sproutboat 0.11.13 → 0.12.0

package/CHANGELOG.md

@@ -10,6 +10,18 @@ maintained going forward by the `release` skill.
 
 ## Unreleased
 
+## [0.12.0] - 2026-09-28
+
+### Added
+- Run three original Cloudflare Worker examples unchanged: JSON responses,
+  cookie parsing, and redirects. The example suite now checks 21 native apps.
+- Pass `(request, env, ctx)` to fetch handlers using the 2026-09-28
+  compatibility date while preserving the earlier two-argument form for older apps.
+
+### Changed
+- Update to Porffor alpha 10 via `@sproutboat/toolchain@^0.4.14` and use
+  `@sproutboat/runtime@^0.13.0` for native request decoding and redirects.
+
 ## [0.11.13] - 2026-09-26
 
 ### Added
@@ -627,7 +639,8 @@ its own package.
 - Renamed the package to `sproutboat` (was `@sproutboat/cli`); dropped the
   `sprout` bin alias in favour of a user-defined shell alias.
 
-[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.13...HEAD
+[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.12.0...HEAD
+[0.12.0]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.13...v0.12.0
 [0.11.13]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.12...v0.11.13
 [0.11.12]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.11...v0.11.12
 [0.11.11]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.10...v0.11.11

package/SURFACE.md

@@ -3,7 +3,7 @@
 > Generated by `src/surface.test.ts` from `src/surface.ts` + the pinned
 > toolchain constants. Do not edit by hand — run `UPDATE_SURFACE=1 bun test`.
 
-**Package:** `sproutboat` 0.11.13 · runs on Bun (use `bunx`, not `npx`)
+**Package:** `sproutboat` 0.12.0 · runs on Bun (use `bunx`, not `npx`)
 
 ## Commands
 
@@ -76,7 +76,7 @@ usage: sproutboat <init [name] | check [project-dir] | types [project-dir] | dev
 | | |
 | --- | --- |
 | Zig | `0.16.0` (`zig cc -target x86_64-linux-musl`, static) |
-| Provenance stamp | `zig-musl/0.16.0+porffor/de4eb58+uws/360c276d` |
+| Provenance stamp | `zig-musl/0.16.0+porffor/08ac7ee+uws/360c276d` |
 | Artifact schema | `2` |
 | Runtime | `native-fetch` |
 | Capability profile | `http-sync-v0` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.11.13",
+  "version": "0.12.0",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "keywords": [
     "cli",
@@ -64,23 +64,24 @@
     "@sproutboat/artifact": "^0.3.0",
     "@sproutboat/assets": "^0.3.0",
     "@sproutboat/config": "^0.4.0",
-    "@sproutboat/runtime": "^0.12.1",
-    "@sproutboat/toolchain": "^0.4.13",
+    "@sproutboat/runtime": "^0.13.0",
+    "@sproutboat/toolchain": "^0.4.14",
     "@sproutboat/wire": "^0.9.1"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.81.0",
     "@types/bun": "1.4.0",
+    "cookie": "2.0.1",
     "lefthook": "2.1.12",
     "oxfmt": "0.66.0",
     "oxlint": "1.81.0",
     "typescript": "7.0.2"
   },
   "optionalDependencies": {
-    "@sproutboat/cli-darwin-arm64": "0.11.13",
-    "@sproutboat/cli-darwin-x64": "0.11.13",
-    "@sproutboat/cli-linux-arm64": "0.11.13",
-    "@sproutboat/cli-linux-x64": "0.11.13"
+    "@sproutboat/cli-darwin-arm64": "0.12.0",
+    "@sproutboat/cli-darwin-x64": "0.12.0",
+    "@sproutboat/cli-linux-arm64": "0.12.0",
+    "@sproutboat/cli-linux-x64": "0.12.0"
   },
   "engines": {
     "node": ">=18"

package/src/build.ts

@@ -1,5 +1,5 @@
 import { createHash, randomUUID } from "node:crypto";
-import { cp, mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { cp, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
 import { walkAssets, type AssetManifest } from "./assets";
 import { resourceRefs, type SproutboatConfig } from "./config";
@@ -82,7 +82,13 @@ async function integrationIdentity(): Promise<string> {
   const files = ["build.ts", "compile.ts", "sqlite.ts", "bearssl.ts", "toolchain.ts"].map((file) =>
     resolve(import.meta.dir, file),
   );
-  files.push(Bun.resolveSync("@sproutboat/toolchain/patch", import.meta.dir));
+  // Hash the patch implementation and its local modules so a Unicode patch
+  // edit cannot reuse a binary compiled with earlier builtin semantics.
+  const patchDir = dirname(Bun.resolveSync("@sproutboat/toolchain/patch", import.meta.dir));
+  const toolchainFiles = (await readdir(patchDir))
+    .filter((file) => file.endsWith(".ts") && !file.endsWith(".test.ts"))
+    .sort();
+  files.push(...toolchainFiles.map((file) => resolve(patchDir, file)));
   return digest(Buffer.concat(await Promise.all(files.map((file) => readFile(file)))));
 }
 

package/src/bundle.ts

@@ -1,7 +1,7 @@
 /**
  * #89 — bundle the handler before Porffor sees it.
  *
- * Porffor alpha 9 supports ESM imports. We still bundle first so capability
+ * Porffor supports ESM imports. We still bundle first so capability
  * validation sees every dependency and the runtime wrapper receives one
  * controlled default export.
  *

package/src/toolchain.ts

@@ -38,7 +38,7 @@ const ZIG_SHA256 = {
 // frozen reference handlers and update its COMPAT.md for any new mismatch before
 // releasing — the alpha compiler's output can shift between pins. Checked by
 // hand at bump time, not in CI.
-// uWebSockets commit Porffor alpha-4 fetches for the native-fetch server.
+// uWebSockets commit Porffor alpha-10 fetches for the native-fetch server.
 const UWS_COMMIT = "360c276d";
 const UWS_COMMIT_FULL = "360c276d609d59af56ae6932adb95154ace9f15f";
 
@@ -678,7 +678,7 @@ export function porfforVersion(): string {
 
 export function esbuildVersion(): string {
   // Legacy artifact field, retained so older control planes can read manifests.
-  // Handler bundling uses Bun.build and Porffor alpha 9 needs no esbuild binary.
+  // Handler bundling uses Bun.build and Porffor alpha 10 needs no esbuild binary.
   return "unused";
 }
 

package/src/types-gen.ts

@@ -1,10 +1,9 @@
 /**
  * `sproutboat types` — the project's `env`, as TypeScript.
  *
- * In Workers `env` is a parameter, so an editor can infer it from a signature.
- * Here it is a global, which means nothing is inferable at all: `env.SESSIONS`
- * is an undeclared identifier until this file exists. That makes generated
- * types worth more here than they are there, not less.
+ * `env` remains available as a global in both compatibility modes. This file
+ * gives it the project's binding names and types. From 2026-09-28 it is also
+ * the second handler argument.
  *
  * The output declares `env` from `sproutboat.jsonc` and references the ambient
  * types shipped in `types/sproutboat.d.ts`, so binding *shapes* version with
@@ -75,6 +74,11 @@ export function generateTypes(config: SproutboatConfig): string {
         .join("\n")
     : "    // No bindings declared in sproutboat.jsonc yet.";
 
+  const handlerNote =
+    config.compatibility_date >= "2026-09-28"
+      ? "The same object is passed as the second handler argument: fetch(request, env, ctx)."
+      : "The handler signature is fetch(request, ctx); env is only a global.";
+
   return `${HEADER}
 /// <reference types="sproutboat/types" />
 
@@ -82,7 +86,7 @@ declare global {
   /**
    * Bindings from sproutboat.jsonc, for project "${config.name}".
    *
-   * A global, not a parameter: the handler signature is \`fetch(request)\`.
+   * ${handlerNote}
    * Every call on these is synchronous, so \`await\` is allowed and does
    * nothing.
    */

package/types/sproutboat.d.ts

@@ -6,9 +6,9 @@
  * generates a project's `sproutboat-env.d.ts`, which references this file and
  * declares `env` with that project's bindings.
  *
- * Two things differ from Cloudflare Workers and are the reason these exist:
- * `env` is a global rather than a parameter, so nothing is inferable from a
- * signature, and every binding call is synchronous.
+ * Bindings are synchronous. Before compatibility date 2026-09-28, `env` is a
+ * global only and `ctx` is the second handler argument. From that date, `env`
+ * is also passed as the second argument and `ctx` as the third.
  */
 
 declare global {
@@ -300,11 +300,7 @@ declare global {
     scheduledTime: number;
   }
 
-  /**
-   * `env` is a global, not a parameter. `ctx` is the second argument, and its
-   * only member is `waitUntil`: work that outlives the response, drained
-   * in-process and capped at 25s.
-   */
+  /** Work that outlives the response, drained in-process and capped at 25s. */
   interface ExecutionContext {
     waitUntil(promise: Promise<unknown>): void;
   }
@@ -318,6 +314,13 @@ declare global {
     queue?(batch: MessageBatch<QueueBody>, ctx: ExecutionContext): void | Promise<void>;
   }
 
+  /** Handler signature for compatibility dates from 2026-09-28. */
+  interface WorkersHandler<Bindings = Record<string, unknown>, QueueBody = unknown> {
+    fetch(request: Request, env: Bindings, ctx: ExecutionContext): Response | Promise<Response>;
+    scheduled?(event: ScheduledEvent, env: Bindings, ctx: ExecutionContext): void | Promise<void>;
+    queue?(batch: MessageBatch<QueueBody>, env: Bindings, ctx: ExecutionContext): void | Promise<void>;
+  }
+
   /**
    * What a Durable Object class implements. Declare it above the default
    * export and name it in `durable_objects`.