@sproutboat/runtime 0.9.6 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @sproutboat/runtime
 
+## 0.11.0
+
+### Minor Changes
+
+- d0e2c05: `request.cf` gains `httpProtocol`, `tlsVersion`, and `tlsCipher` (baronunread/sproutboat#128). Like `clientIp` (#163), these are only populated when the direct peer is listed in `SB_TRUSTED_PROXIES` and it forwarded the corresponding `x-sb-http-protocol` / `x-sb-tls-version` / `x-sb-tls-cipher` header — otherwise they stay absent rather than a guessed or faked value. `colo`, ASN, and geo fields remain out of scope (no GeoIP database on the box).
+
+## 0.10.0
+
+### Minor Changes
+
+- 7287d9b: KV: native key expiration (baronunread/sproutboat#58). `env.KV.put(key, value, { expirationTtl })` / `{ expiration }` now match the Cloudflare Workers contract: `expirationTtl` is seconds from now (rejected below 60, matching CF), `expiration` is an absolute unix-seconds timestamp. An expired key reads as absent from `get()` and is omitted from `list()`; the row is hard-deleted lazily the next time it's touched by a get. No new transport op — both `expirationTtl` and `expiration` are optional fields on the existing `kv.put` frame, so an older broker/prelude pair that ignores them keeps working exactly as before.
+- 7287d9b: Version metadata binding (baronunread/sproutboat#126). `sproutboat.jsonc` gains a `version_metadata` key naming a binding (like wrangler's `[version_metadata]`), and `wrapNativeFetchHandler` bakes `env.<binding> = { id, tag, timestamp }` directly into the module at build time — no broker round trip. `id`/`tag`/`timestamp` are supplied by the caller (the CLI derives them from the artifact digest, the project name, and the build time); this package only wires the config field through and does the baking.
+
 ## 0.9.6
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.9.6",
+  "version": "0.11.0",
   "license": "MIT",
   "type": "module",
   "repository": {

package/src/client-ip.test.js

@@ -17,7 +17,7 @@ const load = new Function(
   "__envMap",
   `${src.slice(start, end)}
    const __sbEnv = (k) => __envMap[k];
-   return { __sbNormalizeIp, __sbIpInCidr, __sbIpTrusted, __sbClientIp, __sbSplitList };`,
+   return { __sbNormalizeIp, __sbIpInCidr, __sbIpTrusted, __sbClientIp, __sbSplitList, __sbTrustedProxyHeader };`,
 );
 const H = load(new Proxy({}, { get: (_, k) => env[k] }));
 
@@ -64,3 +64,22 @@ test("__sbClientIp: an untrusted peer cannot use XFF even if it sends one", () =
   env = { SB_TRUSTED_PROXIES: "10.0.0.0/8" };
   expect(H.__sbClientIp(req({ "x-sb-remote-addr": "198.51.100.9", "x-forwarded-for": "1.1.1.1" }))).toBe("198.51.100.9");
 });
+
+test("__sbTrustedProxyHeader: no trusted proxies configured means the header is ignored", () => {
+  env = {};
+  const r = req({ "x-sb-remote-addr": "127.0.0.1", "x-sb-http-protocol": "HTTP/2" });
+  expect(H.__sbTrustedProxyHeader(r, "x-sb-http-protocol")).toBeUndefined();
+});
+
+test("__sbTrustedProxyHeader: an untrusted direct peer cannot fake it", () => {
+  env = { SB_TRUSTED_PROXIES: "10.0.0.0/8" };
+  const r = req({ "x-sb-remote-addr": "198.51.100.9", "x-sb-tls-version": "TLSv1.3" });
+  expect(H.__sbTrustedProxyHeader(r, "x-sb-tls-version")).toBeUndefined();
+});
+
+test("__sbTrustedProxyHeader: a trusted peer's value passes through, absent stays undefined", () => {
+  env = { SB_TRUSTED_PROXIES: "127.0.0.0/8" };
+  const r = req({ "x-sb-remote-addr": "127.0.0.1", "x-sb-http-protocol": "HTTP/2" });
+  expect(H.__sbTrustedProxyHeader(r, "x-sb-http-protocol")).toBe("HTTP/2");
+  expect(H.__sbTrustedProxyHeader(r, "x-sb-tls-cipher")).toBeUndefined();
+});

package/src/native-fetch-prelude.js

@@ -1170,8 +1170,11 @@ globalThis.__sbInstallBindings = function (target, bindings) {
         const r = __sbRpc("kv.get", { ns, key: String(key) });
         return r.found ? r.value : null;
       },
-      put(key, value) {
-        __sbRpc("kv.put", { ns, key: String(key), value: String(value) });
+      put(key, value, options) {
+        const msg = { ns, key: String(key), value: String(value) };
+        if (options && options.expirationTtl != null) msg.expirationTtl = Number(options.expirationTtl);
+        else if (options && options.expiration != null) msg.expiration = Number(options.expiration);
+        __sbRpc("kv.put", msg);
       },
       delete(key) {
         __sbRpc("kv.delete", { ns, key: String(key) });
@@ -1736,6 +1739,17 @@ function __sbClientIp(request) {
   }
   return peer;
 }
+// #128 — httpProtocol/tlsVersion/tlsCipher: only a trusted front proxy can set
+// these (an untrusted direct peer could otherwise fake any value), so this
+// reuses the same SB_TRUSTED_PROXIES chain #163 already resolves clientIp
+// against. Undefined when no trusted proxy is configured or it sent nothing —
+// omitted, not faked, matching how clientIp itself falls back to the raw peer.
+function __sbTrustedProxyHeader(request, name) {
+  const peer = __sbNormalizeIp(request.headers.get("x-sb-remote-addr") || "");
+  const trusted = __sbSplitList(__sbEnv("SB_TRUSTED_PROXIES"));
+  if (!trusted.length || !__sbIpTrusted(peer, trusted)) return undefined;
+  return request.headers.get(name) || undefined;
+}
 
 // #57 — ctx.waitUntil: work that must run before the turn completes but must
 // not block the response the handler already built. `waitUntil(p)` just
@@ -1821,9 +1835,18 @@ async function __sbQueueWithDrain(result, tasks) {
 globalThis.__sbEntry = function (handlers, request) {
   const trigger = request.headers.get("x-sb-trigger");
   if (!trigger) {
-    // #163 — expose the resolved client IP the Workers way, before the handler runs.
+    // #163/#128 — expose the request metadata the edge already has, the
+    // Workers way, before the handler runs. httpProtocol/tlsVersion/tlsCipher
+    // are only set when a trusted front proxy forwarded them; colo, ASN and
+    // geo fields stay absent everywhere (#128 explicitly rejects faking them).
     const __cf = request.cf || {};
     __cf.clientIp = __sbClientIp(request);
+    const __httpProtocol = __sbTrustedProxyHeader(request, "x-sb-http-protocol");
+    if (__httpProtocol) __cf.httpProtocol = __httpProtocol;
+    const __tlsVersion = __sbTrustedProxyHeader(request, "x-sb-tls-version");
+    if (__tlsVersion) __cf.tlsVersion = __tlsVersion;
+    const __tlsCipher = __sbTrustedProxyHeader(request, "x-sb-tls-cipher");
+    if (__tlsCipher) __cf.tlsCipher = __tlsCipher;
     request.cf = __cf;
     // #28 — per-invocation CPU time. One fetch turn per process (serial), so the
     // process CPU delta across the handler is this invocation's CPU.

package/src/transport-embedded.js

@@ -1779,8 +1779,13 @@ function __sbEnsureSchema() {
   const s = __sbStore();
   __sbSql(
     s,
-    "CREATE TABLE IF NOT EXISTS kv (ns TEXT NOT NULL, key TEXT NOT NULL, value TEXT NOT NULL, PRIMARY KEY (ns, key))",
+    "CREATE TABLE IF NOT EXISTS kv (ns TEXT NOT NULL, key TEXT NOT NULL, value TEXT NOT NULL, " +
+      "expires_at INTEGER, PRIMARY KEY (ns, key))",
   );
+  const kvColumns = __sbSql(s, "PRAGMA table_info(kv)", []).rows;
+  let hasKvExpiresAt = false;
+  for (let i = 0; i < kvColumns.length; i++) if (kvColumns[i][1] === "expires_at") hasKvExpiresAt = true;
+  if (!hasKvExpiresAt) __sbSql(s, "ALTER TABLE kv ADD COLUMN expires_at INTEGER", []);
   // #56 — no `body` column: an object's bytes live in their own file under
   // "<data-dir>/r2-blobs/" (sb_r2_put_c/sb_r2_get_c), never in the sqlite row.
   __sbSql(
@@ -1869,16 +1874,29 @@ function __sbEmbeddedDispatch(msg) {
   if (op === "ping") return { ok: true, op: "pong", echo: msg.msg };
 
   if (op === "kv.get") {
-    const r = __sbSql(store, "SELECT value FROM kv WHERE ns = ? AND key = ?", [msg.ns, msg.key]);
-    return r.rows.length
-      ? { ok: true, found: true, value: r.rows[0][0] }
-      : { ok: true, found: false, value: null };
+    const r = __sbSql(store, "SELECT value, expires_at FROM kv WHERE ns = ? AND key = ?", [msg.ns, msg.key]);
+    if (!r.rows.length) return { ok: true, found: false, value: null };
+    const expiresAt = r.rows[0][1];
+    if (expiresAt != null && expiresAt <= Date.now()) {
+      __sbSql(store, "DELETE FROM kv WHERE ns = ? AND key = ?", [msg.ns, msg.key]);
+      return { ok: true, found: false, value: null };
+    }
+    return { ok: true, found: true, value: r.rows[0][0] };
   }
   if (op === "kv.put") {
+    // #58 — CF rejects expirationTtl under 60 seconds; matched here.
+    let expiresAt = null;
+    if (msg.expirationTtl != null) {
+      const ttl = Number(msg.expirationTtl);
+      if (!(ttl >= 60)) throw new Error("expirationTtl must be at least 60 seconds");
+      expiresAt = Date.now() + ttl * 1000;
+    } else if (msg.expiration != null) {
+      expiresAt = Number(msg.expiration) * 1000;
+    }
     __sbSql(
       store,
-      "INSERT INTO kv (ns, key, value) VALUES (?1,?2,?3) ON CONFLICT (ns, key) DO UPDATE SET value = ?3",
-      [msg.ns, msg.key, msg.value],
+      "INSERT INTO kv (ns, key, value, expires_at) VALUES (?1,?2,?3,?4) ON CONFLICT (ns, key) DO UPDATE SET value = ?3, expires_at = ?4",
+      [msg.ns, msg.key, msg.value, expiresAt],
     );
     return { ok: true };
   }
@@ -1887,10 +1905,11 @@ function __sbEmbeddedDispatch(msg) {
     return { ok: true };
   }
   if (op === "kv.list") {
-    const r = __sbSql(store, "SELECT key FROM kv WHERE ns = ? AND key LIKE ? || '%' ORDER BY key", [
-      msg.ns,
-      msg.prefix || "",
-    ]);
+    const r = __sbSql(
+      store,
+      "SELECT key FROM kv WHERE ns = ? AND key LIKE ? || '%' AND (expires_at IS NULL OR expires_at > ?) ORDER BY key",
+      [msg.ns, msg.prefix || "", Date.now()],
+    );
     const keys = [];
     for (let i = 0; i < r.rows.length; i++) keys.push(r.rows[i][0]);
     return { ok: true, keys };

package/src/wrap.ts

@@ -177,6 +177,13 @@ export function wrapNativeFetchHandler(
   assets?: { manifest: unknown; files: Record<string, string> },
   /** The selected transport determines whether the direct-transfer C ABI is real or stubbed. */
   transport: Transport = "broker",
+  /**
+   * #126 — `env.<binding> = { id, tag, timestamp }`. Baked at build time from the
+   * artifact digest, like `vars`: the control plane's own deployment id is a
+   * separate, later-assigned thing (minted at upload), so this is the artifact's
+   * own self-describing identity rather than a broker round trip.
+   */
+  versionMetadata?: { binding: string; id: string; tag: string; timestamp: string },
 ): string {
   const neutralised = neutraliseExports(source);
   if (neutralised === null || !/\bfetch\s*\(/.test(source)) {
@@ -184,6 +191,13 @@ export function wrapNativeFetchHandler(
   }
 
   const env = `const env = ${JSON.stringify(vars)};\nglobalThis.env = env;\n`;
+  const versionMetadataLine = versionMetadata
+    ? `env[${JSON.stringify(versionMetadata.binding)}] = ${JSON.stringify({
+        id: versionMetadata.id,
+        tag: versionMetadata.tag,
+        timestamp: versionMetadata.timestamp,
+      })};\n`
+    : "";
   // Baked, not a binding: the date belongs to the artifact, and a handler must
   // not be able to change the semantics it was compiled against at runtime.
   const compat =
@@ -215,7 +229,7 @@ export function wrapNativeFetchHandler(
     : "";
 
   return (
-    `${prelude}\n${nativeTransferAbi}${compat}${env}${wire}` +
+    `${prelude}\n${nativeTransferAbi}${compat}${env}${versionMetadataLine}${wire}` +
     `${neutralised}\n` +
     `${registerDO}${triggers}` +
     `export default {\n  port: ${port},\n  fetch(request) { return __sbEntry(__sbHandlers, request); }\n};\n`