host, const struct sockaddr* sa, char* msg, size_t msglen) {
+  const unsigned char* bytes;
+  int len;
+  if (sa->sa_family == AF_INET) { bytes = (const unsigned char*)&((const struct sockaddr_in*)sa)->sin_addr; len = 4; }
+  else if (sa->sa_family == AF_INET6) { bytes = ((const struct sockaddr_in6*)sa)->sin6_addr.s6_addr; len = 16; }
+  else { snprintf(msg, msglen, "fetch() refused: %s resolves to a non-IP address", host); return 1; }
+  char ip[INET6_ADDRSTRLEN];
+  if (!inet_ntop(sa->sa_family, bytes, ip, sizeof(ip))) {
+    snprintf(msg, msglen, "fetch() refused: %s resolves to an unprintable address", host);
+    return 1;
+  }
+  if (sb_egress_allowed(ip)) return 0;
+  const char* cidr = sb_egress_blocked(bytes, len);
+  if (!cidr) return 0;
+  snprintf(msg, msglen,
+           "fetch() refused: %s resolves to %s, a private or reserved address (%s). An operator can allow it with SB_EGRESS_ALLOW=%s",
+           host, ip, cidr, ip);
+  return 1;
+}
+// EGRESS:END
+
+// refused gets the first refusal; a caller reports it when nothing connected.
+static int sb_tcp_connect(const char* host, int port, char* refused, size_t refused_len) {
   struct addrinfo hints, *res = 0, *it;
   memset(&hints, 0, sizeof(hints));
   hints.ai_family = AF_UNSPEC;
   hints.ai_socktype = SOCK_STREAM;
   char portstr[16];
   snprintf(portstr, sizeof(portstr), "%d", port);
-  if (getaddrinfo(host, portstr, &hints, &res) != 0 || !res) return -1;
+  // URL.hostname keeps an IPv6 literal's brackets; getaddrinfo wants it bare.
+  char bare[256];
+  size_t hl = strlen(host);
+  if (hl > 2 && hl < sizeof(bare) && host[0] == '[' && host[hl - 1] == ']') {
+    memcpy(bare, host + 1, hl - 2);
+    bare[hl - 2] = 0;
+  } else {
+    snprintf(bare, sizeof(bare), "%s", host);
+  }
+  if (getaddrinfo(bare, portstr, &hints, &res) != 0 || !res) return -1;
   int fd = -1;
   for (it = res; it; it = it->ai_next) {
+    char why[512];
+    if (sb_egress_refused(host, it->ai_addr, why, sizeof(why))) {
+      if (!refused[0]) snprintf(refused, refused_len, "%s", why);
+      continue;
+    }
     fd = socket(it->ai_family, it->ai_socktype, it->ai_protocol);
     if (fd < 0) continue;
     struct timeval tv; tv.tv_sec = 30; tv.tv_usec = 0;
@@ -1042,14 +1150,15 @@ static int sb_tcp_connect(const char* host, int port) {
   return fd;
 }
 
+// body_len, not strlen(body): a binary body can contain NUL bytes (#232).
 static void sb_build_request(sb_buf* req, const char* host, const char* path, const char* method,
-                             const char* headers, const char* body) {
+                             const char* headers, const char* body, size_t body_len) {
   sb_puts(req, method); sb_puts(req, " "); sb_puts(req, path); sb_puts(req, " HTTP/1.1\r\n");
   sb_puts(req, "Host: "); sb_puts(req, host); sb_puts(req, "\r\n");
   sb_puts(req, "Connection: close\r\n");
   sb_puts(req, "Accept-Encoding: identity\r\n");
   if (headers && *headers) sb_puts(req, headers);
-  size_t blen = body ? strlen(body) : 0;
+  size_t blen = body ? body_len : 0;
   if (blen) {
     char cl[64];
     int k = snprintf(cl, sizeof(cl), "Content-Length: %zu\r\n", blen);
@@ -1153,12 +1262,13 @@ static char* sb_error_json(const char* prefix, const char* detail) {
 }
 
 static char* sb_http_plain(const char* host, int port, const char* path, const char* method,
-                           const char* headers, const char* body) {
-  int fd = sb_tcp_connect(host, port);
-  if (fd < 0) return sb_error_json("could not connect to ", host);
+                           const char* headers, const char* body, size_t body_len) {
+  char refused[512] = "";
+  int fd = sb_tcp_connect(host, port, refused, sizeof(refused));
+  if (fd < 0) return refused[0] ? sb_error_json(refused, 0) : sb_error_json("could not connect to ", host);
 
   sb_buf req = { 0, 0, 0 };
-  sb_build_request(&req, host, path, method, headers, body);
+  sb_build_request(&req, host, path, method, headers, body, body_len);
   size_t sent = 0;
   while (sent < req.len) {
     long n = write(fd, req.p + sent, req.len - sent);
@@ -1343,9 +1453,10 @@ static int sb_sock_write(void* ctx, const unsigned char* buf, size_t len) {
 }
 
 static char* sb_https(const char* host, int port, const char* path, const char* method,
-                      const char* headers, const char* body) {
-  int fd = sb_tcp_connect(host, port);
-  if (fd < 0) return sb_error_json("could not connect to ", host);
+                      const char* headers, const char* body, size_t body_len) {
+  char refused[512] = "";
+  int fd = sb_tcp_connect(host, port, refused, sizeof(refused));
+  if (fd < 0) return refused[0] ? sb_error_json(refused, 0) : sb_error_json("could not connect to ", host);
 
   br_ssl_client_context* sc = (br_ssl_client_context*)malloc(sizeof(br_ssl_client_context));
   br_x509_minimal_context* xc = (br_x509_minimal_context*)malloc(sizeof(br_x509_minimal_context));
@@ -1362,7 +1473,7 @@ static char* sb_https(const char* host, int port, const char* path, const char*
   br_sslio_init(&ioc, &sc->eng, sb_sock_read, &fd, sb_sock_write, &fd);
 
   sb_buf req = { 0, 0, 0 };
-  sb_build_request(&req, host, path, method, headers, body);
+  sb_build_request(&req, host, path, method, headers, body, body_len);
   int wrote = br_sslio_write_all(&ioc, req.p, req.len);
   free(req.p);
   if (wrote != 0) {
@@ -1412,9 +1523,9 @@ static char* sb_https(const char* host, int port, const char* path, const char*
 }
 
 static char* sb_http_request(const char* host, int port, const char* path, const char* method,
-                             const char* headers, const char* body, int tls) {
-  return tls ? sb_https(host, port, path, method, headers, body)
-             : sb_http_plain(host, port, path, method, headers, body);
+                             const char* headers, const char* body, size_t body_len, int tls) {
+  return tls ? sb_https(host, port, path, method, headers, body, body_len)
+             : sb_http_plain(host, port, path, method, headers, body, body_len);
 }
 `;
 
@@ -1697,7 +1808,7 @@ function __sbD1BackupRaw(src, dest) {
 }
 
 // Outbound HTTP. String params so C can read each directly; the JS side has
-// already split the URL and enforced the allowlist. `tlsFlag` is "1" or "0" —
+// already split the URL; the connect refuses private addresses. `tlsFlag` is "1" or "0" —
 // a string like the rest, so the marshalling stays uniform.
 // oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
 function __sbHttpRaw(host, portStr, path, method, headersText, body, tlsFlag) {
@@ -1730,17 +1841,33 @@ function __sbHttpRaw(host, portStr, path, method, headersText, body, tlsFlag) {
     char* __hdrs = (char*)malloc(__hdl + 1); memcpy(__hdrs, __hd, __hdl); __hdrs[__hdl] = 0;
     if (__hdo) free(__hdo);
 
-    const char* __b; size_t __bl; char* __bo = 0;
-    porf_native_fetch_read_value(body, &__b, &__bl, &__bo);
-    char* __body = (char*)malloc(__bl + 1); memcpy(__body, __b, __bl); __body[__bl] = 0;
-    if (__bo) free(__bo);
-
+    // tlsFlag is "0"/"1", plus "b" when the body is raw bytes (#233-style flag
+    // for #232's request half): one char per byte, sent as-is, not UTF-8 encoded.
     const char* __t; size_t __tl; char* __to = 0;
     porf_native_fetch_read_value(tlsFlag, &__t, &__tl, &__to);
     int __tls = (__tl > 0 && __t[0] == '1') ? 1 : 0;
+    int __rawBody = (__tl > 1 && __t[1] == 'b') ? 1 : 0;
     if (__to) free(__to);
 
-    char* __out = sb_http_request(__host, atoi(__portbuf), __path, __method, __hdrs, __body, __tls);
+    const char* __b; size_t __bl; char* __bo = 0;
+    if (__rawBody && porf_native_fetch_read_raw_bytes(body, &__b, &__bl) == 0) {
+      // a bytestring is already one byte per char
+    } else if (__rawBody && body.type == 67) {
+      // A UTF-16 string (type 67: u32 length, then u16 units) still holds one
+      // byte per unit here; narrow each unit instead of UTF-8 encoding it.
+      const u32 __bp = (u32)body.val;
+      __bl = (size_t)*(u32*)(MEM + __bp);
+      __bo = (char*)malloc(__bl + 1);
+      const u16* __bs = (const u16*)(MEM + __bp + 4);
+      for (size_t __i = 0; __i < __bl; __i++) __bo[__i] = (char)(__bs[__i] & 0xff);
+      __b = __bo;
+    } else {
+      porf_native_fetch_read_value(body, &__b, &__bl, &__bo);
+    }
+    char* __body = (char*)malloc(__bl + 1); memcpy(__body, __b, __bl); __body[__bl] = 0;
+    if (__bo) free(__bo);
+
+    char* __out = sb_http_request(__host, atoi(__portbuf), __path, __method, __hdrs, __body, __bl, __tls);
     free(__host); free(__path); free(__method); free(__hdrs); free(__body);
     if (__out) {
       res = porf_box((f64)porf_native_fetch_alloc_bytestring(__out, strlen(__out)), 195);
@@ -1788,12 +1915,6 @@ function __sbSqlRaw(path, sql, paramsJson) {
 // Deliberately the same SQL and the same partition keys as broker.ts. When one
 // changes the other has to, and the conformance suite is what says so.
 
-// The allowlist is baked into the module by wrap.ts; read it lazily so the
-// dispatch has no import-order dependency on __sbInstallBindings.
-function bindingsOutbound() {
-  return globalThis.__sbOutbound || [];
-}
-
 var __sbDataDir = "";
 function __sbDir() {
   // SB_DATA_DIR, then SPROUTBOAT_DATA, then <name>.data relative to the working
@@ -1835,6 +1956,10 @@ function __sbEnsureSchema() {
   let hasKvExpiresAt = false;
   for (let i = 0; i < kvColumns.length; i++) if (kvColumns[i][1] === "expires_at") hasKvExpiresAt = true;
   if (!hasKvExpiresAt) __sbSql(s, "ALTER TABLE kv ADD COLUMN expires_at INTEGER", []);
+  // #233 — 1 when the value was put as bytes, same column as the broker's.
+  let hasKvBinary = false;
+  for (let i = 0; i < kvColumns.length; i++) if (kvColumns[i][1] === "binary") hasKvBinary = true;
+  if (!hasKvBinary) __sbSql(s, "ALTER TABLE kv ADD COLUMN binary INTEGER NOT NULL DEFAULT 0", []);
   // #56 — no `body` column: an object's bytes live in their own file under
   // "<data-dir>/r2-blobs/" (sb_r2_put_c/sb_r2_get_c), never in the sqlite row.
   __sbSql(
@@ -1928,14 +2053,14 @@ function __sbEmbeddedDispatch(msg) {
   if (op === "ping") return { ok: true, op: "pong", echo: msg.msg };
 
   if (op === "kv.get") {
-    const r = __sbSql(store, "SELECT value, expires_at FROM kv WHERE ns = ? AND key = ?", [msg.ns, msg.key]);
+    const r = __sbSql(store, "SELECT value, expires_at, binary FROM kv WHERE ns = ? AND key = ?", [msg.ns, msg.key]);
     if (!r.rows.length) return { ok: true, found: false, value: null };
     const expiresAt = r.rows[0][1];
     if (expiresAt != null && expiresAt <= Date.now()) {
       __sbSql(store, "DELETE FROM kv WHERE ns = ? AND key = ?", [msg.ns, msg.key]);
       return { ok: true, found: false, value: null };
     }
-    return { ok: true, found: true, value: r.rows[0][0] };
+    return { ok: true, found: true, value: r.rows[0][0], binary: r.rows[0][2] === 1 };
   }
   if (op === "kv.put") {
     // #58 — CF rejects expirationTtl under 60 seconds; matched here.
@@ -1949,8 +2074,8 @@ function __sbEmbeddedDispatch(msg) {
     }
     __sbSql(
       store,
-      "INSERT INTO kv (ns, key, value, expires_at) VALUES (?1,?2,?3,?4) ON CONFLICT (ns, key) DO UPDATE SET value = ?3, expires_at = ?4",
-      [msg.ns, msg.key, msg.value, expiresAt],
+      "INSERT INTO kv (ns, key, value, expires_at, binary) VALUES (?1,?2,?3,?4,?5) ON CONFLICT (ns, key) DO UPDATE SET value = ?3, expires_at = ?4, binary = ?5",
+      [msg.ns, msg.key, msg.value, expiresAt, msg.binary === true ? 1 : 0],
     );
     return { ok: true };
   }
@@ -2027,9 +2152,6 @@ function __sbEmbeddedDispatch(msg) {
     const url = new URL(String(msg.url));
     const tls = url.protocol === "https:";
     if (!tls && url.protocol !== "http:") throw new Error("unsupported protocol: " + url.protocol);
-    const allow = bindingsOutbound();
-    if (allow.indexOf(url.host) === -1)
-      throw new Error("host not in outbound allowlist: " + url.host);
     let headerText = "";
     const pairs = msg.headers || [];
     for (let i = 0; i < pairs.length; i++) {
@@ -2047,7 +2169,7 @@ function __sbEmbeddedDispatch(msg) {
         String(msg.method || "GET").toUpperCase(),
         headerText,
         msg.body == null ? "" : String(msg.body),
-        tls ? "1" : "0",
+        (tls ? "1" : "0") + (msg.bodyBinary === true ? "b" : ""),
       ),
     );
     if (reply.ok === false) throw new Error(reply.error);

package/src/url-host.test.js

@@ -0,0 +1,25 @@
+// #174 — the prelude's URL shim splits `host` into hostname and port. An IPv6
+// literal holds colons of its own, so only the colon after `]` is the port's.
+// Lifted out of the text-only prelude, as client-ip.test.js does.
+import { expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const src = readFileSync(fileURLToPath(new URL("./native-fetch-prelude.js", import.meta.url)), "utf8");
+const start = src.indexOf("function __sbPortColon(");
+const end = src.indexOf("__sbDefineURLAccessor(", start);
+if (start === -1 || end === -1) throw new Error("__sbPortColon not found in prelude");
+// oxlint-disable-next-line no-function-constructor -- lifting a pure block out of the text-only prelude for test
+const portColon = new Function(`${src.slice(start, end)}\nreturn __sbPortColon;`)();
+const split = (host) => {
+  const c = portColon(host);
+  return c === -1 ? [host, ""] : [host.slice(0, c), host.slice(c + 1)];
+};
+
+test("hostname and port split at the port colon, never inside an IPv6 literal", () => {
+  expect(split("example.com")).toEqual(["example.com", ""]);
+  expect(split("example.com:8080")).toEqual(["example.com", "8080"]);
+  expect(split("[::1]")).toEqual(["[::1]", ""]);
+  expect(split("[::1]:9")).toEqual(["[::1]", "9"]);
+  expect(split("[64:ff9b::7f00:2]:443")).toEqual(["[64:ff9b::7f00:2]", "443"]);
+});

package/src/wrap.ts

@@ -58,7 +58,6 @@ export const BASELINE_COMPATIBILITY_DATE = "2026-08-26";
 export type Bindings = {
   kv: string[];
   secrets: string[];
-  outbound: string[];
   d1: string[];
   r2: string[];
   queues: string[];
@@ -78,7 +77,6 @@ export type Bindings = {
 export const EMPTY_BINDINGS: Bindings = {
   kv: [],
   secrets: [],
-  outbound: [],
   d1: [],
   r2: [],
   queues: [],
@@ -94,7 +92,6 @@ function hasBindings(b: Bindings): boolean {
   return (
     b.kv.length > 0 ||
     b.secrets.length > 0 ||
-    b.outbound.length > 0 ||
     b.d1.length > 0 ||
     b.r2.length > 0 ||
     b.queues.length > 0 ||
@@ -204,8 +201,6 @@ export function wrapNativeFetchHandler(
     `globalThis.__sbCompat = ${JSON.stringify(compatibilityDate)};\n` +
     // #15 — the embedded transport derives its default data directory from this.
     `globalThis.__sbAppName = ${JSON.stringify(appName)};\n` +
-    // #15 — and enforces the outbound allowlist itself, with no broker to do it.
-    `globalThis.__sbOutbound = ${JSON.stringify(bindings.outbound)};\n` +
     (assets ? `globalThis.__sbAssets = ${JSON.stringify(assets)};\n` : "");
   // The native transfer hook runs before JavaScript receives its Request. It
   // has a real file-backed implementation only in embedded builds. The broker
@@ -215,9 +210,10 @@ export function wrapNativeFetchHandler(
     transport === "embedded"
       ? `Porffor.c\`const char* sb_standalone_app_name(void) { return ${JSON.stringify(appName)}; }\`;\n`
       : "Porffor.c`typedef struct sb_r2_transfer_ctx { int unused; } sb_r2_transfer_ctx; int sb_r2_transfer_open(const char* a, const char* b, size_t c, sb_r2_transfer_ctx** d) { if (d) *d = 0; return 404; } int sb_r2_transfer_write(sb_r2_transfer_ctx* a, const char* b, size_t c) { return 404; } int sb_r2_transfer_finish(sb_r2_transfer_ctx* a) { return 404; } void sb_r2_transfer_abort(sb_r2_transfer_ctx* a) {} int sb_r2_transfer_download_open(const char* a, const char* b, sb_r2_transfer_ctx** c) { if (c) *c = 0; return 404; } size_t sb_r2_transfer_download_size(sb_r2_transfer_ctx* a) { return 0; } const char* sb_r2_transfer_download_etag(sb_r2_transfer_ctx* a) { return \"\"; } size_t sb_r2_transfer_download_read(sb_r2_transfer_ctx* a, size_t b, char* c, size_t d) { return 0; } void sb_r2_transfer_download_close(sb_r2_transfer_ctx* a) {}`;\n";
-  const wire = hasBindings(bindings)
-    ? `__sbInstallBindings(env, ${JSON.stringify(bindings)});\n`
-    : "";
+  // #174 — fetch() needs no binding: every sprout gets it.
+  const wire =
+    "__sbInstallFetch();\n" +
+    (hasBindings(bindings) ? `__sbInstallBindings(env, ${JSON.stringify(bindings)});\n` : "");
   const registerDO = bindings.do.length
     ? `__sbRegisterDO({ ${bindings.do.map((d) => `${d.className}: ${d.className}`).join(", ")} });\n`
     : "";
@@ -320,7 +316,6 @@ export function readBindingsFromEnv(): Bindings {
   return {
     kv: strings(parsed.kv),
     secrets: strings(parsed.secrets),
-    outbound: strings(parsed.outbound),
     d1: strings(parsed.d1),
     r2: strings(parsed.r2),
     queues: strings(parsed.queues),