@sproutboat/runtime 0.19.2 → 0.21.0

package/CHANGELOG.md

@@ -1,5 +1,100 @@
 # @sproutboat/runtime
 
+## 0.21.0
+
+### Minor Changes
+
+- 6f253b9: Service bindings support Workers RPC.
+  
+  **Callee.** A deployment whose default export extends `WorkerEntrypoint`, imported from `cloudflare:workers`, exposes its methods:
+  
+  - `env.SERVICE.add(2, 3)` runs `add(2, 3)` on a fresh instance, with `this.env` and `this.ctx` set, and resolves to its result.
+  - Arguments and results are copied as structured clone does: `undefined`, `NaN`, `-0`, `Date`, `RegExp`, binary data, `Map`, `Set` and errors survive the trip.
+  - An error the method throws rejects the call with the same class and message.
+  - An unknown method rejects with workerd's `TypeError`.
+  - Passing functions or RPC stubs is not supported yet.
+  
+  **Where it works.** RPC travels over the service-binding calls a platform edge vouches for, so no client can invoke a method.
+  
+  **Imports.** `cloudflare:workers` provides `WorkerEntrypoint`, `DurableObject`, `RpcTarget` and `env`. The runtime turns the import into globals, so a handler that imports it runs both bundled and as plain ESM.
+  
+  **Default exports.**
+  - A class default export is instantiated per request, for `fetch`, `scheduled` and `queue`.
+  - A `WorkerEntrypoint` may have no `fetch` at all.
+
+### Patch Changes
+
+- 581c2f4: `atob()` and `btoa()` give the right result for any string. They used Porffor's own implementations, which read how a string is stored, so they went wrong on strings held as UTF-16, such as ones from `JSON.parse` or `TextDecoder`:
+  
+  - `atob(JSON.parse('"AQL/"'))` returned two wrong bytes instead of `01 02 ff`;
+  - `btoa` of a parsed `"héllo"` encoded the UTF-16 storage.
+  
+  Both are now plain JavaScript, with the same validation and errors as before.
+
+## 0.20.0
+
+### Minor Changes
+
+- 85aa74d: Service-binding calls and outbound `fetch()` no longer block a deployed sprout. In a deployed sprout, each call runs off the event loop on one I/O thread, so the sprout keeps answering other requests while a call is in flight. Concurrent calls overlap: eight 500 ms calls finish in about 510 ms, where they used to queue for about 4 s. A deployment can also call itself through a binding, to any depth, where this used to deadlock. The toolchain installs the loop hook the runtime uses for this; with an older runtime it does nothing.
+  
+  `env.SERVICE.fetch()` now always returns a promise, as in Workers, and reads its arguments as `fetch()` does:
+  
+  - a `URL` object works as input;
+  - `fetch(request, init)` keeps the request's body when `init` sets no body of its own;
+  - a `ReadableStream` body is sent whole, where it used to arrive as the text `[object ReadableStream]`.
+  
+  Responses from bindings and from `fetch()` keep every `Set-Cookie` header, where they used to keep only the last one.
+  
+  A broker exchange is now resent only when the broker cannot have acted on it: the request never fully left, or the connection had gone stale. A `fetch` or service call that the broker may already have run is no longer repeated.
+- f2d2b72: Service-binding calls behave as in workerd in two more ways, on a platform edge that vouches for them:
+  
+  - **The callee sees the caller's URL.** `request.url` is the URL the caller passed (`https://peer/path`), where it used to be the callee deployment's own hostname.
+  - **A callee that throws makes the caller throw.** The caller's `fetch()` rejects with the callee's error, keeping its class for standard errors and its message, where it used to get a plain 500 response.
+  
+  How the platform vouches for a call:
+  
+  1. The broker sends each service call with the edge's secret (`SB_EDGE_SECRET`, which the edge gives only to brokers) and the caller's URL.
+  2. The edge forwards the call to the callee with that sprout's own token (`SB_EDGE_TOKEN`).
+  3. The callee trusts a call only when the token matches.
+  
+  A client can forge none of this. The edge removes its headers from every other request, and the error marker never reaches a client.
+  
+  A vouched call also no longer shows the broker's loopback address as `x-sb-remote-addr`. The edge's internal headers are removed before any handler sees a request.
+  
+  In `@sproutboat/wire`, the broker reads `SB_EDGE_SECRET` and takes an `edgeSecret` option.
+- b287117: `fetch()` and service bindings honour an abort signal, set as `init.signal` or a `Request`'s `signal`:
+  
+  - A signal that is already aborted rejects the call at once.
+  - Aborting it later, by hand or through `AbortSignal.timeout()`, rejects the pending call with the signal's reason.
+  
+  In a deployed sprout the abort also stops the work. The sprout closes the call's broker connection, the broker aborts its upstream request when a sprout's connection closes, and the platform's edge stops the callee's request in turn. Before, an abandoned call ran to the end anyway.
+  
+  In sproutd the request still runs to the end, and its late reply is dropped.
+  
+  In `@sproutboat/wire`, `Broker.handleFrame` takes an optional `AbortSignal`, which the broker server aborts when the connection closes.
+- 9773e45: From compatibility date `2026-10-22`, `fetch()` and service bindings follow redirects as Fetch does:
+  
+  - Under `redirect: "follow"`, the default, the request goes again to the new location, up to 20 times. Each outbound hop is checked against the egress rules like the first.
+  - A 303 turns the request into a GET with no body, and so does a 301 or 302 that answers a POST.
+  - A hop to another origin drops `Authorization`.
+  - A service binding follows through the same binding, as in workerd.
+  - `redirect: "error"` rejects with a `TypeError`.
+  - `redirect: "manual"` returns the 3xx as it is.
+  
+  Before this date, a 3xx came back to the handler whatever the mode, and still does for apps with an earlier `compatibility_date`.
+  
+  A response from `fetch()` or a service binding that has no `Content-Type` no longer gains `text/plain;charset=UTF-8`.
+- 3798994: Responses to `fetch()` and service-binding calls stream. In a deployed sprout with compatibility date `2026-10-21` or later, the call resolves as soon as the status and headers arrive. `response.body` is then a `ReadableStream` that receives each chunk as the upstream sends it.
+  
+  Before, the whole body had to arrive first. A response streamed over several seconds, such as server-sent events or a long download, reached the caller only at the end.
+  
+  The 32 MiB `SB_FETCH_MAX_BYTES` cap still applies to the total. Cancelling the body, or aborting the call's signal, stops the upstream request.
+  
+  In `@sproutboat/wire`:
+  - the broker streams a `fetch` or `service.fetch` that asks for it (`stream: true`), sending the head and each chunk as `FRAME_V1_MORE` frames through the new `emit` argument of `handleFrame`;
+  - the final frame ends the response;
+  - a request that doesn't ask is answered whole, as before.
+
 ## 0.19.2
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.19.2",
+  "version": "0.21.0",
   "license": "MIT",
   "type": "module",
   "repository": {